Rootkit Fichier caché. Fermé

Question

Bonjour,
je viens chercher de l'aide car en effet AVG 8.0, fonctin Anti-Rootkit m'a détecté un Rootkit qui malheurseusement n'est pas supprimable, c'est un "Pilote Masqué" et plus ennyeux c'est qu'il change de nom a chaque nouvelle analyse... 
De plus il semble avoir affecté mon lecteur CD/DVD qui réagit lorsque j'insère un CD mais qui ne s'affiche pas sur l'ordi...  
Si quelqu'un pouvait me sauver...

jlpjlp · Answer

slt,


Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

Kira · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by Step at 2009-02-01 19:47:49
Microsoft® Windows Vista™ Édition Familiale Basique  Service Pack 1
System drive C: has 10 GB (13%) free of 75 GB
Total RAM: 893 MB (13% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:48:28, on 01/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\Utilities\VolControl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
C:\Windows\vVX1000.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Users\Step\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Users\Step\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Step\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
C:\Users\Step\Desktop\RSIT.exe
C:\Program Files	rend micro\Step.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fhome.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TOSHIBA Volume Indicator] "C:\Program Files\Toshiba\Utilities\VolControl.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information	opi.exe -startup
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\Windows\vVX1000.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Step\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\Step\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin
pjpi160.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin
pjpi160.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR (file missing)
O13 - Gopher Prefix: 
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} (VirginMega.DMFacade.Interface) - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game01.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Kira · Answer

info.txt logfile of random's system information tool 1.05 2009-02-01 19:48:43 ======Uninstall list====== -->"C:\Program Files\InstallShield Installation Information\{A644254B-92F6-4970-8635-AB0775371E72}\setup.exe" --u:{A644254B-92F6-4970-8635-AB0775371E72} -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{622E6F16-0904-49B6-BBE1-4CC836314CCF}\setup.exe" -l0x40c -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{697AFC77-F318-4CD4-BF16-F50F4C1072DA}\setup.exe" -l0x40c Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5101} Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 7.1.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A71000000002} aquaplay-->"C:\Program Files\aquaplay\Uninstall.exe" Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe Assistant de connexion Windows Live-->MsiExec.exe /I{D6E592B3-67DA-4BBB-9783-E1838FB253A2} ATI Catalyst Control Center Ex-->MsiExec.exe /I{44FEBA8C-2C89-E2A9-1423-AE5E5A42F472} AVG 8.0-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL Azureus Vuze-->C:\Program Files\Azureus\uninstall.exe CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe" CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe" Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E} Codeur Windows Media Série 9-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} Codeur Windows Media Série 9-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN DVD MovieFactory for TOSHIBA-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}\setup.exe" -l0x40c ffdshow (remove only)-->"C:\Program Files\ffdshow\uninstall.exe" Football Manager 2008-->"C:\Program Files\Sports Interactive\Football Manager 2008\Uninstall_Football Manager 2008\Uninstall Football Manager 2008.exe" Football Manager 2009-->"C:\Program Files\Sports Interactive\Football Manager 2009\Uninstall_Football Manager 2009\Uninstall Football Manager 2009.exe" Free Video to Mp3 Converter version 2.7-->"C:\Program Files\DVDVIDEOSOFT\Free Video to Mp3 Converter\unins000.exe" Free YouTube to Mp3 Converter version 3.1-->"C:\Program Files\DVDVideoSoft\Free YouTube to Mp3 Converter\unins000.exe" Free YouTube Uploader version 2.2-->"C:\Program Files\DVDVideoSoft\Free YouTube Uploader\unins000.exe" Galerie de photos Windows Live-->MsiExec.exe /X{43563ACB-371B-4C58-8979-B192B390424C} HijackThis 2.0.2-->"C:\Program Files rend micro\HijackThis.exe" /uninstall Hotfix for Windows Media Encoder (KB929182)-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} MSIPATCHREMOVE={5406B219-A1AC-4BC4-8695-72292C8195AC} /qb Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe Installation Windows Live-->MsiExec.exe /I{3CCB732A-E472-4CF9-B1EE-F18365341FE0} Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000} Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A} LimeWire PRO 4.9.37-->"C:\Program Files\LimeWire\uninstall.exe" Manuels TOSHIBA-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{29D59BE2-C15F-4835-B113-121D73924979}\setup.exe" -l0x40c -removeonly Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe" Microsoft LifeCam-->MsiExec.exe /X{968D41C3-25BB-4632-A6DF-2E1C8F0143A4} Microsoft Office FrontPage 2003-->MsiExec.exe /I{9017040C-6000-11D3-8CFE-0150048383C9} Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC} Microsoft Office OneNote 2003-->MsiExec.exe /I{90A1040C-6000-11D3-8CFE-0150048383C9} Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0120-040C-0000-0000000FF1CE} Microsoft Office Personal Portfolio-->MsiExec.exe /I{1FC2BFA9-92DE-40B3-BBC3-31CDBDBE8B95} Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9} Microsoft Office Project Professional 2003-->MsiExec.exe /I{903B040C-6000-11D3-8CFE-0150048383C9} Microsoft Office Visio Professional 2003-->MsiExec.exe /I{9051040C-6000-11D3-8CFE-0150048383C9} Microsoft Reader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B6F7DBE7-2FE2-458F-A738-B10832746036}\Setup.exe" -L0x40c Microsoft Search Enhancement Pack-->MsiExec.exe /I{299CF645-48C7-4FA1-8BCD-5CE200CF180D} Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8} Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5} Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94} MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MUSK Codec Pack v5-->"C:\Program Files\MUSK Codec Pack v5\unins000.exe" neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238} Paint.NET v3.31-->MsiExec.exe /X{51AFB69C-1C54-4C77-A888-2860F8CD3E7D} PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe" Programme d’installation d’Atheros Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\Setup.exe" -l0x40c -removeonly QuickTime-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{3868A8EE-5051-4DB0-8DF6-4F4B8A98D083} /l1036 Real Alternative 1.9.0-->"C:\Program Files\Real Alternative\unins000.exe" Realtek High Definition Audio Driver-->RtlUpd.exe -r -m Réducteur de bruit lect. CD/DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\setup.exe" -l0x40c Search Settings 1.2-->MsiExec.exe /X{D0C73318-7B4A-4D16-A0C4-3B83F075EA88} Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for Windows Media Encoder (KB954156)-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E} MSIPATCHREMOVE={E836F1B7-43FB-46B0-A0D9-E4D2A5951659} /qb SplitCam-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{00718491-55BF-46C6-83EF-4B3B95AC807A}\setup.exe" -l0x9 -removeonly Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3} Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall TOSHIBA Assist-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\setup.exe" -l0x40c TOSHIBA ConfigFree-->C:\Program Files\InstallShield Installation Information\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}\setup.exe -runfromtemp -l0x040cuninstall -removeonly TOSHIBA Disc Creator-->MsiExec.exe /I{5DA0E02F-970B-424B-BF41-513A5018E4C0} TOSHIBA Extended Tiles for Windows Mobility Center-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{617C36FD-0CBE-4600-84B2-441CEB12FADF} /l1036 TOSHIBA Hardware Setup-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{EB0B41B1-E84F-483C-91FF-BB83019EE127} /l1036 Toshiba Online Product Information-->C:\Program Files\InstallShield Installation Information\{2290A680-4083-410A-ADCC-7092C67FC052}\setup.exe -runfromtemp -l0x040c -removeonly TOSHIBA Software Modem-->Tosmreg -U TOSHIBA Supervisor Password-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{BE998F99-4CEB-4E64-B717-493A2E9797F4} /l1036 TOSHIBA Value Added Package-->C:\Program Files\InstallShield Installation Information\{FEDD27A0-B306-45EF-BF58-B527406B42C8}\setup.exe -runfromtemp -l0x040c TOSHIBA Volume Indicator-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{98708E86-46E1-479D-B897-9802E591E762} /l1036 TVUPlayer 2.3.5.4-->C:\Program Files\TVUPlayer\uninst.exe VirginMega DownloadManager-->"C:\Program Files\VirginMega\DownloadManager\Uninstall.exe" "C:\Program Files\VirginMega\DownloadManager\install.log" Windows Live Call-->MsiExec.exe /I{01523985-2098-43AF-9C97-12B07BE02A9B} Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B} Windows Live Contrôle parental-->MsiExec.exe /X{EB8BAA0D-11EF-4EDC-A960-2AB7CA8F53F0} Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657} Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C} Windows Live Movie Maker Bêta-->MsiExec.exe /X{5ED7F74A-B4AB-4209-B99C-B88012C712F2} Windows Live Sync-->MsiExec.exe /X{67D0313C-4F15-437D-9A2D-C1564088A26A} Windows Live Toolbar-->MsiExec.exe /X{915809D6-1F93-45F2-9699-5F1DA64DC24B} Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1} WinDVD for TOSHIBA-->C:\Program Files\InstallShield Installation Information\{20471B27-D702-4FE8-8DEC-0702CC8C0A85}\setup.exe -runfromtemp -l0x040c X-Chat 2.8.4-1-->"C:\Program Files\X-Chat 2\unins000.exe" ======Security center information====== AV: AVG Anti-Virus AS: AVG Anti-Virus (disabled) AS: Windows Defender System event log Computer Name: PC-de-2007 Event Code: 6 Message: Le filtre de système de fichiers « F-Secure Standalone Minifilter » (Version 6.0, 2008-07-25T11:14:32.000Z) s’est chargé et s’est inscrit correctement auprès du gestionnaire de filtres. Record Number: 123917 Source Name: Microsoft-Windows-FilterManager Time Written: 20090201180440.458971-000 Event Type: Information User: AUTORITE NT\SYSTEM Computer Name: PC-de-2007 Event Code: 3004 Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez. Pour plus d’informations, consultez les données suivantes : Non applicable ID d’analyse : {5C615E89-CFDA-4BBA-95A5-9B64B866785A} Utilisateur : PC-de-2007\Step Nom : Unknown ID : ID de gravité : ID de catégorie : Chemin d’accès trouvé : driver:F-Secure Standalone Minifilter;file:C:\Users\Step\AppData\Local\Temp\Low\OnlineScanner\Anti-Virus\fsgk.sys Type d’alerte : Logiciel non classifié Type de détection : Record Number: 123918 Source Name: Microsoft-Windows-Windows Defender Time Written: 20090201180611.000000-000 Event Type: Avertissement User: Computer Name: PC-de-2007 Event Code: 3005 Message: L’agent de protection en temps réel Windows Defender a pris des mesures pour protéger cet ordinateur contre les logiciels espions ou autres logiciels potentiellement indésirables. Pour plus d’informations, consultez les informations suivantes : Non applicable ID d’analyse : {5C615E89-CFDA-4BBA-95A5-9B64B866785A} Utilisateur : PC-de-2007\Step Nom : Unknown ID : ID de gravité : ID de catégorie : Type d’alerte : Logiciel non classifié Action : Ignorer Record Number: 123919 Source Name: Microsoft-Windows-Windows Defender Time Written: 20090201180614.000000-000 Event Type: Information User: Computer Name: PC-de-2007 Event Code: 1 Message: Filtre de système de fichiers « F-Secure Standalone Minifilter » (Version 6.0, 2008-07-25T11:14:32.000Z) déchargé correctement. Record Number: 123920 Source Name: Microsoft-Windows-FilterManager Time Written: 20090201181514.042443-000 Event Type: Information User: AUTORITE NT\SYSTEM Computer Name: PC-de-2007 Event Code: 7036 Message: Le service Service de découverte automatique de Proxy Web pour les services HTTP Windows est entré dans l'état : arrêté. Record Number: 123921 Source Name: Service Control Manager Time Written: 20090201182236.000000-000 Event Type: Information User: Application event log Computer Name: PC-de-2007 Event Code: 3013 Message: Impossible de mettre à jour l'entrée dans la configuration de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique attaché au système ne fonctionne pas correctement. (0x8007001f) Record Number: 34332 Source Name: Microsoft-Windows-Search Time Written: 20090201181253.000000-000 Event Type: Erreur User: Computer Name: PC-de-2007 Event Code: 3013 Message: Impossible de mettre à jour l'entrée dans la configuration de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique attaché au système ne fonctionne pas correctement. (0x8007001f) Record Number: 34333 Source Name: Microsoft-Windows-Search Time Written: 20090201181254.000000-000 Event Type: Erreur User: Computer Name: PC-de-2007 Event Code: 3013 Message: Impossible de mettre à jour l'entrée dans la configuration de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique attaché au système ne fonctionne pas correctement. (0x8007001f) Record Number: 34334 Source Name: Microsoft-Windows-Search Time Written: 20090201181254.000000-000 Event Type: Erreur User: Computer Name: PC-de-2007 Event Code: 3013 Message: Impossible de mettre à jour l'entrée dans la configuration de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique attaché au système ne fonctionne pas correctement. (0x8007001f) Record Number: 34335 Source Name: Microsoft-Windows-Search Time Written: 20090201181733.000000-000 Event Type: Erreur User: Computer Name: PC-de-2007 Event Code: 3013 Message: Impossible de mettre à jour l'entrée dans la configuration de hachage. Contexte : Application , Catalogue SystemIndex Détails : Un périphérique attaché au système ne fonctionne pas correctement. (0x8007001f) Record Number: 34336 Source Name: Microsoft-Windows-Search Time Written: 20090201181733.000000-000 Event Type: Erreur User: Security event log Computer Name: PC-de-2007 Event Code: 4648 Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites. Sujet : ID de sécurité : S-1-5-18 Nom du compte : PC-DE-2007$ Domaine du compte : WORKGROUP ID d’ouverture de session : 0x3e7 GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Compte dont les informations d’identification ont été utilisées : Nom du compte : Step Domaine du compte : PC-de-2007 GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Serveur cible : Nom du serveur cible : localhost Informations supplémentaires : localhost Informations sur le processus : ID du processus : 0x2f8 Nom du processus : C:\Windows\System32\winlogon.exe Informations sur le réseau : Adresse du réseau : 127.0.0.1 Port : 0 Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS. Record Number: 35739 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081124183454.543615-000 Event Type: Succès de l'audit User: Computer Name: PC-de-2007 Event Code: 4624 Message: L’ouverture de session d’un compte s’est correctement déroulée. Sujet : ID de sécurité : S-1-5-18 Nom du compte : PC-DE-2007$ Domaine du compte : WORKGROUP ID d’ouverture de session : 0x3e7 Type d’ouverture de session : 2 Nouvelle ouverture de session : ID de sécurité : S-1-5-21-3104662218-1256191170-3440181771-1002 Nom du compte : Step Domaine du compte : PC-de-2007 ID d’ouverture de session : 0x2372a GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Informations sur le processus : ID du processus : 0x2f8 Nom du processus : C:\Windows\System32\winlogon.exe Informations sur le réseau : Nom de la station de travail : PC-DE-2007 Adresse du réseau source : 127.0.0.1 Port source : 0 Informations détaillées sur l’authentification : Processus d’ouverture de session : User32 Package d’authentification : Negotiate Services en transit : - Nom du package (NTLM uniquement) : - Longueur de la clé : 0 Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée. Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe. Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau). Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté. Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas. Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique. - Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC . - Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session. - Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM. - La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée. Record Number: 35740 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081124183454.543615-000 Event Type: Succès de l'audit User: Computer Name: PC-de-2007 Event Code: 4624 Message: L’ouverture de session d’un compte s’est correctement déroulée. Sujet : ID de sécurité : S-1-5-18 Nom du compte : PC-DE-2007$ Domaine du compte : WORKGROUP ID d’ouverture de session : 0x3e7 Type d’ouverture de session : 2 Nouvelle ouverture de session : ID de sécurité : S-1-5-21-3104662218-1256191170-3440181771-1002 Nom du compte : Step Domaine du compte : PC-de-2007 ID d’ouverture de session : 0x2374a GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Informations sur le processus : ID du processus : 0x2f8 Nom du processus : C:\Windows\System32\winlogon.exe Informations sur le réseau : Nom de la station de travail : PC-DE-2007 Adresse du réseau source : 127.0.0.1 Port source : 0 Informations détaillées sur l’authentification : Processus d’ouverture de session : User32 Package d’authentification : Negotiate Services en transit : - Nom du package (NTLM uniquement) : - Longueur de la clé : 0 Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée. Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe. Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau). Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté. Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas. Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique. - Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC . - Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session. - Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM. - La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée. Record Number: 35741 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081124183454.543615-000 Event Type: Succès de l'audit User: Computer Name: PC-de-2007 Event Code: 4672 Message: Privilèges spéciaux attribués à la nouvelle ouverture de session. Sujet : ID de sécurité : S-1-5-21-3104662218-1256191170-3440181771-1002 Nom du compte : Step Domaine du compte : PC-de-2007 ID d’ouverture de session : 0x2372a Privilèges : SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege Record Number: 35742 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081124183454.543615-000 Event Type: Succès de l'audit User: Computer Name: PC-de-2007 Event Code: 4648 Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites. Sujet : ID de sécurité : S-1-5-18 Nom du compte : PC-DE-2007$ Domaine du compte : WORKGROUP ID d’ouverture de session : 0x3e7 GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Compte dont les informations d’identification ont été utilisées : Nom du compte : SYSTEM Domaine du compte : AUTORITE NT GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000} Serveur cible : Nom du serveur cible : localhost Informations supplémentaires : localhost Informations sur le processus : ID du processus : 0x274 Nom du processus : C:\Windows\System32\services.exe Informations sur le réseau : Adresse du réseau : - Port : - Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS. Record Number: 35743 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20081124183515.234938-000 Event Type: Succès de l'audit User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Ulead Systems\MPEG;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\Adobe\AGL "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=x86 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 14 Stepping 12, GenuineIntel "PROCESSOR_REVISION"=0e0c "NUMBER_OF_PROCESSORS"=2 "CLASSPATH"=C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files\Java\jre1.6.0\lib\ext\QTJava.zip -----------------EOF----------------- Et vvoici le Fichier Info

jlpjlp · Answer

ok vire cette tache planifiée  "edufbfyu"   si tu ne la connais pas en allant dans:

poste de travail puis C:\Windows	asks\edufbfyu.job 


______________

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D. 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)

Kira · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Basique  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2060  @ 1.60GHz )
   BIOS : Phoenix NoteBIOS 4.0 Release 6.1     
   USER : Step ( Administrator )
   BOOT : Normal boot
   Antivirus : AVG Anti-Virus 8.0 (Activated)
   C:\ (Local Disk) - NTFS - Total:73 Go (Free:9 Go)
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 01/02/2009|20:21 )

   [ UAC => 1 ]

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\DAEMON Tools Toolbar
   C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   C:\Program Files\DAEMON Tools Toolbar\Resources
   C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
   C:\Program Files\DAEMON Tools Toolbar\Resources\about.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\as.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\as.png
   C:\Program Files\DAEMON Tools Toolbar\Resources\astro.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\b1.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\b1.png
   C:\Program Files\DAEMON Tools Toolbar\Resources\BurnImage.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\buy.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond000.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond001.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond003.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond004.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond005.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond006.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond007.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond008.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond009.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond010.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond011.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond019.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond020.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond021.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond022.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond023.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond024.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond025.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond026.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond037.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond038.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond039.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond040.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond041.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond046.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond048.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond050.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond051.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond052.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond053.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond054.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond055.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond056.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond057.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond058.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond059.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond060.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond061.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond062.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond063.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond064.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond065.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond066.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond067.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond068.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond069.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond075.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond076.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond077.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond078.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond079.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond080.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond084.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond085.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond086.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond087.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond088.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond089.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond090.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond091.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond092.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond093.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond094.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond095.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond108.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond109.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond110.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond111.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond112.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond113.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond120.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond121.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond122.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond126.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond127.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond128.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond129.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond130.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond131.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond132.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond133.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond134.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond135.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond136.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond137.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond138.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond140.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond141.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond142.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond143.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond148.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond149.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond152.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond154.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond155.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond156.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\cond157.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\d.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\d2.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\daemon.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\ds.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\dsearch.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\dt.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\DTPro.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\Dwnl.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\emulation.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\features.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\gd.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\globe.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\GrabImage.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\hb.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\hb.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\help.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\ip.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\lang.xml
   C:\Program Files\DAEMON Tools Toolbar\Resources\lingvo.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\m.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\mail.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mailc.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_down.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_under.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mail_disable.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mail_down.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mail_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\mail_under.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources
ext.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources
ext_down.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources
ext_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources
ext_under.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources
one.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources
one_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources
oW.gif
   C:\Program Files\DAEMON Tools Toolbar\Resources\op.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\pragma.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\prev.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\prev_down.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\prev_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\prev_under.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\prod.ico
   C:\Program Files\DAEMON Tools Toolbar\Resourcesefresh.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resourcesefresh_down.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resourcesefresh_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resourcesefresh_under.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\Rss.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\Rss1.ico
   C:\Program Files\DAEMON Tools Toolbar\ResourcesssClose.ico
   C:\Program Files\DAEMON Tools Toolbar\ResourcesssL.bmp
   C:\Program Files\DAEMON Tools Toolbar\ResourcesssOpen.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\size.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\size_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\skins.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\spt.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\SupportRequest.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources	ime.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\TitleIcon.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources	oolbar.xml
   C:\Program Files\DAEMON Tools Toolbar\Resources	rans.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\Trash.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_down.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_under.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\u.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wb.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m42.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m43.bmp
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi0.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi1.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi10.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi11.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi12.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi13.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi2.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi3.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi4.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi5.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi6.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi7.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi8.ico
   C:\Program Files\DAEMON Tools Toolbar\Resources\wi9.ico
   C:\Program Files\Search Settings
   C:\Program Files\Search Settings\kb127
   C:\Program Files\Search Settings\SearchSettings.exe
   C:\Program Files\Search Settings\kb127es
   C:\Program Files\Search Settings\kb127\SearchSettings.dll
   C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
   C:\Program Files\Search Settings\kb127	emp
   C:\Windows\iun6002.exe

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fhome.php"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://fr.yahoo.com/"
   "Default_Page_URL"="https://fr.yahoo.com/"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\Step\AppData\Roaming\Azureus	orrents\Football_Manager_2009_-_crack_and_patch_[mininova].torrent
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\crack fm2009+fichier langue francais.rar
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009-crack&patch
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\Readme.txt
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009\fm2009.iso
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009-crack&patch\FM2009_v9.1.0_Patch.exe
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009-crack&patch\fm91_t1.exe
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009-crack&patchead me.txt
   C:\Users\Step\Documents\LimeWire\Incomplete\T-4190924-Neophyte - Braincracking.mp3
   C:\Users\Step\Downloads\Football_Manager_2009_-_crack_and_patch_[mininova].torrent
   C:\Users\Step\Downloads\Update-FM2009-v9.2.0-Patch-et-Activation-Crack-(Update-9.2.0-et-9.1.0-incluse)-M777.rar.torrent
   C:\Users\Step\Downloads\_Football_Manager_2009_working_crack.exe_[mininova].torrent


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 01/02/2009|20:22 - Option : [1]

   -----------\  Fin du rapport a 20:22:54,00





Voici ;-)

jlpjlp · Answer

il faudrait virer les cracks :)



Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée". 
! Ne ferme pas la fenêtre lors de la suppression ! 
Un rapport sera généré, poste son contenu ici. 

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches. 
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..." 
Tape explorer puis valide.

Kira · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Basique  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2060  @ 1.60GHz )
   BIOS : Phoenix NoteBIOS 4.0 Release 6.1     
   USER : Step ( Administrator )
   BOOT : Normal boot
   Antivirus : AVG Anti-Virus 8.0 (Activated)
   C:\ (Local Disk) - NTFS - Total:73 Go (Free:9 Go)
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 01/02/2009|20:54 )

   [ UAC => 1 ]

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
   Supprime! - C:\Program Files\Search Settings\kb127
   Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
   Supprime! - C:\Windows\iun6002.exe
   Supprime! - C:\Program Files\DAEMON Tools Toolbar
   Supprime! - C:\Program Files\Search Settings

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fhome.php"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://fr.yahoo.com/"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\Step\AppData\Roaming\Azureus	orrents\Football_Manager_2009_-_crack_and_patch_[mininova].torrent
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\crack fm2009+fichier langue francais.rar
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009-crack&patch
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\Readme.txt
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009\fm2009.iso
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009-crack&patch\FM2009_v9.1.0_Patch.exe
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009-crack&patch\fm91_t1.exe
   C:\Users\Step\Documents\Azureus Downloads\Football Manager 2009 - crack and patch\fm2009-crack&patchead me.txt
   C:\Users\Step\Documents\LimeWire\Incomplete\T-4190924-Neophyte - Braincracking.mp3
   C:\Users\Step\Downloads\Football_Manager_2009_-_crack_and_patch_[mininova].torrent
   C:\Users\Step\Downloads\Update-FM2009-v9.2.0-Patch-et-Activation-Crack-(Update-9.2.0-et-9.1.0-incluse)-M777.rar.torrent
   C:\Users\Step\Downloads\_Football_Manager_2009_working_crack.exe_[mininova].torrent


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 01/02/2009|20:22 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 01/02/2009|21:02 - Option : [2]

   -----------\  Fin du rapport a 21:02:40,43


Voilà.

jlpjlp · Answer

ok c'est nettoyé

mais je ne vois aucun rootkit dans ton ordi pour verifier:

Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord) 

Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche comme demandé, le blocnote va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

Kira · Answer

Lorsque je lance après l'installation il me demande de choisir la lange, puis il dis que Geths Paths a céssé de fonctionner.
Le Rootkit pourrait être un bug de AVG 8.0 qui prendrait un pilote pour un rootkit?

jlpjlp · Answer

Le Rootkit pourrait être un bug de AVG 8.0 qui prendrait un pilote pour un rootkit?

oui je pense :)



passe un coup de panda antirootkit ou sophos pour verifier:

sophos antirootkit

http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html



panda antirootkit 

https://www.zdnet.fr/telecharger/logiciel/panda-free-antivirus-39647425s.htm

Kira · Answer

Et comment pourrais-je faire car il considère comme un rootkit un pilote qui doit avoir un lien avec mon lecteur CD... :s

jlpjlp · Answer

avg antivirus ou antirootkit seulement? le considère comme infecté?

si c'est l'antivirus met le dans les exceptions:

https://www.malekal.com/avg-antivirus-free-antivirus-gratuit-pour-proteger-son-pc-des-virus/

Kira · Answer

avg 8.0 
et sa fonction "Anti-Rootkit"
Il me mets "Ce pilote est masqué"

jlpjlp · Answer

tu ignore ou tu mets dans les exception pour ne plus avoir la question


sinon pour vérifier



 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Kira · Answer

le probléme c'est que mon Lecteur CD ne semble plus être reconnu depuis...
En plus "ce rootkit" change constament de nom....

jlpjlp · Answer

alors:



télécharge combofix (par sUBs) ici : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

et enregistre le sur le bureau. 

déconnecte toi d'internet et ferme toutes tes applications. 

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware) 


double-clique sur combofix.exe et suis les instructions 

à la fin, il va produire un rapport C:\ComboFix.txt 

réactive ton parefeu, ton antivirus, la garde de ton antispyware 

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse. 

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi. 

Tu as un tutoriel complet ici : 

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Kira · Answer

Je ne sais pas ce qu'il se passe mais toutes les applications "s'arrêtent" .... ( pANDA? Combo...)

Kira · Answer

ComboFix 09-02-01.01 - Step 2009-02-02 14:55:29.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.1.1036.18.893.295 [GMT 1:00] Lancé depuis: c:\users\Step\Desktop\ComboFix.exe AV: AVG Anti-Virus *On-access scanning enabled* (Updated) * Un nouveau point de restauration a été créé . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-02 au 2009-02-02 )))))))))))))))))))))))))))))))))))) . 2009-02-02 13:10 . 2009-02-02 13:10 d-------- c:\program files\Panda Security 2009-02-02 13:10 . 2008-06-19 16:24 28,544 --a------ c:\windows\System32\drivers\pavboot.sys 2009-02-02 13:02 . 2009-02-02 13:02 d-------- c:\windows\BDOSCAN8 2009-02-02 12:59 . 2009-02-02 12:59 d-------- c:\program files\Sophos 2009-02-02 12:34 . 2009-02-02 12:34 d-------- c:\program files\Navilog1 2009-02-01 20:20 . 2009-02-01 21:02 d-------- C:\ToolBar SD 2009-02-01 19:47 . 2009-02-01 19:48 d-------- C: sit 2009-02-01 19:47 . 2009-02-01 19:48 d-------- c:\program files rend micro 2009-02-01 15:25 . 2009-02-01 15:25 d-------- c:\users\Kiiira\AppData\Roaming\ATI 2009-02-01 15:24 . 2009-02-01 15:24 dr------- c:\users\Kiiira\Searches 2009-02-01 15:23 . 2009-02-01 15:24 dr------- c:\users\Kiiira\Videos 2009-02-01 15:23 . 2009-02-01 15:24 dr------- c:\users\Kiiira\Saved Games 2009-02-01 15:23 . 2009-02-01 15:24 dr------- c:\users\Kiiira\Pictures 2009-02-01 15:23 . 2009-02-01 15:24 dr------- c:\users\Kiiira\Music 2009-02-01 15:23 . 2009-02-01 15:24 dr------- c:\users\Kiiira\Links 2009-02-01 15:23 . 2009-02-01 15:24 dr------- c:\users\Kiiira\Downloads 2009-02-01 15:23 . 2009-02-01 15:24 dr------- c:\users\Kiiira\Documents 2009-02-01 15:23 . 2009-02-01 15:23 dr------- c:\users\Kiiira\Contacts 2009-02-01 15:23 . 2009-02-01 15:24 d--h----- c:\users\Kiiira\AppData 2009-02-01 15:23 . 2009-02-01 15:24 d-------- c:\users\Kiiira 2009-02-01 01:43 . 2009-02-01 01:43 d-------- c:\users\Step\AppData\Roaming\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\users\All Users\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\programdata\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-01 00:10 . 2009-02-01 16:43 250 --a------ c:\windows\gmer.ini 2009-01-24 05:24 . 2009-02-01 15:09 d-------- c:\program files\aquaplay 2009-01-23 20:26 . 2009-01-23 20:26 d-------- c:\users\All Users\Sports Interactive 2009-01-23 20:26 . 2009-01-23 20:26 d-------- c:\programdata\Sports Interactive 2009-01-23 20:24 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\System32\D3DX9_38.dll 2009-01-23 20:24 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\System32\D3DCompiler_38.dll 2009-01-23 20:24 . 2008-05-30 14:19 507,400 --a------ c:\windows\System32\XAudio2_1.dll 2009-01-23 20:24 . 2008-03-05 16:03 479,752 --a------ c:\windows\System32\XAudio2_0.dll 2009-01-23 20:24 . 2008-05-30 14:11 467,984 --a------ c:\windows\System32\d3dx10_38.dll 2009-01-23 20:24 . 2008-05-30 14:18 238,088 --a------ c:\windows\System32\xactengine3_1.dll 2009-01-23 20:24 . 2008-03-05 16:03 238,088 --a------ c:\windows\System32\xactengine3_0.dll 2009-01-23 20:24 . 2008-05-30 14:17 65,032 --a------ c:\windows\System32\XAPOFX1_0.dll 2009-01-23 20:24 . 2008-05-30 14:17 25,608 --a------ c:\windows\System32\X3DAudio1_4.dll 2009-01-23 20:24 . 2008-03-05 16:00 25,608 --a------ c:\windows\System32\X3DAudio1_3.dll 2009-01-23 19:14 . 2009-01-24 10:43 d-------- c:\program files\Common Files\Steam 2009-01-23 19:13 . 2009-02-02 13:52 d-------- c:\program files\Steam 2009-01-15 18:12 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-13 20:49 . 2009-01-13 20:49 d-------- c:\users\Step\AppData\Roaming\aAvgApi . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-01 14:09 --------- d-----w c:\users\Step\AppData\Roaming\Azureus 2009-02-01 14:09 --------- d-----w c:\program files\Windows Defender 2009-01-24 04:45 --------- d-----w c:\users\Step\AppData\Roaming\Sports Interactive 2009-01-23 18:09 --------- d-----w c:\program files\Sports Interactive 2009-01-21 20:30 --------- d-----w c:\program files\Azureus 2009-01-15 16:58 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-01-12 20:18 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-01-12 20:18 --------- d-----w c:\programdata\avg8 2009-01-12 20:17 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys 2009-01-11 16:00 --------- d-----w c:\program files\Common Files\Adobe 2009-01-11 12:23 --------- d-----w c:\program files\Messenger Plus! Live 2008-12-31 13:55 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-12-30 14:56 --------- d-----w c:\users\Step\AppData\Roaming\InterVideo 2008-12-28 12:35 --------- d-----w c:\programdata\Messenger Plus! 2008-12-28 11:55 --------- d-----w c:\users\Step\AppData\Roaming\Canneverbe_Limited 2008-12-28 11:54 --------- d-----w c:\program files\CDBurnerXP 2008-12-28 10:32 --------- d-----w c:\users\Step\AppData\Roaming\Ahead 2008-12-28 10:10 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-28 10:10 --------- d-----w c:\program files\Microsoft Reader 2008-12-28 10:03 --------- d-----w c:\users\TEMP\AppData\Roaming\ATI 2008-12-28 00:46 --------- d-----w c:\program files\BitTorrent 2008-12-28 00:24 --------- d-----w c:\program files\iPod 2008-12-28 00:24 --------- d-----w c:\program files\Bonjour 2008-12-28 00:21 --------- d-----w c:\program files\Windows Sidebar 2008-12-28 00:21 --------- d-----w c:\program files\Windows Photo Gallery 2008-12-28 00:21 --------- d-----w c:\program files\SplitCam 2008-12-28 00:21 --------- d-----w c:\program files\QuickTime 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft Sync Framework 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft 2008-12-27 23:47 --------- d-----w c:\users\Step\AppData\Roaming\Apple Computer 2008-12-27 23:46 --------- d-----w c:\program files\iTunes 2008-12-27 23:46 --------- d-----w c:\program files\Common Files\Apple 2008-12-27 23:45 --------- d-----w c:\programdata\Apple Computer 2008-12-27 23:37 --------- d-----w c:\program files\Apple Software Update 2008-12-27 21:16 --------- d-----w c:\programdata\ma-config.com 2008-12-27 21:16 --------- d-----w c:\program files\ma-config.com 2008-12-18 10:57 --------- d-----w c:\program files\Windows Live 2008-12-18 09:45 --------- d-----w c:\program files\Windows Mail 2008-12-18 09:06 --------- d-----w c:\program files\Yahoo! 2008-12-17 20:10 --------- d-----w c:\programdata\WLInstaller 2008-12-17 19:25 174 --sha-w c:\program files\desktop.ini 2008-12-17 19:12 --------- d-----w c:\program files\Windows Calendar 2008-12-17 19:11 --------- d-----w c:\program files\Windows Collaboration 2008-12-17 14:58 --------- d-----w c:\program files\Microsoft Silverlight 2008-12-17 14:57 --------- d-----w c:\program files\Microsoft Office Outlook Connector 2008-12-17 14:45 --------- d-----w c:\program files\Windows Live SkyDrive 2008-12-17 14:34 --------- d-----w c:\program files\Common Files\Windows Live 2008-12-08 16:01 55,264 ----a-w c:\windows\system32\drivers\fssfltr.sys 2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR 2008-06-25 17:58 1,664,591 ----a-w c:\users\2007\pf-setup.exe . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 413696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2006-12-20 77824] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-14 411768] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2006-12-14 493688] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 530552] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 90112] "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-12-16 188416] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 815104] "TOSHIBA Volume Indicator"="c:\program files\Toshiba\Utilities\VolControl.exe" [2006-12-13 94208] "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information opi.exe" [2006-12-15 577536] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2006-12-13 554640] "fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2008-12-08 453984] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 c:\windows\RtHDVCpl.exe] "NDSTray.exe"="NDSTray.exe" [BU] c:\users\2007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=G [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide d'Adobe Reader.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Lancement rapide d'Adobe Reader.lnk backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Lancement rapide de Microsoft Office OneNote 2003.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Lancement rapide de Microsoft Office OneNote 2003.lnk backup=c:\windows\pss\Lancement rapide de Microsoft Office OneNote 2003.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^Users^Step^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Outil de notification Live Search.lnk] path=c:\users\Step\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Outil de notification Live Search.lnk backup=c:\windows\pss\Outil de notification Live Search.lnk.Startup backupExtension=.Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY] --a------ 2009-01-12 21:17 1601304 c:\progra~1\AVG\AVG8\avgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-24 16:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] --a----t- 2009-01-18 11:19 133104 c:\users\Step\AppData\Local\Google\Update\GoogleUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam] --a------ 2007-05-17 22:45 279912 c:\program files\Microsoft LifeCam\LifeExp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2008-12-02 22:41 3882312 c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-12-20 14:37 155648 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2009-01-23 19:15 1410296 c:\program files\Steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX1000] --a------ 2007-04-10 22:46 709992 c:\windows\vVX1000.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2008-01-19 08:38 1008184 c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{5FD91A4C-4DB7-4928-B53A-6D5FC34295DB}c:\program files\bearshare applications\bearshare\bearshare.exe"= UDP:c:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "UDP Query User{419DCCF4-F449-4FAA-9255-14B244D9CD47}c:\program files\bearshare applications\bearshare\bearshare.exe"= TCP:c:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "TCP Query User{6DF018C9-6C18-4C79-AA7D-1E3C34979C0B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus "UDP Query User{1B957FE3-F7B2-45B8-B14B-20E8D8BF36E3}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus "TCP Query User{BBBE5863-238E-4B75-8719-4F5342394360}c:\users\2007\appdata\local\temp\rar$ex00.171\emule\emule.exe"= UDP:c:\users\2007\appdata\local emp ar$ex00.171\emule\emule.exe:emule.exe "UDP Query User{67500115-DC8F-4C89-BA3C-A4744AD4E436}c:\users\2007\appdata\local\temp\rar$ex00.171\emule\emule.exe"= TCP:c:\users\2007\appdata\local emp ar$ex00.171\emule\emule.exe:emule.exe "TCP Query User{9CEF591D-A89A-4C92-BAEB-0D3CB26BD49F}c:\program files\limewire\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{4B70F833-BC74-460F-9282-3FB9FB9BB736}c:\program files\limewire\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{F56905EA-E544-4CC3-AB7E-EE1214E1E8CC}c:\program files\bittorrent\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:bittorrent "UDP Query User{F78F6B5B-FEF5-47C6-A315-7DE628CA3D75}c:\program files\bittorrent\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:bittorrent "{D7C874C2-43D8-479E-8B7A-AB41451EEF90}"= Disabled:UDP:c:\program files\fm.exe:Football Manager 2008 "{5B3DCBAC-B132-46F6-9393-B35D886DC396}"= Disabled:TCP:c:\program files\fm.exe:Football Manager 2008 "TCP Query User{20EDBEE9-47B9-4FDB-A3B1-41A241D2A7FE}c:\program files\sopcast\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "UDP Query User{9521B02B-9AC6-4227-8949-0E57CEB5B2B8}c:\program files\sopcast\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "TCP Query User{161C8511-8AA2-4B90-98E3-4E7160E5F9E8}c:\program files\tvuplayer\tvuplayer.exe"= UDP:c:\program files vuplayer vuplayer.exe:TVUPlayer Component "UDP Query User{F4AA48FC-F466-4A90-9A76-9EA89684E16E}c:\program files\tvuplayer\tvuplayer.exe"= TCP:c:\program files vuplayer vuplayer.exe:TVUPlayer Component "TCP Query User{39F9BBEB-2BC8-43E3-BB42-FBCBCDCA3EAD}c:\program files\ppmate\ppmate\ppmate.exe"= UDP:c:\program files\ppmate\ppmate\ppmate.exe:PPMate P2P TV "UDP Query User{ACBAF6E3-97E3-45CB-8842-CAE637A0EF29}c:\program files\ppmate\ppmate\ppmate.exe"= TCP:c:\program files\ppmate\ppmate\ppmate.exe:PPMate P2P TV "TCP Query User{2A05CA98-2A5A-4F74-9CEF-7672D26610B5}c:\program files\tvants\tvants.exe"= UDP:c:\program files vants vants.exe:TVAnts "UDP Query User{75F44963-AB3D-44C1-A755-9B8940C9C4AB}c:\program files\tvants\tvants.exe"= TCP:c:\program files vants vants.exe:TVAnts "TCP Query User{9DDA4A41-30BD-4196-85D0-9EA7DB44F854}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{6763BFB0-A49B-4277-A9CE-A19578701E25}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{38713D86-3CA7-499A-9B2A-14AF270526B4}c:\users\2007\appdata\roaming\sopcast\adv\sopadver.exe"= UDP:c:\users\2007\appdata oaming\sopcast\adv\sopadver.exe:sopadver.exe "UDP Query User{299B3A3B-3B1C-4974-8F50-0153917864D8}c:\users\2007\appdata\roaming\sopcast\adv\sopadver.exe"= TCP:c:\users\2007\appdata oaming\sopcast\adv\sopadver.exe:sopadver.exe "TCP Query User{0D9D7D59-AADB-4947-87D4-98C717CDE973}c:\users\2007\appdata\local\temp\rar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= UDP:c:\users\2007\appdata\local emp ar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "UDP Query User{6DF04E2B-4701-4509-8054-4AE12924940E}c:\users\2007\appdata\local\temp\rar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= TCP:c:\users\2007\appdata\local emp ar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "TCP Query User{17A35D09-AE7C-4F5C-B13D-FC286C30EF4D}c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= UDP:c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "UDP Query User{9A5627BA-9821-424D-8218-EF7212B6654F}c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= TCP:c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "{41459E7D-92F3-4E24-8F71-D5C96095655D}"= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{13B6E290-630B-4DA0-84A9-1F716AFFAB55}"= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{A4673DA1-B535-40B4-94BC-1C31865E8EA3}"= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "{620635BF-FE10-4A5E-8303-A28AC3A25581}"= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "TCP Query User{55EE90A1-CE93-47BB-AE27-65FE0F2B89CA}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{414DF850-822B-4472-A942-E2B9C9F47B22}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{FCF6337D-B51F-488B-8F32-325683A80121}c:\program files\x-chat 2\xchat.exe"= UDP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client "UDP Query User{86EF4704-CDAE-4FFC-A2E3-2233AA84B20B}c:\program files\x-chat 2\xchat.exe"= TCP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client "{8EE34478-C877-4132-8760-01BA327FEEA2}"= UDP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{A2A9274B-85DB-4921-A9B9-0AB54253676B}"= TCP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{84BD71E7-5322-40FC-9D41-75009201E747}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe "{CCE87925-0BEA-4C21-A2C2-36BB72ECC53A}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{EB21003F-AFFE-4796-9980-E3DA1E3D189F}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe "{5DDEEE1B-4615-4B66-AFCE-91AD14CEEFD8}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{D21EC17D-59F9-4560-AF55-965F1D2F1680}"= UDP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009 "{5967084E-B8D9-4D40-AFE7-3EA8E4830CA3}"= TCP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\Program Files\BitTorrent\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "c:\Program Files\PPMate\PPMate\ppmate.exe"= c:\program files\PPMate\PPMate\ppmate.exe:*:Enabled:PPMate "c:\Program Files\uusee\UUSeePlayer.exe"= c:\program files\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2008-11-15 12552] R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [2009-02-02 28544] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2008-11-15 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2008-11-15 107272] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-12 298264] R2 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [2008-12-18 55264] R2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344] R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640] --- Autres Services/Pilotes en mémoire --- *Deregistered* - sptd [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc . Contenu du dossier 'Tâches planifiées' 2009-01-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3104662218-1256191170-3440181771-1002.job - c:\users\Step\AppData\Local\Google\Update\GoogleUpdate.exe [2009-01-18 11:19] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.facebook.com/home.php mWindow Title = IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: {{C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - hxxps://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game01.zylom.com/activex/zylomgamesplayer.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-02 15:00:52 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????P?Qe?U??0???X????????????? Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.exe'(3860) c:\program files\Microsoft Office\OFFICE11\msohev.dll . Heure de fin: 2009-02-02 15:04:19 ComboFix-quarantined-files.txt 2009-02-02 14:03:54 Avant-CF: 10 483 630 080 octets libres Après-CF: 10,413,629,440 octets libres 271 --- E O F --- 2009-01-31 22:59:37 Voilà ce que combofix m'a rendu comme résultat.

jlpjlp · Answer

pas de rootkit en vu:


pour voir



colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Kira · Answer

Les trois sites précédents me disent chacun "échec de la mise à jour"... ;-)

Kira · Answer

"Nom de l'objet";"C:\Windows\System32\Drivers\arhtnljy.SYS"
"Nom de la détection";"Pilote masqué"
"Type d'objet";"Fichier"
"Type de SDK";"Rootkit"
"Résultat";"L'objet est masqué"
"Historiques des actions";""
Voilà exactement ce que me dit AVG ...

jlpjlp · Answer

analyse ce fichiers sur virus total et colle le rapport:  https://www.virustotal.com/gui/

C:\Windows\System32\Drivers\arhtnljy.SYS

jlpjlp · Answer

scan avec 
MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Kira · Answer

^Sa devenait un peu long là..
donc:
Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1654
Windows 6.0.6001 Service Pack 1

03/02/2009 21:17:23
mbam-log-2009-02-03 (21-17-23).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 135841
Temps écoulé: 3 hour(s), 8 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

jlpjlp · Answer

télécharge OTMoveIt 
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved. 
(attention bien mettre :files)

:files
C:\Windows\System32\Drivers\arhtnljy.SYS
C:\Windows\System32\Drivers\atoa00.SYS 
C:\Windows	asks\edufbfyu.job 
:commands
[purity]
[emptytemp]
[start explorer]


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 


_______________________


télécharge bitdefender free; mets le a jour et colle un rapport avec

https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/29063.html

Kira · Answer

========== FILES ==========
File/Folder C:\Windows\System32\Drivers\arhtnljy.SYS not found.
File/Folder C:\Windows\System32\Drivers\abvpxh8y.SYS not found.
C:\Windows	asks\edufbfyu.job moved successfully.
========== COMMANDS ==========
File delete failed. C:\Users\Step\AppData\Local\Temp\Low\~DF4344.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\Step\AppData\Local\Temp\Low\~DF4352.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\Windows	emp\0e63b6f7-f857-45cd-af49-6a2ddf864eee.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\108025c4-ee4d-4ede-a363-293b85154a6d.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\141abbef-7d07-4adb-be70-b876ed259434.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\1de66a33-0773-4afe-851a-d274628dd87d.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\1e45b94e-ad67-46d5-b43e-db4829395ea4.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\1f02c5eb-1ad5-49ff-8751-7e49e547ee45.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\20b7af81-0dd0-40fa-9e6a-935c629eac31.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\25e3dacc-257e-4305-b07b-e5bca6892ec6.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\4b7e9106-9066-45c4-955b-0ddda8c3730f.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\52e6dd91-9b35-4017-8d99-5fbf79e9323e.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\55c2ba45-c1a9-4c00-b9ff-10a3053e6896.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\563a668f-7a36-4b6e-bf02-83535995e711.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\909c70bb-70c2-4ac9-96a5-0665b2c025ff.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\917d8055-a5f6-412b-b26d-3df9ab91df24.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\a0196bf3-d8e1-4f57-b7db-552cc7c1dd1c.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\a2fe2ec3-c7e1-4423-afd2-06c2b6ce5c24.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\b1167a08-ddd2-47e1-9893-30dcff0ea9f1.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\b16966f4-eb91-4e1a-baa3-3d6054cb1feb.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\b3a9273d-36ca-403b-a40b-a55aa0cbc322.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\c213d463-708a-4b6b-b565-1d51cc8494aa.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\c4b6f2f8-e78a-4e7c-a1c2-6268d38c28f1.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\d6071a1d-cc4a-4bfc-909c-501983a51476.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile00.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile01.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile02.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\MpSigStub.log scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\TMP000000281300EC683977F042 scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\TMP00000050CD050F0037F9357E scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02042009_180457


Voilà pour OT, je poste au plus vite le résultat de bitdefender.

Kira · Answer

//-----------------------------------------------------------------
//
//	Produit BitDefender Free Edition v10
//	Produit 10.2
//
//	Créé le: 	04/02/2009	18:45:14
//
//-----------------------------------------------------------------

Options d'analyse

Détection
[X] Analyser le secteur de boot
[X] Processus mémoire
[X] Analyser les archives
[X] Analyser les fichiers enpaquetés
[X] Analyser la messagerie

Masque fichiers
[X] Programmes
[ ] Tous les fichiers
[ ] Extensions définies par l'utilisateur: 
[ ] Exclure les extensions: ;

Action

Objets infectés
[X] Ignorer
[ ] Désinfecter
[ ] Effacer
[ ] Mettre en quarantaine
[ ] Demander l'action

Seconde action
[X] Ignorer
[ ] Effacer
[ ] Mettre en quarantaine
[ ] Demander l'action

Options d'analyse
[ ] Activer les alertes
[X] Activer l'heuristique
[ ] Afficher tous les fichiers dans le journal
[X] Fichier journal: C:\ProgramData\Bitdefender\Desktop\Profiles\Logs\rootkit_scan\bdlB49E.log

Options d'analyse Spyware

[ ] Analyse contre les risques non-viraux
[ ] Clés de registres
[ ] Cookies

Voici pr BD ;-)

jlpjlp · Answer

le rapport bitdefender est incomplet! il a trouvé des infections? quels fichiers sont infectés?

Kira · Answer

Non il a rien trouvé...

jlpjlp · Answer

Télécharge ToolsCleaner sur ton bureau. 
-->  http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 
_________________

le rootkit est encore trouvé?

Kira · Answer

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !
C:\Users\Step\Downloads\Gmer.zip: trouvé !
C:\Users\Step\Downloads\OTMoveIt3.exe: trouvé !
C:\Windows\msnfix.txt: trouvé !

;-)

Kira · Answer

et oui le rootkit est toujours trouvé par AVG....

jlpjlp · Answer

tu as viré tes cracks???

Kira · Answer

ouais mais j'ai pas éteint l'ordinateur depuis, j'dois le rallumer?

jlpjlp · Answer

oui redemarre et verifie

Kira · Answer

il est toujours trouvé. :s
peut-être que en tentant une réstauration du systeme?

Kira · Answer

bon j'ai tenter une restauration, sa marche pas des masses ...

jlpjlp · Answer

Télécharge MSNFix de Laurent http://sosvirus.changelog.fr/MSNFix.zip Décompresse-le et double clic sur le fichier MSNFix.bat. - Exécute l'option R. --Si l'infection est détectée, exécute l'option N - Sauvegarde ce rapport puis fais un copier/coller de ce rapport sur le forum. Note : Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement. envoyer le fichier [b] C:\DOCUME~1\florian\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr pour faire evoluer msnfix __________________________ Télécharge RavAntivirus d'Evosla : http://ww25.evosla.com/compteur.php?soft=rav_antivirus # Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX # Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau # Doucle-clique sur >> RAV.exe << afin de lancer l'outil. # Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles) # Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain . # Retire tes disques amovibles et redémarrez votre ordinateur. # Poste le rapport, si infection!

Kira · Answer

MSNfix me fait "accès refusé"
pour RAV sa fait genre 45minutes il detecte rien...

Kira · Answer

bon ben y'a rien...

Kira · Answer

y'a vraiment rien a faire?

jlpjlp · Answer

on va refaire:


Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

Kira · Answer

Logfile of random's system information tool 1.05 (written by random/random)
Run by Step at 2009-02-07 20:17:39
Microsoft® Windows Vista™ Édition Familiale Basique  Service Pack 1
System drive C: has 13 GB (18%) free of 75 GB
Total RAM: 893 MB (9% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:19, on 2009-02-07
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\Utilities\VolControl.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Windows\vVX1000.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Users\Step\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Users\Step\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Users\Step\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32	askeng.exe
C:\Users\Step\Downloads\RSIT.exe
C:\Program Files	rend micro\Step.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fhome.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TOSHIBA Volume Indicator] "C:\Program Files\Toshiba\Utilities\VolControl.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information	opi.exe -startup
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [VX1000] C:\Windows\vVX1000.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Step\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Outil de notification Live Search.lnk = C:\Users\Step\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin
pjpi160.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin
pjpi160.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR (file missing)
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} (VirginMega.DMFacade.Interface) - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game01.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

jlpjlp · Answer

pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

_____________________



telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs ! 



Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :




Driver ::
awiugvj5
File::
C:\Windows\system32\drivers\awiugvj5.sys








Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.



Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Kira · Answer

ComboFix 09-02-06.04 - Step 2009-02-07 21:22:12.3 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.1.1036.18.893.206 [GMT 1:00] Lancé depuis: c:\users\Step\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\Step\Desktop\CFscript.txt * Un nouveau point de restauration a été créé FILE :: c:\windows\system32\drivers\awiugvj5.sys . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-07 au 2009-02-07 )))))))))))))))))))))))))))))))))))) . 2009-02-07 21:12 . 2009-02-07 21:13 153,372,961 --a------ c:\windows\MEMORY.DMP 2009-02-04 18:22 . 2009-02-05 20:51 d-------- c:\program files\Common Files\Softwin 2009-02-04 18:04 . 2009-02-04 18:04 d-------- C:\_OTMoveIt 2009-02-02 13:10 . 2009-02-07 14:21 d-------- c:\program files\Panda Security 2009-02-02 13:02 . 2009-02-05 21:15 d-------- c:\windows\BDOSCAN8 2009-02-02 12:59 . 2009-02-07 14:19 d-------- c:\program files\Sophos 2009-02-02 12:34 . 2009-02-05 21:15 d-------- c:\program files\Navilog1 2009-02-01 20:20 . 2009-02-05 21:15 d-------- C:\ToolBar SD 2009-02-01 19:47 . 2009-02-01 19:48 d-------- C: sit 2009-02-01 19:47 . 2009-02-07 20:17 d-------- c:\program files rend micro 2009-02-01 01:43 . 2009-02-01 01:43 d-------- c:\users\Step\AppData\Roaming\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\users\All Users\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\programdata\Malwarebytes 2009-02-01 01:42 . 2009-02-02 20:31 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-01 00:10 . 2009-02-01 16:43 250 --a------ c:\windows\gmer.ini 2009-01-24 05:24 . 2009-02-05 21:15 d-------- c:\program files\aquaplay 2009-01-23 20:26 . 2009-02-05 20:04 d-------- c:\users\All Users\Sports Interactive 2009-01-23 20:26 . 2009-02-05 20:04 d-------- c:\programdata\Sports Interactive 2009-01-23 20:24 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\System32\D3DX9_38.dll 2009-01-23 20:24 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\System32\D3DCompiler_38.dll 2009-01-23 20:24 . 2008-05-30 14:19 507,400 --a------ c:\windows\System32\XAudio2_1.dll 2009-01-23 20:24 . 2008-03-05 16:03 479,752 --a------ c:\windows\System32\XAudio2_0.dll 2009-01-23 20:24 . 2008-05-30 14:11 467,984 --a------ c:\windows\System32\d3dx10_38.dll 2009-01-23 20:24 . 2008-05-30 14:18 238,088 --a------ c:\windows\System32\xactengine3_1.dll 2009-01-23 20:24 . 2008-03-05 16:03 238,088 --a------ c:\windows\System32\xactengine3_0.dll 2009-01-23 20:24 . 2008-05-30 14:17 65,032 --a------ c:\windows\System32\XAPOFX1_0.dll 2009-01-23 20:24 . 2008-05-30 14:17 25,608 --a------ c:\windows\System32\X3DAudio1_4.dll 2009-01-23 20:24 . 2008-03-05 16:00 25,608 --a------ c:\windows\System32\X3DAudio1_3.dll 2009-01-23 19:14 . 2009-02-05 21:15 d-------- c:\program files\Common Files\Steam 2009-01-23 19:13 . 2009-02-05 21:15 d-------- c:\program files\Steam 2009-01-15 18:12 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-13 20:49 . 2009-01-13 20:49 d-------- c:\users\Step\AppData\Roaming\aAvgApi . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-05 20:23 --------- d-----w c:\program files\Paint.NET 2009-02-05 20:15 --------- d-----w c:\users\Step\AppData\Roaming\DAEMON Tools 2009-02-05 20:15 --------- d-----w c:\users\Step\AppData\Roaming\Azureus 2009-02-05 20:15 --------- d-----w c:\program files\Windows Defender 2009-01-24 04:45 --------- d-----w c:\users\Step\AppData\Roaming\Sports Interactive 2009-01-23 18:09 --------- d-----w c:\program files\Sports Interactive 2009-01-21 20:30 --------- d-----w c:\program files\Azureus 2009-01-15 16:58 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-01-12 20:18 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-01-12 20:18 10,520 ----a-w c:\windows\System32\avgrsstx.dll 2009-01-12 20:18 --------- d-----w c:\programdata\avg8 2009-01-12 20:17 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys 2009-01-11 16:00 --------- d-----w c:\program files\Common Files\Adobe 2009-01-11 12:23 --------- d-----w c:\program files\Messenger Plus! Live 2008-12-31 13:55 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-12-30 14:56 --------- d-----w c:\users\Step\AppData\Roaming\InterVideo 2008-12-28 12:35 --------- d-----w c:\programdata\Messenger Plus! 2008-12-28 11:55 --------- d-----w c:\users\Step\AppData\Roaming\Canneverbe_Limited 2008-12-28 11:54 --------- d-----w c:\program files\CDBurnerXP 2008-12-28 10:32 --------- d-----w c:\users\Step\AppData\Roaming\Ahead 2008-12-28 10:10 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-28 10:10 --------- d-----w c:\program files\Microsoft Reader 2008-12-28 10:03 --------- d-----w c:\users\TEMP\AppData\Roaming\ATI 2008-12-28 00:46 --------- d-----w c:\program files\BitTorrent 2008-12-28 00:24 --------- d-----w c:\program files\iPod 2008-12-28 00:24 --------- d-----w c:\program files\Bonjour 2008-12-28 00:21 --------- d-----w c:\program files\Windows Sidebar 2008-12-28 00:21 --------- d-----w c:\program files\Windows Photo Gallery 2008-12-28 00:21 --------- d-----w c:\program files\SplitCam 2008-12-28 00:21 --------- d-----w c:\program files\QuickTime 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft Sync Framework 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft 2008-12-27 23:47 --------- d-----w c:\users\Step\AppData\Roaming\Apple Computer 2008-12-27 23:46 --------- d-----w c:\program files\iTunes 2008-12-27 23:46 --------- d-----w c:\program files\Common Files\Apple 2008-12-27 23:45 --------- d-----w c:\programdata\Apple Computer 2008-12-27 23:37 --------- d-----w c:\program files\Apple Software Update 2008-12-27 21:16 --------- d-----w c:\programdata\ma-config.com 2008-12-27 21:16 --------- d-----w c:\program files\ma-config.com 2008-12-18 10:57 --------- d-----w c:\program files\Windows Live 2008-12-18 09:45 --------- d-----w c:\program files\Windows Mail 2008-12-18 09:06 --------- d-----w c:\program files\Yahoo! 2008-12-17 20:10 --------- d-----w c:\programdata\WLInstaller 2008-12-17 19:25 174 --sha-w c:\program files\desktop.ini 2008-12-17 19:12 --------- d-----w c:\program files\Windows Calendar 2008-12-17 19:11 --------- d-----w c:\program files\Windows Collaboration 2008-12-17 18:38 82,432 ----a-w c:\windows\System32\axaltocm.dll 2008-12-17 18:38 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-12-17 14:58 --------- d-----w c:\program files\Microsoft Silverlight 2008-12-17 14:57 --------- d-----w c:\program files\Microsoft Office Outlook Connector 2008-12-17 14:45 --------- d-----w c:\program files\Windows Live SkyDrive 2008-12-17 14:34 --------- d-----w c:\program files\Common Files\Windows Live 2008-12-08 16:01 55,264 ----a-w c:\windows\system32\drivers\fssfltr.sys 2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR 2008-12-02 21:37 49,480 ----a-w c:\windows\System32\sirenacm.dll 2008-06-25 17:58 1,664,591 ----a-w c:\users\2007\pf-setup.exe . ((((((((((((((((((((((((((((( SnapShot@2009-02-07_20.59.53.96 ))))))))))))))))))))))))))))))))))))))))) . - 2009-02-07 08:33:53 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-02-07 20:12:49 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-02-07 08:33:53 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-02-07 20:12:49 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-02-07 08:36:59 262,144 --sha-w c:\windows\ServiceProfiles\LocalService tuser.dat + 2009-02-07 20:14:20 262,144 --sha-w c:\windows\ServiceProfiles\LocalService tuser.dat + 2009-02-07 20:14:20 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService tuser.dat.LOG1 - 2009-02-07 09:18:57 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService tuser.dat + 2009-02-07 20:14:26 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService tuser.dat + 2009-02-07 20:14:26 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService tuser.dat.LOG1 - 2009-02-07 19:49:12 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-02-07 20:20:43 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-02-07 19:49:12 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-02-07 20:20:43 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-02-07 19:49:12 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-07 20:20:43 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-02-07 14:26:44 101,556 ----a-w c:\windows\System32\perfc009.dat + 2009-02-07 20:20:19 101,556 ----a-w c:\windows\System32\perfc009.dat - 2009-02-07 14:26:44 123,896 ----a-w c:\windows\System32\perfc00C.dat + 2009-02-07 20:20:19 123,896 ----a-w c:\windows\System32\perfc00C.dat - 2009-02-07 14:26:44 587,484 ----a-w c:\windows\System32\perfh009.dat + 2009-02-07 20:20:19 587,484 ----a-w c:\windows\System32\perfh009.dat - 2009-02-07 14:26:44 669,890 ----a-w c:\windows\System32\perfh00C.dat + 2009-02-07 20:20:19 669,890 ----a-w c:\windows\System32\perfh00C.dat - 2009-02-07 08:37:51 13,546 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3104662218-1256191170-3440181771-1002_UserData.bin + 2009-02-07 20:15:09 13,782 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3104662218-1256191170-3440181771-1002_UserData.bin - 2009-02-07 08:37:49 70,176 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-02-07 20:15:09 70,230 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 413696] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312] "Google Update"="c:\users\Step\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-01-18 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2006-12-20 77824] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-14 411768] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2006-12-14 493688] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 530552] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 90112] "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-12-16 188416] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 815104] "TOSHIBA Volume Indicator"="c:\program files\Toshiba\Utilities\VolControl.exe" [2006-12-13 94208] "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information opi.exe" [2006-12-15 577536] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2006-12-13 554640] "fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2008-12-08 453984] "VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-20 155648] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-12 1601304] "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 c:\windows\RtHDVCpl.exe] "NDSTray.exe"="NDSTray.exe" [BU] c:\users\2007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] c:\users\Step\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Outil de notification Live Search.lnk - c:\users\Step\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-12-17 143360] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2008-04-23 29696] Lancement rapide de Microsoft Office OneNote 2003.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=G [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-24 16:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2009-01-23 19:15 1410296 c:\program files\Steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{5FD91A4C-4DB7-4928-B53A-6D5FC34295DB}c:\program files\bearshare applications\bearshare\bearshare.exe"= UDP:c:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "UDP Query User{419DCCF4-F449-4FAA-9255-14B244D9CD47}c:\program files\bearshare applications\bearshare\bearshare.exe"= TCP:c:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "TCP Query User{6DF018C9-6C18-4C79-AA7D-1E3C34979C0B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus "UDP Query User{1B957FE3-F7B2-45B8-B14B-20E8D8BF36E3}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus "TCP Query User{BBBE5863-238E-4B75-8719-4F5342394360}c:\users\2007\appdata\local\temp\rar$ex00.171\emule\emule.exe"= UDP:c:\users\2007\appdata\local emp ar$ex00.171\emule\emule.exe:emule.exe "UDP Query User{67500115-DC8F-4C89-BA3C-A4744AD4E436}c:\users\2007\appdata\local\temp\rar$ex00.171\emule\emule.exe"= TCP:c:\users\2007\appdata\local emp ar$ex00.171\emule\emule.exe:emule.exe "TCP Query User{9CEF591D-A89A-4C92-BAEB-0D3CB26BD49F}c:\program files\limewire\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{4B70F833-BC74-460F-9282-3FB9FB9BB736}c:\program files\limewire\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{F56905EA-E544-4CC3-AB7E-EE1214E1E8CC}c:\program files\bittorrent\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:bittorrent "UDP Query User{F78F6B5B-FEF5-47C6-A315-7DE628CA3D75}c:\program files\bittorrent\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:bittorrent "{D7C874C2-43D8-479E-8B7A-AB41451EEF90}"= Disabled:UDP:c:\program files\fm.exe:Football Manager 2008 "{5B3DCBAC-B132-46F6-9393-B35D886DC396}"= Disabled:TCP:c:\program files\fm.exe:Football Manager 2008 "TCP Query User{20EDBEE9-47B9-4FDB-A3B1-41A241D2A7FE}c:\program files\sopcast\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "UDP Query User{9521B02B-9AC6-4227-8949-0E57CEB5B2B8}c:\program files\sopcast\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "TCP Query User{161C8511-8AA2-4B90-98E3-4E7160E5F9E8}c:\program files\tvuplayer\tvuplayer.exe"= UDP:c:\program files vuplayer vuplayer.exe:TVUPlayer Component "UDP Query User{F4AA48FC-F466-4A90-9A76-9EA89684E16E}c:\program files\tvuplayer\tvuplayer.exe"= TCP:c:\program files vuplayer vuplayer.exe:TVUPlayer Component "TCP Query User{39F9BBEB-2BC8-43E3-BB42-FBCBCDCA3EAD}c:\program files\ppmate\ppmate\ppmate.exe"= UDP:c:\program files\ppmate\ppmate\ppmate.exe:PPMate P2P TV "UDP Query User{ACBAF6E3-97E3-45CB-8842-CAE637A0EF29}c:\program files\ppmate\ppmate\ppmate.exe"= TCP:c:\program files\ppmate\ppmate\ppmate.exe:PPMate P2P TV "TCP Query User{2A05CA98-2A5A-4F74-9CEF-7672D26610B5}c:\program files\tvants\tvants.exe"= UDP:c:\program files vants vants.exe:TVAnts "UDP Query User{75F44963-AB3D-44C1-A755-9B8940C9C4AB}c:\program files\tvants\tvants.exe"= TCP:c:\program files vants vants.exe:TVAnts "TCP Query User{9DDA4A41-30BD-4196-85D0-9EA7DB44F854}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{6763BFB0-A49B-4277-A9CE-A19578701E25}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{38713D86-3CA7-499A-9B2A-14AF270526B4}c:\users\2007\appdata\roaming\sopcast\adv\sopadver.exe"= UDP:c:\users\2007\appdata oaming\sopcast\adv\sopadver.exe:sopadver.exe "UDP Query User{299B3A3B-3B1C-4974-8F50-0153917864D8}c:\users\2007\appdata\roaming\sopcast\adv\sopadver.exe"= TCP:c:\users\2007\appdata oaming\sopcast\adv\sopadver.exe:sopadver.exe "TCP Query User{0D9D7D59-AADB-4947-87D4-98C717CDE973}c:\users\2007\appdata\local\temp\rar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= UDP:c:\users\2007\appdata\local emp ar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "UDP Query User{6DF04E2B-4701-4509-8054-4AE12924940E}c:\users\2007\appdata\local\temp\rar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= TCP:c:\users\2007\appdata\local emp ar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "TCP Query User{17A35D09-AE7C-4F5C-B13D-FC286C30EF4D}c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= UDP:c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "UDP Query User{9A5627BA-9821-424D-8218-EF7212B6654F}c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= TCP:c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "{41459E7D-92F3-4E24-8F71-D5C96095655D}"= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{13B6E290-630B-4DA0-84A9-1F716AFFAB55}"= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{A4673DA1-B535-40B4-94BC-1C31865E8EA3}"= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "{620635BF-FE10-4A5E-8303-A28AC3A25581}"= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "TCP Query User{55EE90A1-CE93-47BB-AE27-65FE0F2B89CA}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{414DF850-822B-4472-A942-E2B9C9F47B22}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{FCF6337D-B51F-488B-8F32-325683A80121}c:\program files\x-chat 2\xchat.exe"= UDP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client "UDP Query User{86EF4704-CDAE-4FFC-A2E3-2233AA84B20B}c:\program files\x-chat 2\xchat.exe"= TCP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client "{8EE34478-C877-4132-8760-01BA327FEEA2}"= UDP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{A2A9274B-85DB-4921-A9B9-0AB54253676B}"= TCP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{84BD71E7-5322-40FC-9D41-75009201E747}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe "{CCE87925-0BEA-4C21-A2C2-36BB72ECC53A}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{EB21003F-AFFE-4796-9980-E3DA1E3D189F}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe "{5DDEEE1B-4615-4B66-AFCE-91AD14CEEFD8}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{D21EC17D-59F9-4560-AF55-965F1D2F1680}"= UDP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009 "{5967084E-B8D9-4D40-AFE7-3EA8E4830CA3}"= TCP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\Program Files\BitTorrent\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "c:\Program Files\PPMate\PPMate\ppmate.exe"= c:\program files\PPMate\PPMate\ppmate.exe:*:Enabled:PPMate "c:\Program Files\uusee\UUSeePlayer.exe"= c:\program files\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2008-11-15 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2008-11-15 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2008-11-15 107272] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-12 298264] R2 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [2008-12-18 55264] R2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344] R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640] --- Autres Services/Pilotes en mémoire --- *Deregistered* - sptd [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc . Contenu du dossier 'Tâches planifiées' 2009-01-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3104662218-1256191170-3440181771-1002.job - c:\users\Step\AppData\Local\Google\Update\GoogleUpdate.exe [2009-01-18 11:19] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.facebook.com/home.php mWindow Title = IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: {{C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - hxxps://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game01.zylom.com/activex/zylomgamesplayer.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-07 21:28:21 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????P?Qe?U??0???X????????????? Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2009-02-07 21:33:08 ComboFix-quarantined-files.txt 2009-02-07 20:32:59 ComboFix2.txt 2009-02-02 14:04:21 Avant-CF: 13,447,319,552 octets libres Après-CF: 13,244,776,448 octets libres 279 --- E O F --- 2009-02-06 16:22:08

jlpjlp · Answer

c'est bon ou pas cette fois?

Kira · Answer

Non il est encore et toujours trouvé par AVG ...

Kira · Answer

Eh bien je préviens que je pars en vacances, ainsi je ne pourrais répondre avant samedi prochain. (le 14)

jlpjlp · Answer

ok tu collera un rapport AVG pour voir

Kira · Answer

https://imageshack.com/

Voilà

ou

[URL=https://imageshack.com/][IMG]http://img12.imageshack.us/img12/3123/avgrslib1.jpg[/IMG][/URL]
[URL=http://g.imageshack.us/img12/avgrslib1.jpg/1/][IMG]http://img12.imageshack.us/img12/avgrslib1.jpg/1/w1280.png[/IMG][/URL]

jlpjlp · Answer

slt
il faut le nom complet du fichier infecté   

donne le svp

Kira · Answer

https://imageshack.com/

jlpjlp · Answer

télécharge OTMoveIt 
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved. 
(attention bien mettre :files)



:services
amhoiqo
:files
c:\windows\system32\Drivers\amhoiqo.sys
:commands
[purity]
[emptytemp]
[start explorer]



clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

Kira · Answer

Merci de ta patience Jlpjlp...
Malheureusement nouveau scan avec AVG ce matin même et :

https://imageshack.com/

jlpjlp · Answer

il faut coller le rapport

____________

télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
(attention bien mettre :files)



:services
amhoiqo
ackxxyqt
:files
c:\windows\system32\Drivers\amhoiqo.sys
c:\windows\system32\Drivers\ackxxyqt.sys
:commands
[purity]
[emptytemp]
[start explorer]



clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

Kira · Answer

========== SERVICES/DRIVERS ==========
Unable to stop service amhoiqo .
Unable to stop service ackxxyqt .
========== FILES ==========
File/Folder c:\windows\system32\Drivers\amhoiqo.sys not found.
File/Folder c:\windows\system32\Drivers\ackxxyqt.sys not found.
========== COMMANDS ==========
File delete failed. C:\Users\Step\AppData\Local\Temp\hsperfdata_Step\5796 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\Windows	emp\0344890f-2bbf-4b4d-baf5-aa89a51b8942.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\06fd00f1-1bda-4958-9a04-e5d633bdabed.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\08293b17-f9dd-43cf-a5a5-cfc43db7c88a.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\0e3f7bc9-8b37-4ee6-bad8-a3024f15ee57.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\0fc3cdee-bfdc-4776-84b4-8a88fe7bdbe5.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\117e6c6f-b4eb-411e-bec6-aaf7d0f69eca.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\1486010b-aeef-4e6e-95cd-90b52d7f09d6.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\15e17546-dcec-4f3e-bcaf-83334e6df035.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\16206712-7d28-4571-a136-7a53cf73ae3a.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\1788025f-5bdd-4557-91a0-6c91fcd9d266.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\19e920f7-adcf-4c1c-86a4-e63f8e7f3ebf.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\1c1a1d8e-7fcb-4dd5-b2dc-08b5ce14c0b9.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\1d15c231-f42b-437e-a77f-edee7bd6af96.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\1e02cfac-3668-4534-8fc5-3cbe74cfbab9.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\2007e9f1-83ba-4e6b-a6de-ab58c60bbaa8.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\229acb5d-686e-4856-97d1-de779fc5286c.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\39307130-a2ae-4043-9418-14ba24418bba.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\3b987ad7-e6b4-4da5-a53c-e21d12b5fb8e.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\3c14b38f-3e15-44ff-bb7e-4009f120d22e.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\3dbe2c3c-6f60-428b-b3c1-bc4b8f9cd830.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\40393d56-c9a7-4a8a-8e7a-fe0b49d410b2.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\4121b77e-0498-46d9-897c-8ec54af241af.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\41d0c0cb-0674-4f4d-84a7-99a1df52e613.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\44295a9b-10f8-491e-85dc-e29bc14aeebb.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\455e09d5-f72b-45db-8ac4-b4bb12fae7e5.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\472a5e15-29b8-4880-a356-18b8537cc0a6.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\4a1cc986-70fc-4c11-b4ca-77d10d2d43cd.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\4ece81c3-1e1d-4c99-a236-de6d5d27af54.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\566d02a2-d963-43f8-a8bf-370818d09e3e.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\5958ca96-7aec-48eb-b1dd-8fccca9afcd3.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\5d769c85-afb5-422d-aba2-18995b7091c0.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\5db7d998-dcb9-4461-8d43-207e729f6eaa.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\6219bbb2-a5f7-4b03-934b-1d28ee9a8d03.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\64719b5f-b966-43d2-80fa-ed1ce6353699.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\64cd4a99-85a3-460d-aaf8-49990fe764d0.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\68d6d822-c020-4247-a91c-aa3e38dd22e3.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\6ff064cf-268b-4da2-8431-219b3e4da9ac.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\703e1346-4669-4dab-a009-2443422319d9.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\7421bfe6-9783-456b-9893-88a979dfdc45.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\742edb71-4aa2-4569-a58a-c3526695b578.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\76a159b5-8611-46b9-bfdf-5b0134da18fb.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\7ac17ad1-b7f3-49b6-b33c-9561e64550eb.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\7b5f7cfa-6ff4-4dd7-8761-47a8ba91d8cd.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\7b73128c-4dee-4e95-bfb2-f490c76d493d.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\7ca1f5a6-ba79-473a-a869-780465a7668a.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\7e215496-ae7c-46fb-91e1-a75e91a54fcb.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\812bda79-84de-4cbb-b6a1-ba90a0e91434.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\81302c0f-0e8a-4efc-81cc-8cd880503964.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\81932e9a-8c43-465a-9702-090caefaeb46.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\834ea858-4108-49e4-bfee-8fd4bb515fb6.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\895b26f5-2629-4b94-9821-798d2a3230e8.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\8b9378fe-3cc6-498a-986c-22dc8b95249f.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\9601c946-7e3b-460b-be97-a659cb412d71.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\974641ad-0221-4c15-9e1b-8803f8db1ffb.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\97950f34-3743-423f-a0b1-8dc1fe2aaa0f.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\9ac1294b-07dc-44d5-a40d-408e2550afe0.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\9fafeae7-158b-48d7-96d0-2f9ce7bec112.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\9ff909f1-a149-4b76-a15d-def29fcbdd51.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\a17dbb7d-f3c9-4095-b050-09be328d05f0.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\a7a8e2ed-5282-49a3-b978-a58d35103bf8.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\a8a2e189-92e8-46fb-a4bc-e40edff3cfdd.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\ab25951b-b93c-4e38-8d01-3a04f91111a8.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\b0a6505f-fa06-4eae-843f-c9aa79e683b0.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\b26e3033-c106-4d13-b5b2-7f7cc4e48ea0.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\bc10de03-16c6-40f3-9429-6f3f1628dfe6.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\bc17b3cb-efae-4b44-ab43-4168c4aab452.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\bc323d06-5eed-4d98-8815-46589d10e604.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\cc33fb98-131d-44ee-be51-4266424622c9.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\ccb03b25-3937-4b22-8643-ffe45e24245b.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\d4ccbfbf-e5f7-43a8-a8ef-bc1d50a70047.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\d55a4f8f-6552-4af4-94ec-28d4a2f72f92.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\d5ea1e18-9a30-4dc9-87a7-ed1ac3aafdde.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\db5003a8-ad36-4df1-b051-c1ac6a21d711.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\e0b66e88-a67a-4a83-ad40-c335193151ae.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\e5eaaa73-b214-4bcc-bbf9-caa7d4f1ddbe.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\e5f91237-2c10-4c49-b305-cbf6acd998f2.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\e7c5be89-b478-4da0-a73f-1e773d6a9282.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\e823829f-4550-4cce-b83d-93ce1a2d3f97.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\e841e033-1883-430c-a3d8-bf29fdf5a307.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\ea319a10-4cac-4194-9417-f45ecf5b4a36.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\edfae5d9-0fa9-493f-9f78-73a2e4211236.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\ee064a08-9c29-415a-ae98-d90818c31e2c.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\eee653fb-6769-4400-9182-f635d83bdc8c.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\f2714296-32c3-4297-9fed-803f8753762a.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\f3816969-f1ad-4071-8242-5b779cac32f1.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\f4048a4a-c31c-452b-b831-d75f0c2c86b8.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\f5254253-965a-45c0-9548-89e81a866da5.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\f553a7d1-956e-4434-9c07-137b4e9d86be.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\f7fffc76-a865-4145-84b8-79902ce098a9.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fb49f1b5-e4d4-422d-ba56-286f1894ecf1.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fcf97554-b2d8-4019-9c2b-e95cf198de0d.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fe1b6bf4-98e3-4d5c-bab6-2e71558c7197.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fef5578e-44bb-4ef2-9036-f70c32427dbd.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile00.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile01.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile02.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile03.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile04.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\MpCmdRun.log scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\MpSigStub.log scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\TMP0000000D2E9B9DC52984B950 scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\VisioCA.log scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02162009_195120

jlpjlp · Answer

telecharge combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Sauvegarde le sur ton bureau et pas ailleurs ! 



Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :



File::
c:\windows\system32\Drivers\amhoiqo.sys 
Driver ::
amhoiqo



Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.



Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt


_________________

lance AVG antirootkit et vire ce qui est trouvé:
http://www.commentcamarche.net/telecharger/telecharger 34055015 avg anti rootkit
https://www.clubic.com/telecharger-fiche34515-avg-anti-rootkit.html

Kira · Answer

ComboFix 09-02-15.01 - Step 2009-02-17 3:14:42.5 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.1.1036.18.893.122 [GMT 1:00] Lancé depuis: c:\users\Step\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\Step\Desktop\CFScript.txt * Un nouveau point de restauration a été créé FILE :: c:\windows\system32\Drivers\amhoiqo.sys . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-17 au 2009-02-17 )))))))))))))))))))))))))))))))))))) . 2009-02-17 03:08 . 2009-02-17 03:08 d-------- C:\32788R22FWJFW.0.tmp 2009-02-16 16:05 . 2009-02-16 16:05 d-------- c:\users\Step\AppData\Roaming\OpenOffice.org 2009-02-16 15:56 . 2009-02-16 15:56 d-------- c:\program files\OpenOffice.org 3 2009-02-15 23:54 . 2009-02-15 23:54 0 --ah---t- c:\windows\wusa.lock 2009-02-15 23:53 . 2009-02-16 20:01 d-------- C:\edfe6c060c8fb4b80e95eb6092f8 2009-02-08 21:53 . 2009-02-14 19:25 d-------- c:\users\All Users\Spybot - Search & Destroy 2009-02-08 21:53 . 2009-02-14 19:25 d-------- c:\programdata\Spybot - Search & Destroy 2009-02-08 21:53 . 2009-02-15 00:06 d-------- c:\program files\Spybot - Search & Destroy 2009-02-08 21:48 . 2009-02-15 00:06 d-------- c:\program files\eMule 2009-02-08 10:16 . 2009-02-08 10:16 d-------- c:\users\All Users\Yahoo! Companion 2009-02-08 10:16 . 2009-02-08 10:16 d-------- c:\programdata\Yahoo! Companion 2009-02-04 18:22 . 2009-02-05 20:51 d-------- c:\program files\Common Files\Softwin 2009-02-04 18:04 . 2009-02-04 18:04 d-------- C:\_OTMoveIt 2009-02-02 13:10 . 2009-02-07 14:21 d-------- c:\program files\Panda Security 2009-02-02 13:02 . 2009-02-05 21:15 d-------- c:\windows\BDOSCAN8 2009-02-02 12:59 . 2009-02-07 14:19 d-------- c:\program files\Sophos 2009-02-02 12:34 . 2009-02-05 21:15 d-------- c:\program files\Navilog1 2009-02-01 20:20 . 2009-02-05 21:15 d-------- C:\ToolBar SD 2009-02-01 19:47 . 2009-02-01 19:48 d-------- C: sit 2009-02-01 19:47 . 2009-02-07 20:17 d-------- c:\program files rend micro 2009-02-01 01:43 . 2009-02-01 01:43 d-------- c:\users\Step\AppData\Roaming\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\users\All Users\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\programdata\Malwarebytes 2009-02-01 01:42 . 2009-02-02 20:31 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-01 00:10 . 2009-02-01 16:43 250 --a------ c:\windows\gmer.ini 2009-01-24 05:24 . 2009-02-05 21:15 d-------- c:\program files\aquaplay 2009-01-23 20:26 . 2009-02-05 20:04 d-------- c:\users\All Users\Sports Interactive 2009-01-23 20:26 . 2009-02-05 20:04 d-------- c:\programdata\Sports Interactive 2009-01-23 20:24 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\System32\D3DX9_38.dll 2009-01-23 20:24 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\System32\D3DCompiler_38.dll 2009-01-23 20:24 . 2008-05-30 14:19 507,400 --a------ c:\windows\System32\XAudio2_1.dll 2009-01-23 20:24 . 2008-03-05 16:03 479,752 --a------ c:\windows\System32\XAudio2_0.dll 2009-01-23 20:24 . 2008-05-30 14:11 467,984 --a------ c:\windows\System32\d3dx10_38.dll 2009-01-23 20:24 . 2008-05-30 14:18 238,088 --a------ c:\windows\System32\xactengine3_1.dll 2009-01-23 20:24 . 2008-03-05 16:03 238,088 --a------ c:\windows\System32\xactengine3_0.dll 2009-01-23 20:24 . 2008-05-30 14:17 65,032 --a------ c:\windows\System32\XAPOFX1_0.dll 2009-01-23 20:24 . 2008-05-30 14:17 25,608 --a------ c:\windows\System32\X3DAudio1_4.dll 2009-01-23 20:24 . 2008-03-05 16:00 25,608 --a------ c:\windows\System32\X3DAudio1_3.dll 2009-01-23 19:14 . 2009-02-05 21:15 d-------- c:\program files\Common Files\Steam 2009-01-23 19:13 . 2009-02-05 21:15 d-------- c:\program files\Steam . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-14 23:06 --------- d-----w c:\program files\Messenger Plus! Live 2009-02-14 23:06 --------- d-----w c:\program files\CCleaner 2009-02-08 09:16 --------- d-----w c:\program files\Yahoo! 2009-02-05 20:23 --------- d-----w c:\program files\Paint.NET 2009-02-05 20:15 --------- d-----w c:\users\Step\AppData\Roaming\DAEMON Tools 2009-02-05 20:15 --------- d-----w c:\users\Step\AppData\Roaming\Azureus 2009-02-05 20:15 --------- d-----w c:\program files\Windows Defender 2009-01-24 04:45 --------- d-----w c:\users\Step\AppData\Roaming\Sports Interactive 2009-01-23 18:09 --------- d-----w c:\program files\Sports Interactive 2009-01-21 20:30 --------- d-----w c:\program files\Azureus 2009-01-15 16:58 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-01-13 19:49 --------- d-----w c:\users\Step\AppData\Roaming\aAvgApi 2009-01-12 20:18 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-01-12 20:18 10,520 ----a-w c:\windows\System32\avgrsstx.dll 2009-01-12 20:18 --------- d-----w c:\programdata\avg8 2009-01-12 20:17 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys 2009-01-11 16:00 --------- d-----w c:\program files\Common Files\Adobe 2008-12-31 13:55 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-12-30 14:56 --------- d-----w c:\users\Step\AppData\Roaming\InterVideo 2008-12-28 12:35 --------- d-----w c:\programdata\Messenger Plus! 2008-12-28 11:55 --------- d-----w c:\users\Step\AppData\Roaming\Canneverbe_Limited 2008-12-28 11:54 --------- d-----w c:\program files\CDBurnerXP 2008-12-28 10:32 --------- d-----w c:\users\Step\AppData\Roaming\Ahead 2008-12-28 10:10 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-28 10:10 --------- d-----w c:\program files\Microsoft Reader 2008-12-28 10:03 --------- d-----w c:\users\TEMP\AppData\Roaming\ATI 2008-12-28 00:46 --------- d-----w c:\program files\BitTorrent 2008-12-28 00:24 --------- d-----w c:\program files\iPod 2008-12-28 00:24 --------- d-----w c:\program files\Bonjour 2008-12-28 00:21 --------- d-----w c:\program files\Windows Sidebar 2008-12-28 00:21 --------- d-----w c:\program files\Windows Photo Gallery 2008-12-28 00:21 --------- d-----w c:\program files\SplitCam 2008-12-28 00:21 --------- d-----w c:\program files\QuickTime 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft Sync Framework 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft 2008-12-27 23:47 --------- d-----w c:\users\Step\AppData\Roaming\Apple Computer 2008-12-27 23:46 --------- d-----w c:\program files\iTunes 2008-12-27 23:46 --------- d-----w c:\program files\Common Files\Apple 2008-12-27 23:45 --------- d-----w c:\programdata\Apple Computer 2008-12-27 23:37 --------- d-----w c:\program files\Apple Software Update 2008-12-27 21:16 --------- d-----w c:\programdata\ma-config.com 2008-12-27 21:16 --------- d-----w c:\program files\ma-config.com 2008-12-18 10:57 --------- d-----w c:\program files\Windows Live 2008-12-18 09:45 --------- d-----w c:\program files\Windows Mail 2008-12-17 20:10 --------- d-----w c:\programdata\WLInstaller 2008-12-17 19:25 174 --sha-w c:\program files\desktop.ini 2008-12-17 19:12 --------- d-----w c:\program files\Windows Calendar 2008-12-17 19:11 --------- d-----w c:\program files\Windows Collaboration 2008-12-17 18:38 82,432 ----a-w c:\windows\System32\axaltocm.dll 2008-12-17 18:38 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-12-17 14:58 --------- d-----w c:\program files\Microsoft Silverlight 2008-12-17 14:57 --------- d-----w c:\program files\Microsoft Office Outlook Connector 2008-12-17 14:45 --------- d-----w c:\program files\Windows Live SkyDrive 2008-12-17 14:34 --------- d-----w c:\program files\Common Files\Windows Live 2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR 2008-12-02 21:37 49,480 ----a-w c:\windows\System32\sirenacm.dll 2008-06-25 17:58 1,664,591 ----a-w c:\users\2007\pf-setup.exe . ((((((((((((((((((((((((((((( SnapShot@2009-02-07_20.59.53.96 ))))))))))))))))))))))))))))))))))))))))) . + 2009-02-17 02:13:29 6,041,600 ----a-w c:\windows\ERDNT\Hiv-backup\schema.dat - 2009-01-16 11:42:53 593,920 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\accicons.exe + 2009-02-17 02:07:40 593,920 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\accicons.exe - 2009-01-16 11:42:53 12,288 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2009-02-17 02:07:40 12,288 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2009-01-16 11:42:53 86,016 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\inficon.exe + 2009-02-17 02:07:40 86,016 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\inficon.exe - 2009-01-16 11:42:52 135,168 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\misc.exe + 2009-02-17 02:07:40 135,168 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\misc.exe - 2009-01-16 11:42:53 11,264 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\mspicons.exe + 2009-02-17 02:07:40 11,264 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2009-01-16 11:42:53 27,136 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2009-02-17 02:07:40 27,136 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\oisicon.exe - 2009-01-16 11:42:53 4,096 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2009-02-17 02:07:40 4,096 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2009-01-16 11:42:53 794,624 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\outicon.exe + 2009-02-17 02:07:40 794,624 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\outicon.exe - 2009-01-16 11:42:53 249,856 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pptico.exe + 2009-02-17 02:07:40 249,856 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pptico.exe - 2009-01-16 11:42:52 61,440 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pubs.exe + 2009-02-17 02:07:40 61,440 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pubs.exe - 2009-01-16 11:42:53 23,040 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2009-02-17 02:07:41 23,040 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2009-01-16 11:42:52 286,720 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\wordicon.exe + 2009-02-17 02:07:40 286,720 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\wordicon.exe - 2009-01-16 11:42:52 409,600 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2009-02-17 02:07:40 409,600 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\xlicons.exe - 2008-11-16 08:20:06 12,288 ----a-r c:\windows\Installer\{9051040C-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2009-02-17 02:10:43 12,288 ----a-r c:\windows\Installer\{9051040C-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2008-11-16 08:20:06 135,168 ----a-r c:\windows\Installer\{9051040C-6000-11D3-8CFE-0150048383C9}\misc.exe + 2009-02-17 02:10:45 135,168 ----a-r c:\windows\Installer\{9051040C-6000-11D3-8CFE-0150048383C9}\misc.exe - 2008-11-16 08:20:06 4,096 ----a-r c:\windows\Installer\{9051040C-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2009-02-17 02:10:47 4,096 ----a-r c:\windows\Installer\{9051040C-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2008-11-16 08:20:05 176,128 ----a-r c:\windows\Installer\{9051040C-6000-11D3-8CFE-0150048383C9}\visicon.exe + 2009-02-17 02:10:41 176,128 ----a-r c:\windows\Installer\{9051040C-6000-11D3-8CFE-0150048383C9}\visicon.exe - 2009-02-06 22:07:16 941,680 ----a-w c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2009-02-16 18:54:51 941,680 ----a-w c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2009-02-07 08:33:53 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-02-17 02:00:23 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-02-07 08:33:53 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-02-17 02:00:23 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-02-07 08:36:59 262,144 --sha-w c:\windows\ServiceProfiles\LocalService tuser.dat + 2009-02-17 02:02:57 262,144 --sha-w c:\windows\ServiceProfiles\LocalService tuser.dat - 2009-02-07 09:18:57 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService tuser.dat + 2009-02-17 02:02:50 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService tuser.dat - 2009-02-07 19:49:12 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-02-17 02:14:56 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-02-07 19:49:12 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-02-17 02:14:56 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-02-07 19:49:12 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-17 02:14:56 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-16 15:10:52 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat - 2009-02-07 19:51:58 262,144 ----a-w c:\windows\System32\config\systemprofile tuser.dat + 2009-02-17 01:54:36 262,144 ----a-w c:\windows\System32\config\systemprofile tuser.dat + 2009-02-17 01:54:36 262,144 ---ha-w c:\windows\System32\config\systemprofile tuser.dat.LOG1 - 2009-02-07 14:26:44 101,556 ----a-w c:\windows\System32\perfc009.dat + 2009-02-15 18:40:04 101,556 ----a-w c:\windows\System32\perfc009.dat - 2009-02-07 14:26:44 123,896 ----a-w c:\windows\System32\perfc00C.dat + 2009-02-15 18:40:04 123,896 ----a-w c:\windows\System32\perfc00C.dat - 2009-02-07 14:26:44 587,484 ----a-w c:\windows\System32\perfh009.dat + 2009-02-15 18:40:04 587,484 ----a-w c:\windows\System32\perfh009.dat - 2009-02-07 14:26:44 669,890 ----a-w c:\windows\System32\perfh00C.dat + 2009-02-15 18:40:04 669,890 ----a-w c:\windows\System32\perfh00C.dat - 2009-01-16 12:00:29 6,291,456 ----a-w c:\windows\System32\SMI\Store\Machine\schema.dat + 2009-02-17 02:08:10 6,291,456 ----a-w c:\windows\System32\SMI\Store\Machine\schema.dat - 2009-02-07 08:37:51 13,546 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3104662218-1256191170-3440181771-1002_UserData.bin + 2009-02-17 02:02:51 13,846 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3104662218-1256191170-3440181771-1002_UserData.bin - 2009-02-07 08:37:49 70,176 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-02-17 02:02:50 71,036 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2009-02-06 16:10:58 4,370 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat + 2009-02-16 18:54:42 4,370 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat - 2009-02-07 08:37:49 57,288 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-02-16 13:06:53 58,406 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2009-02-02 13:33:38 218,276 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-02-09 15:33:13 220,984 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin - 2009-01-15 17:00:18 155,339,540 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin + 2009-02-17 02:08:18 191,005,605 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin + 2008-04-11 06:42:20 64,512 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18203_none_01ebf827a1d05839\WininetPlugin.dll + 2007-09-23 10:44:58 2,455,488 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6000.16809_none_f9b4de176e8fd9a5\ieapfltr.dat + 2007-09-23 10:44:58 2,455,488 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6000.20996_none_f9da2ab887f928e3\ieapfltr.dat + 2008-01-19 07:36:35 129,536 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_6.0.6001.18203_none_47a6af038c817696\sqmapi.dll + 2008-01-19 07:34:31 180,736 ----a-w c:\windows\winsxs\x86_microsoft-windows-ieframe_31bf3856ad364e35_6.0.6001.18203_none_64a57149ae1c4f9c\ieui.dll . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 413696] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312] "Google Update"="c:\users\Step\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-01-18 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2006-12-20 77824] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-14 411768] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2006-12-14 493688] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 530552] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 90112] "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-12-16 188416] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 815104] "TOSHIBA Volume Indicator"="c:\program files\Toshiba\Utilities\VolControl.exe" [2006-12-13 94208] "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information opi.exe" [2006-12-15 577536] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2006-12-13 554640] "fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2008-12-08 453984] "VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-20 155648] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-12 1601304] "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 c:\windows\RtHDVCpl.exe] "NDSTray.exe"="NDSTray.exe" [BU] c:\users\2007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] c:\users\Step\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Outil de notification Live Search.lnk - c:\users\Step\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-12-17 143360] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2008-04-23 29696] Lancement rapide de Microsoft Office OneNote 2003.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=G [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-24 16:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2009-01-23 19:15 1410296 c:\program files\Steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{5FD91A4C-4DB7-4928-B53A-6D5FC34295DB}c:\program files\bearshare applications\bearshare\bearshare.exe"= UDP:c:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "UDP Query User{419DCCF4-F449-4FAA-9255-14B244D9CD47}c:\program files\bearshare applications\bearshare\bearshare.exe"= TCP:c:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "TCP Query User{6DF018C9-6C18-4C79-AA7D-1E3C34979C0B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus "UDP Query User{1B957FE3-F7B2-45B8-B14B-20E8D8BF36E3}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus "TCP Query User{BBBE5863-238E-4B75-8719-4F5342394360}c:\users\2007\appdata\local\temp\rar$ex00.171\emule\emule.exe"= UDP:c:\users\2007\appdata\local emp ar$ex00.171\emule\emule.exe:emule.exe "UDP Query User{67500115-DC8F-4C89-BA3C-A4744AD4E436}c:\users\2007\appdata\local\temp\rar$ex00.171\emule\emule.exe"= TCP:c:\users\2007\appdata\local emp ar$ex00.171\emule\emule.exe:emule.exe "TCP Query User{9CEF591D-A89A-4C92-BAEB-0D3CB26BD49F}c:\program files\limewire\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{4B70F833-BC74-460F-9282-3FB9FB9BB736}c:\program files\limewire\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{F56905EA-E544-4CC3-AB7E-EE1214E1E8CC}c:\program files\bittorrent\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:bittorrent "UDP Query User{F78F6B5B-FEF5-47C6-A315-7DE628CA3D75}c:\program files\bittorrent\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:bittorrent "{D7C874C2-43D8-479E-8B7A-AB41451EEF90}"= Disabled:UDP:c:\program files\fm.exe:Football Manager 2008 "{5B3DCBAC-B132-46F6-9393-B35D886DC396}"= Disabled:TCP:c:\program files\fm.exe:Football Manager 2008 "TCP Query User{20EDBEE9-47B9-4FDB-A3B1-41A241D2A7FE}c:\program files\sopcast\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "UDP Query User{9521B02B-9AC6-4227-8949-0E57CEB5B2B8}c:\program files\sopcast\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "TCP Query User{161C8511-8AA2-4B90-98E3-4E7160E5F9E8}c:\program files\tvuplayer\tvuplayer.exe"= UDP:c:\program files vuplayer vuplayer.exe:TVUPlayer Component "UDP Query User{F4AA48FC-F466-4A90-9A76-9EA89684E16E}c:\program files\tvuplayer\tvuplayer.exe"= TCP:c:\program files vuplayer vuplayer.exe:TVUPlayer Component "TCP Query User{39F9BBEB-2BC8-43E3-BB42-FBCBCDCA3EAD}c:\program files\ppmate\ppmate\ppmate.exe"= UDP:c:\program files\ppmate\ppmate\ppmate.exe:PPMate P2P TV "UDP Query User{ACBAF6E3-97E3-45CB-8842-CAE637A0EF29}c:\program files\ppmate\ppmate\ppmate.exe"= TCP:c:\program files\ppmate\ppmate\ppmate.exe:PPMate P2P TV "TCP Query User{2A05CA98-2A5A-4F74-9CEF-7672D26610B5}c:\program files\tvants\tvants.exe"= UDP:c:\program files vants vants.exe:TVAnts "UDP Query User{75F44963-AB3D-44C1-A755-9B8940C9C4AB}c:\program files\tvants\tvants.exe"= TCP:c:\program files vants vants.exe:TVAnts "TCP Query User{9DDA4A41-30BD-4196-85D0-9EA7DB44F854}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{6763BFB0-A49B-4277-A9CE-A19578701E25}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{38713D86-3CA7-499A-9B2A-14AF270526B4}c:\users\2007\appdata\roaming\sopcast\adv\sopadver.exe"= UDP:c:\users\2007\appdata oaming\sopcast\adv\sopadver.exe:sopadver.exe "UDP Query User{299B3A3B-3B1C-4974-8F50-0153917864D8}c:\users\2007\appdata\roaming\sopcast\adv\sopadver.exe"= TCP:c:\users\2007\appdata oaming\sopcast\adv\sopadver.exe:sopadver.exe "TCP Query User{0D9D7D59-AADB-4947-87D4-98C717CDE973}c:\users\2007\appdata\local\temp\rar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= UDP:c:\users\2007\appdata\local emp ar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "UDP Query User{6DF04E2B-4701-4509-8054-4AE12924940E}c:\users\2007\appdata\local\temp\rar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= TCP:c:\users\2007\appdata\local emp ar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "TCP Query User{17A35D09-AE7C-4F5C-B13D-FC286C30EF4D}c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= UDP:c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "UDP Query User{9A5627BA-9821-424D-8218-EF7212B6654F}c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= TCP:c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "{41459E7D-92F3-4E24-8F71-D5C96095655D}"= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{13B6E290-630B-4DA0-84A9-1F716AFFAB55}"= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{A4673DA1-B535-40B4-94BC-1C31865E8EA3}"= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "{620635BF-FE10-4A5E-8303-A28AC3A25581}"= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "TCP Query User{55EE90A1-CE93-47BB-AE27-65FE0F2B89CA}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{414DF850-822B-4472-A942-E2B9C9F47B22}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{FCF6337D-B51F-488B-8F32-325683A80121}c:\program files\x-chat 2\xchat.exe"= UDP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client "UDP Query User{86EF4704-CDAE-4FFC-A2E3-2233AA84B20B}c:\program files\x-chat 2\xchat.exe"= TCP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client "{8EE34478-C877-4132-8760-01BA327FEEA2}"= UDP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{A2A9274B-85DB-4921-A9B9-0AB54253676B}"= TCP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{84BD71E7-5322-40FC-9D41-75009201E747}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe "{CCE87925-0BEA-4C21-A2C2-36BB72ECC53A}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{EB21003F-AFFE-4796-9980-E3DA1E3D189F}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe "{5DDEEE1B-4615-4B66-AFCE-91AD14CEEFD8}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{D21EC17D-59F9-4560-AF55-965F1D2F1680}"= UDP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009 "{5967084E-B8D9-4D40-AFE7-3EA8E4830CA3}"= TCP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\Program Files\BitTorrent\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "c:\Program Files\PPMate\PPMate\ppmate.exe"= c:\program files\PPMate\PPMate\ppmate.exe:*:Enabled:PPMate "c:\Program Files\uusee\UUSeePlayer.exe"= c:\program files\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2008-11-15 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2008-11-15 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2008-11-15 107272] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-12 298264] R2 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [2008-12-18 55264] R2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344] R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640] --- Autres Services/Pilotes en mémoire --- *Deregistered* - sptd [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc . Contenu du dossier 'Tâches planifiées' 2009-02-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3104662218-1256191170-3440181771-1002.job - c:\users\Step\AppData\Local\Google\Update\GoogleUpdate.exe [2009-01-18 11:19] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.facebook.com/home.php mWindow Title = IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: {{C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - hxxps://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game01.zylom.com/activex/zylomgamesplayer.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-17 03:27:41 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????P?Qe?U??0???X????????????? Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.exe'(564) c:\program files\Microsoft Office\OFFICE11\msohev.dll . Heure de fin: 2009-02-17 3:33:50 ComboFix-quarantined-files.txt 2009-02-17 02:33:12 ComboFix2.txt 2009-02-07 20:33:12 ComboFix3.txt 2009-02-02 14:04:21 Avant-CF: 12,762,099,712 octets libres Après-CF: 14,489,235,456 octets libres 351 --- E O F --- 2009-02-17 02:10:15 Voiilà ce que sa m'a rendu.

jlpjlp · Answer

lance avg antirootkit

Kira · Answer

https://imageshack.com/

et

https://imageshack.com/

Voilà ;-)

jlpjlp · Answer

vire ces deux fichiers

C:\32788R22FWJFW.0.tmp

C:\edfe6c060c8fb4b80e95eb6092f8 


______________
analyse ce fichier sur virus total et colle le rapport https://www.virustotal.com/gui/

c:\windows\wusa.lock

_____________

pour voir si il existe bien un rootkit ce qui m'etonne vu les rapports

essaye sophos antirootkit, panda antirootkit , rootkit hunter,mac afee rootkit


si rien je pense que c'est un faux positif


http://www.commentcamarche.net/telecharger/logiciel 110 anti rootkit

Kira · Answer

Alors je n'ai pu virer :
-C:\32788R22FWJFW.0.tmp 

et voilà ce que m'indique virustotal:
0 bytes size received / Se ha recibido un archivo vacio


Que faire si c'est un "faux positif"?

jlpjlp · Answer

si c'est un faux positif il faut l'ignorer enparamettrant avg 8  ou alors mets antivir a la place d'avg 8

https://www.malekal.com/avira-free-security-antivirus-gratuit/

_______________



télécharge OTMoveIt

http://oldtimer.geekstogo.com/OTMoveIt3.exe

(de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.




:files
C:\32788R22FWJFW.0.tmp
C:\edfe6c060c8fb4b80e95eb6092f8
c:\windows\wusa.lock



clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer 
C:\32788R22FWJFW.0.tmp
C:\edfe6c060c8fb4b80e95eb6092f8
c:\windows\wusa.lock
le pc pour achever la suppression.si c'est le cas accepte par Yes.

Kira · Answer

========== FILES ==========
File/Folder C:\32788R22FWJFW.0.tmp not found.
File/Folder C:\edfe6c060c8fb4b80e95eb6092f8 not found.
File/Folder c:\windows\wusa.lock not found.
 

voilà ;-)

jlpjlp · Answer

Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :





File::
C:\32788R22FWJFW.0.tmp
C:\edfe6c060c8fb4b80e95eb6092f8
c:\windows\wusa.lock 




Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

Kira · Answer

ComboFix 09-02-15.01 - Step 2009-02-18 12:52:08.6 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.1.1036.18.893.257 [GMT 1:00] Lancé depuis: c:\users\Step\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\Step\Desktop\CFScript.txt * Un nouveau point de restauration a été créé FILE :: C:\32788R22FWJFW.0.tmp C:\edfe6c060c8fb4b80e95eb6092f8 c:\windows\wusa.lock . ((((((((((((((((((((((((((((( Fichiers créés du 2009-01-18 au 2009-02-18 )))))))))))))))))))))))))))))))))))) . 2009-02-18 10:50 . 2009-02-18 10:50 d-------- C:\ef72b07650eb81e63c9b73ee91a30bcf 2009-02-17 23:23 . 2009-02-17 23:23 d-------- c:\users\Step\AppData\Roaming\Netscape 2009-02-17 23:22 . 2009-02-17 23:46 d-------- c:\program files\Netscape 2009-02-16 16:05 . 2009-02-16 16:05 d-------- c:\users\Step\AppData\Roaming\OpenOffice.org 2009-02-16 15:56 . 2009-02-16 15:56 d-------- c:\program files\OpenOffice.org 3 2009-02-08 21:53 . 2009-02-14 19:25 d-------- c:\users\All Users\Spybot - Search & Destroy 2009-02-08 21:53 . 2009-02-14 19:25 d-------- c:\programdata\Spybot - Search & Destroy 2009-02-08 21:53 . 2009-02-15 00:06 d-------- c:\program files\Spybot - Search & Destroy 2009-02-08 21:48 . 2009-02-15 00:06 d-------- c:\program files\eMule 2009-02-04 18:22 . 2009-02-05 20:51 d-------- c:\program files\Common Files\Softwin 2009-02-04 18:04 . 2009-02-04 18:04 d-------- C:\_OTMoveIt 2009-02-02 13:10 . 2009-02-07 14:21 d-------- c:\program files\Panda Security 2009-02-02 13:02 . 2009-02-05 21:15 d-------- c:\windows\BDOSCAN8 2009-02-02 12:59 . 2009-02-07 14:19 d-------- c:\program files\Sophos 2009-02-02 12:34 . 2009-02-05 21:15 d-------- c:\program files\Navilog1 2009-02-01 20:20 . 2009-02-05 21:15 d-------- C:\ToolBar SD 2009-02-01 19:47 . 2009-02-01 19:48 d-------- C: sit 2009-02-01 19:47 . 2009-02-07 20:17 d-------- c:\program files rend micro 2009-02-01 01:43 . 2009-02-01 01:43 d-------- c:\users\Step\AppData\Roaming\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\users\All Users\Malwarebytes 2009-02-01 01:42 . 2009-02-01 01:42 d-------- c:\programdata\Malwarebytes 2009-02-01 01:42 . 2009-02-02 20:31 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-01 00:10 . 2009-02-01 16:43 250 --a------ c:\windows\gmer.ini 2009-01-24 05:24 . 2009-02-05 21:15 d-------- c:\program files\aquaplay 2009-01-23 20:26 . 2009-02-05 20:04 d-------- c:\users\All Users\Sports Interactive 2009-01-23 20:26 . 2009-02-05 20:04 d-------- c:\programdata\Sports Interactive 2009-01-23 20:24 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\System32\D3DX9_38.dll 2009-01-23 20:24 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\System32\D3DCompiler_38.dll 2009-01-23 20:24 . 2008-05-30 14:19 507,400 --a------ c:\windows\System32\XAudio2_1.dll 2009-01-23 20:24 . 2008-03-05 16:03 479,752 --a------ c:\windows\System32\XAudio2_0.dll 2009-01-23 20:24 . 2008-05-30 14:11 467,984 --a------ c:\windows\System32\d3dx10_38.dll 2009-01-23 20:24 . 2008-05-30 14:18 238,088 --a------ c:\windows\System32\xactengine3_1.dll 2009-01-23 20:24 . 2008-03-05 16:03 238,088 --a------ c:\windows\System32\xactengine3_0.dll 2009-01-23 20:24 . 2008-05-30 14:17 65,032 --a------ c:\windows\System32\XAPOFX1_0.dll 2009-01-23 20:24 . 2008-05-30 14:17 25,608 --a------ c:\windows\System32\X3DAudio1_4.dll 2009-01-23 20:24 . 2008-03-05 16:00 25,608 --a------ c:\windows\System32\X3DAudio1_3.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-18 09:41 --------- d-----w c:\program files\Yahoo! 2009-02-17 22:21 --------- d-----w c:\program files\VirginMega 2009-02-14 23:06 --------- d-----w c:\program files\Messenger Plus! Live 2009-02-14 23:06 --------- d-----w c:\program files\CCleaner 2009-02-05 20:23 --------- d-----w c:\program files\Paint.NET 2009-02-05 20:15 --------- d-----w c:\users\Step\AppData\Roaming\DAEMON Tools 2009-02-05 20:15 --------- d-----w c:\users\Step\AppData\Roaming\Azureus 2009-02-05 20:15 --------- d-----w c:\program files\Windows Defender 2009-01-24 04:45 --------- d-----w c:\users\Step\AppData\Roaming\Sports Interactive 2009-01-23 18:09 --------- d-----w c:\program files\Sports Interactive 2009-01-21 20:30 --------- d-----w c:\program files\Azureus 2009-01-15 16:58 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-01-15 10:05 911,872 ----a-w c:\windows\System32\wininet.dll 2009-01-15 10:05 43,008 ----a-w c:\windows\System32\licmgr10.dll 2009-01-15 10:04 18,944 ----a-w c:\windows\System32\corpol.dll 2009-01-15 10:04 132,096 ----a-w c:\windows\System32\ieUnatt.exe 2009-01-15 10:04 109,568 ----a-w c:\windows\System32\PDMSetup.exe 2009-01-15 10:04 109,056 ----a-w c:\windows\System32\iesysprep.dll 2009-01-15 10:04 107,520 ----a-w c:\windows\System32\RegisterIEPKEYs.exe 2009-01-15 10:04 107,008 ----a-w c:\windows\System32\SetIEInstalledDate.exe 2009-01-15 10:04 103,936 ----a-w c:\windows\System32\SetDepNx.exe 2009-01-15 10:03 72,704 ----a-w c:\windows\System32\admparse.dll 2009-01-15 10:03 71,680 ----a-w c:\windows\System32\iesetup.dll 2009-01-15 10:03 66,560 ----a-w c:\windows\System32\wextract.exe 2009-01-15 10:03 420,352 ----a-w c:\windows\System32\vbscript.dll 2009-01-15 10:02 169,472 ----a-w c:\windows\System32\iexpress.exe 2009-01-15 10:01 34,304 ----a-w c:\windows\System32\imgutil.dll 2009-01-15 10:00 48,128 ----a-w c:\windows\System32\mshtmler.dll 2009-01-15 10:00 45,568 ----a-w c:\windows\System32\mshta.exe 2009-01-15 09:50 156,160 ----a-w c:\windows\System32\msls31.dll 2009-01-13 19:49 --------- d-----w c:\users\Step\AppData\Roaming\aAvgApi 2009-01-12 20:18 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-01-12 20:18 10,520 ----a-w c:\windows\System32\avgrsstx.dll 2009-01-12 20:18 --------- d-----w c:\programdata\avg8 2009-01-12 20:17 12,552 ----a-w c:\windows\system32\drivers\avgrkx86.sys 2009-01-11 16:00 --------- d-----w c:\program files\Common Files\Adobe 2008-12-31 13:55 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-12-30 14:56 --------- d-----w c:\users\Step\AppData\Roaming\InterVideo 2008-12-28 12:35 --------- d-----w c:\programdata\Messenger Plus! 2008-12-28 11:55 --------- d-----w c:\users\Step\AppData\Roaming\Canneverbe_Limited 2008-12-28 11:54 --------- d-----w c:\program files\CDBurnerXP 2008-12-28 10:32 --------- d-----w c:\users\Step\AppData\Roaming\Ahead 2008-12-28 10:10 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-28 10:10 --------- d-----w c:\program files\Microsoft Reader 2008-12-28 10:03 --------- d-----w c:\users\TEMP\AppData\Roaming\ATI 2008-12-28 00:46 --------- d-----w c:\program files\BitTorrent 2008-12-28 00:24 --------- d-----w c:\program files\iPod 2008-12-28 00:24 --------- d-----w c:\program files\Bonjour 2008-12-28 00:21 --------- d-----w c:\program files\Windows Sidebar 2008-12-28 00:21 --------- d-----w c:\program files\Windows Photo Gallery 2008-12-28 00:21 --------- d-----w c:\program files\SplitCam 2008-12-28 00:21 --------- d-----w c:\program files\QuickTime 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft Sync Framework 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-12-28 00:20 --------- d-----w c:\program files\Microsoft 2008-12-27 23:47 --------- d-----w c:\users\Step\AppData\Roaming\Apple Computer 2008-12-27 23:46 --------- d-----w c:\program files\iTunes 2008-12-27 23:46 --------- d-----w c:\program files\Common Files\Apple 2008-12-27 23:45 --------- d-----w c:\programdata\Apple Computer 2008-12-27 23:37 --------- d-----w c:\program files\Apple Software Update 2008-12-27 21:16 --------- d-----w c:\programdata\ma-config.com 2008-12-27 21:16 --------- d-----w c:\program files\ma-config.com 2008-12-18 10:57 --------- d-----w c:\program files\Windows Live 2008-12-18 09:45 --------- d-----w c:\program files\Windows Mail 2008-12-17 19:25 174 --sha-w c:\program files\desktop.ini 2008-12-17 18:38 82,432 ----a-w c:\windows\System32\axaltocm.dll 2008-12-17 18:38 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR 2008-12-02 21:37 49,480 ----a-w c:\windows\System32\sirenacm.dll 2008-06-25 17:58 1,664,591 ----a-w c:\users\2007\pf-setup.exe . ((((((((((((((((((((((((((((( SnapShot_2009-02-17_ 3.30.03.04 ))))))))))))))))))))))))))))))))))))))))) . - 2009-02-16 18:54:51 941,680 ----a-w c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat + 2009-02-18 11:40:36 1,140,816 ----a-w c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat - 2009-02-17 02:00:23 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-02-18 11:41:51 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-02-17 02:00:23 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2009-02-18 11:41:51 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2009-01-28 20:29:33 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-02-17 21:14:58 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-01-28 20:29:33 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-02-17 21:14:58 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-01-28 20:29:33 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-17 21:14:58 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-02-17 02:02:57 262,144 --sha-w c:\windows\ServiceProfiles\LocalService tuser.dat + 2009-02-18 11:43:55 262,144 --sha-w c:\windows\ServiceProfiles\LocalService tuser.dat - 2009-02-17 02:02:50 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService tuser.dat + 2009-02-18 11:43:48 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService tuser.dat - 2008-01-19 07:33:43 128,000 ----a-w c:\windows\System32\advpack.dll + 2009-01-15 10:03:11 128,512 ----a-w c:\windows\System32\advpack.dll - 2009-02-17 02:14:56 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2009-02-18 11:57:45 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-02-17 02:14:56 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-02-18 11:57:45 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-02-17 02:14:56 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-18 11:57:45 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2009-02-16 15:10:52 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2009-02-18 11:57:45 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat - 2008-01-19 07:34:08 347,136 ----a-w c:\windows\System32\dxtmsft.dll + 2009-01-15 10:01:21 348,160 ----a-w c:\windows\System32\dxtmsft.dll - 2008-01-19 07:34:08 214,528 ----a-w c:\windows\System32\dxtrans.dll + 2009-01-15 10:01:14 216,064 ----a-w c:\windows\System32\dxtrans.dll - 2008-01-19 07:34:28 63,488 ----a-w c:\windows\System32\icardie.dll + 2009-01-15 10:01:38 59,904 ----a-w c:\windows\System32\icardie.dll - 2008-01-19 07:33:12 70,656 ----a-w c:\windows\System32\ie4uinit.exe + 2009-01-15 10:03:26 172,544 ----a-w c:\windows\System32\ie4uinit.exe - 2008-01-19 07:34:28 153,088 ----a-w c:\windows\System32\ieakeng.dll + 2009-01-15 10:03:41 125,952 ----a-w c:\windows\System32\ieakeng.dll - 2008-01-19 07:34:28 230,400 ----a-w c:\windows\System32\ieaksie.dll + 2009-01-15 10:03:48 228,352 ----a-w c:\windows\System32\ieaksie.dll - 2006-11-02 09:39:30 161,792 ----a-w c:\windows\System32\ieakui.dll + 2009-01-15 10:03:19 163,840 ----a-w c:\windows\System32\ieakui.dll - 2007-09-23 10:44:58 2,455,488 ----a-w c:\windows\System32\ieapfltr.dat + 2008-12-15 01:12:40 3,698,040 ----a-w c:\windows\System32\ieapfltr.dat - 2008-01-19 07:34:28 383,488 ----a-w c:\windows\System32\ieapfltr.dll + 2009-01-15 09:35:08 445,440 ----a-w c:\windows\System32\ieapfltr.dll - 2008-01-19 07:34:29 388,096 ----a-w c:\windows\System32\iedkcs32.dll + 2009-01-15 10:17:21 392,040 ----a-w c:\windows\System32\iedkcs32.dll - 2008-10-16 04:47:29 6,068,736 ----a-w c:\windows\System32\ieframe.dll + 2009-01-15 10:12:11 10,963,968 ----a-w c:\windows\System32\ieframe.dll - 2008-01-19 07:34:31 193,024 ----a-w c:\windows\System32\iepeers.dll + 2009-01-15 10:01:50 183,808 ----a-w c:\windows\System32\iepeers.dll - 2008-01-19 07:34:31 44,544 ----a-w c:\windows\System32\iernonce.dll + 2009-01-15 10:03:13 55,808 ----a-w c:\windows\System32\iernonce.dll - 2008-10-16 04:47:29 270,336 ----a-w c:\windows\System32\iertutil.dll + 2009-01-15 10:02:48 1,975,296 ----a-w c:\windows\System32\iertutil.dll - 2008-01-19 07:34:31 180,736 ----a-w c:\windows\System32\ieui.dll + 2009-01-15 09:50:48 164,352 ----a-w c:\windows\System32\ieui.dll - 2008-01-19 07:34:34 93,696 ----a-w c:\windows\System32\inseng.dll + 2009-01-15 10:03:12 94,720 ----a-w c:\windows\System32\inseng.dll - 2008-05-08 21:59:28 512,000 ----a-w c:\windows\System32\jscript.dll + 2009-01-15 10:03:56 724,992 ----a-w c:\windows\System32\jscript.dll - 2008-10-16 04:47:30 28,160 ----a-w c:\windows\System32\jsproxy.dll + 2009-01-15 10:04:14 25,600 ----a-w c:\windows\System32\jsproxy.dll - 2008-04-11 06:42:20 64,512 ----a-w c:\windows\System32\migration\WininetPlugin.dll + 2009-01-15 10:04:18 64,512 ----a-w c:\windows\System32\migration\WininetPlugin.dll - 2009-01-10 01:35:28 20,853,704 ----a-w c:\windows\System32\mrt.exe + 2009-02-12 04:56:17 21,244,872 ----a-w c:\windows\System32\mrt.exe - 2008-01-19 07:34:58 458,240 ----a-w c:\windows\System32\msfeeds.dll + 2009-01-15 10:02:38 593,920 ----a-w c:\windows\System32\msfeeds.dll - 2008-01-19 07:34:58 52,224 ----a-w c:\windows\System32\msfeedsbs.dll + 2009-01-15 10:01:38 54,272 ----a-w c:\windows\System32\msfeedsbs.dll - 2008-01-19 07:33:16 12,800 ----a-w c:\windows\System32\msfeedssync.exe + 2009-01-15 10:01:41 13,312 ----a-w c:\windows\System32\msfeedssync.exe - 2008-12-12 05:52:52 3,578,880 ----a-w c:\windows\System32\mshtml.dll + 2009-01-15 10:13:17 5,888,512 ----a-w c:\windows\System32\mshtml.dll - 2008-01-19 07:34:59 476,672 ----a-w c:\windows\System32\mshtmled.dll + 2009-01-15 10:01:05 66,560 ----a-w c:\windows\System32\mshtmled.dll - 2008-01-19 07:35:12 193,024 ----a-w c:\windows\System32\msrating.dll + 2009-01-15 10:05:33 193,536 ----a-w c:\windows\System32\msrating.dll - 2008-10-16 04:47:32 671,232 ----a-w c:\windows\System32\mstime.dll + 2009-01-15 10:02:19 611,840 ----a-w c:\windows\System32\mstime.dll - 2008-01-19 07:36:00 102,912 ----a-w c:\windows\System32\occache.dll + 2009-01-15 10:05:33 109,056 ----a-w c:\windows\System32\occache.dll - 2008-01-19 07:36:06 45,056 ----a-w c:\windows\System32\pngfilt.dll + 2009-01-15 10:01:16 46,592 ----a-w c:\windows\System32\pngfilt.dll - 2009-02-17 02:08:10 6,291,456 ----a-w c:\windows\System32\SMI\Store\Machine\schema.dat + 2009-02-17 14:59:21 6,291,456 ----a-w c:\windows\System32\SMI\Store\Machine\schema.dat - 2008-01-19 07:36:46 105,984 ----a-w c:\windows\System32\url.dll + 2009-01-15 10:05:58 105,984 ----a-w c:\windows\System32\url.dll - 2008-10-16 04:47:34 1,166,336 ----a-w c:\windows\System32\urlmon.dll + 2009-01-15 10:06:46 1,182,720 ----a-w c:\windows\System32\urlmon.dll - 2009-02-17 02:02:51 13,846 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3104662218-1256191170-3440181771-1002_UserData.bin + 2009-02-18 11:44:07 13,886 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3104662218-1256191170-3440181771-1002_UserData.bin - 2009-02-17 02:02:50 71,036 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2009-02-18 11:44:07 71,414 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2009-02-16 18:54:42 4,370 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat + 2009-02-17 13:43:20 4,370 ----a-w c:\windows\System32\WDI\ERCQueuedResolutions.dat - 2009-02-16 13:06:53 58,406 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-02-18 11:43:58 58,422 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin - 2008-01-19 07:36:52 233,984 ----a-w c:\windows\System32\webcheck.dll + 2009-01-15 10:06:07 236,544 ----a-w c:\windows\System32\webcheck.dll - 2008-01-19 07:33:37 208,384 ----a-w c:\windows\System32\WinFXDocObj.exe + 2009-01-15 10:06:20 208,384 ----a-w c:\windows\System32\WinFXDocObj.exe - 2009-02-17 02:08:18 191,005,605 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin + 2009-02-17 14:52:38 196,504,260 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin + 2009-01-15 10:03:11 128,512 ----a-w c:\windows\winsxs\x86_microsoft-windows-advpack_31bf3856ad364e35_8.0.6001.18372_none_8e6ad0c808d4cd48\advpack.dll + 2009-01-15 10:04:05 107,008 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_8.0.6001.18372_none_eb166cf8d70d9a7c\SetIEInstalledDate.exe + 2009-01-15 10:01:16 46,592 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..ablenetworkgraphics_31bf3856ad364e35_8.0.6001.18372_none_d065da77296db347\pngfilt.dll + 2009-01-15 10:06:46 1,182,720 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_8.0.6001.18372_none_97828329ecce2aab\urlmon.dll + 2009-01-15 10:02:19 611,840 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..mlrenderingadvanced_31bf3856ad364e35_8.0.6001.18372_none_c36511f29276ea1a\mstime.dll + 2009-01-15 10:04:26 18,944 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..tivexpolicyprovider_31bf3856ad364e35_8.0.6001.18372_none_6f0a64fd61b66334\corpol.dll + 2009-01-15 10:04:14 25,600 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.18372_none_e4885ecbb7d7513e\jsproxy.dll + 2009-01-15 10:05:40 911,872 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.18372_none_e4885ecbb7d7513e\wininet.dll + 2009-01-15 10:04:18 64,512 ----a-w c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.6001.18372_none_e4885ecbb7d7513e\WininetPlugin.dll + 2009-01-15 10:17:21 392,040 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-adminkitbranding_31bf3856ad364e35_8.0.6001.18372_none_56efd7c76d817205\iedkcs32.dll + 2009-01-15 10:03:41 125,952 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-adminkitengine_31bf3856ad364e35_8.0.6001.18372_none_86b5a17dde37d53a\ieakeng.dll + 2009-01-15 10:03:31 72,704 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-adminkitmostfiles_31bf3856ad364e35_8.0.6001.18372_none_90d18d1b1cca28e4\admparse.dll + 2009-01-15 10:03:48 228,352 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-adminkitmostfiles_31bf3856ad364e35_8.0.6001.18372_none_90d18d1b1cca28e4\ieaksie.dll + 2009-01-15 10:03:19 163,840 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-adminkitmostfiles_31bf3856ad364e35_8.0.6001.18372_none_90d18d1b1cca28e4\ieakui.dll + 2008-12-15 01:12:40 3,698,040 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_8.0.6001.18372_none_de3181a581c2cb91\ieapfltr.dat + 2009-01-15 09:35:08 445,440 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_8.0.6001.18372_none_de3181a581c2cb91\ieapfltr.dll + 2009-01-15 10:01:50 183,808 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-behaviors_31bf3856ad364e35_8.0.6001.18372_none_1f62effd081219a0\iepeers.dll + 2009-01-15 10:05:33 43,008 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-controls_31bf3856ad364e35_8.0.6001.18372_none_ac80c33865f6f825\licmgr10.dll + 2009-01-15 10:07:32 736,768 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-devtools_31bf3856ad364e35_8.0.6001.18372_none_1e44781e55da9d7f\iedvtool.dll + 2009-01-15 10:01:21 348,160 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-directxtransforms_31bf3856ad364e35_8.0.6001.18372_none_7a65ba5d97a851bf\dxtmsft.dll + 2009-01-15 10:01:14 216,064 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-directxtransforms_31bf3856ad364e35_8.0.6001.18372_none_7a65ba5d97a851bf\dxtrans.dll + 2009-01-15 10:02:38 593,920 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-feeds-platform_31bf3856ad364e35_8.0.6001.18372_none_4285f59a507aa3f6\msfeeds.dll + 2009-01-15 10:01:38 54,272 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.6001.18372_none_deed5a57f0c6431d\msfeedsbs.dll + 2009-01-15 10:01:41 13,312 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.6001.18372_none_deed5a57f0c6431d\msfeedssync.exe + 2009-01-15 10:04:05 107,520 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.6001.18372_none_0a88416b39d399f7\RegisterIEPKEYs.exe + 2009-01-15 10:04:05 103,936 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-gc-setdepnx_31bf3856ad364e35_8.0.6001.18372_none_934a5a5607dc0ab7\SetDepNx.exe + 2009-01-15 10:00:37 45,568 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.6001.18372_none_3bf95a8f1f61ce38\mshta.exe + 2009-01-15 10:01:05 66,560 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-htmlediting_31bf3856ad364e35_8.0.6001.18372_none_2ac854b55969044c\mshtmled.dll + 2009-01-15 10:00:44 48,128 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-htmleditingsupport_31bf3856ad364e35_8.0.6001.18372_none_d60cf1ced02adb99\mshtmler.dll + 2009-01-15 10:13:17 5,888,512 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.6001.18372_none_f5e27dea382dba74\mshtml.dll + 2009-01-15 10:04:05 125,952 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-iecleanup_31bf3856ad364e35_8.0.6001.18372_none_a085c086aa922a39\iecleanup.exe + 2009-01-15 10:06:45 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-iecompat_31bf3856ad364e35_8.0.6001.18372_none_838ef3c446ee6331\iecompat.dll + 2009-01-09 23:47:53 79,360 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-iecompat_31bf3856ad364e35_8.0.6001.18386_none_8388250046f2e47e\iecompat.dll + 2009-01-09 22:35:51 79,360 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-iecompat_31bf3856ad364e35_8.0.6001.22482_none_840dc0a360141eec\iecompat.dll + 2009-01-15 10:04:59 115,712 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.6001.18372_none_e9157774873ef983\ielowutil.exe + 2009-01-15 10:04:40 245,760 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-ieproxy_31bf3856ad364e35_8.0.6001.18372_none_72ce4fad6094dbbd\ieproxy.dll + 2009-01-15 10:04:20 193,024 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-ieshims_31bf3856ad364e35_8.0.6001.18372_none_2a2c9b43b03d422b\IEShims.dll + 2009-01-15 10:02:56 169,472 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.6001.18372_none_471b482f54b63138\iexpress.exe + 2009-01-15 10:03:04 66,560 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.6001.18372_none_471b482f54b63138\wextract.exe + 2009-01-15 10:01:25 34,304 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-imagesupport_31bf3856ad364e35_8.0.6001.18372_none_209434220912bb05\imgutil.dll + 2009-01-15 10:06:47 143,872 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_8.0.6001.18372_none_109d2beed989d5a6\ExtExport.exe + 2009-01-15 10:01:38 59,904 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-infocard_31bf3856ad364e35_8.0.6001.18372_none_3d3aeab47a42467d\icardie.dll + 2009-01-15 10:04:05 132,096 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18372_none_12016b573002c021\ieUnatt.exe + 2009-01-15 10:17:20 636,264 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.6001.18372_none_12016b573002c021\iexplore.exe + 2009-01-15 10:06:38 519,168 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-jscriptdebugui_31bf3856ad364e35_8.0.6001.18372_none_9d0bba2be3a97c27\jsdbgui.dll + 2009-01-15 10:06:39 118,272 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-jsprofilercore_31bf3856ad364e35_8.0.6001.18372_none_ed4707bd47637a4e\JSProfilerCore.dll + 2009-01-15 10:07:05 231,424 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-jsprofilerui_31bf3856ad364e35_8.0.6001.18372_none_d59e64f5e43736e5\jsprofilerui.dll + 2009-01-15 10:05:33 109,056 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_8.0.6001.18372_none_19c5d37a2a275509\occache.dll + 2009-01-15 10:06:07 236,544 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_8.0.6001.18372_none_43cb4e4667bdcfed\webcheck.dll + 2008-10-10 20:42:04 265,720 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.6001.18372_none_d01555fafe902944\msdbg2.dll + 2008-10-10 20:42:05 355,832 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.6001.18372_none_d01555fafe902944\pdm.dll + 2009-01-15 10:04:05 109,568 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.6001.18372_none_d01555fafe902944\PDMSetup.exe + 2009-01-15 10:05:33 193,536 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-ratings_31bf3856ad364e35_8.0.6001.18372_none_aa31a9a272bf7a1f\msrating.dll + 2009-01-15 10:02:48 1,975,296 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_8.0.6001.18372_none_2a4315a7a2886f9b\iertutil.dll + 2009-01-15 10:17:21 141,160 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_8.0.6001.18372_none_2a4315a7a2886f9b\sqmapi.dll + 2009-01-15 10:03:26 172,544 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.6001.18372_none_a8702072747d88c6\ie4uinit.exe + 2009-01-15 10:03:13 55,808 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.6001.18372_none_a8702072747d88c6\iernonce.dll + 2009-01-15 10:03:16 71,680 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.6001.18372_none_a8702072747d88c6\iesetup.dll + 2009-01-15 10:03:12 94,720 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-setup_31bf3856ad364e35_8.0.6001.18372_none_7bdec6f45dcc8c96\inseng.dll + 2009-01-15 10:04:10 109,056 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-sysprep_31bf3856ad364e35_8.0.6001.18372_none_fe31851ed000c58b\iesysprep.dll + 2009-01-15 10:04:55 755,200 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-vgx_31bf3856ad364e35_8.0.6001.18372_none_cfd67cb8febf36da\VGX.dll + 2009-01-15 10:06:20 208,384 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-winfxdocobj_31bf3856ad364e35_8.0.6001.18372_none_d45682f2305b1e8e\WinFXDocObj.exe + 2009-01-15 10:05:58 105,984 ----a-w c:\windows\winsxs\x86_microsoft-windows-ie-winsockautodialstub_31bf3856ad364e35_8.0.6001.18372_none_d2ca3c9473ce9fe8\url.dll + 2009-01-15 10:12:11 10,963,968 ----a-w c:\windows\winsxs\x86_microsoft-windows-ieframe_31bf3856ad364e35_8.0.6001.18372_none_4741d7edc42348a1\ieframe.dll + 2009-01-15 09:50:48 164,352 ----a-w c:\windows\winsxs\x86_microsoft-windows-ieframe_31bf3856ad364e35_8.0.6001.18372_none_4741d7edc42348a1\ieui.dll + 2009-01-15 10:04:50 256,512 ----a-w c:\windows\winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_8.0.6001.18372_none_cb3b446ca7a69cd9\ieinstal.exe + 2009-01-15 10:06:35 120,832 ----a-w c:\windows\winsxs\x86_microsoft-windows-js-debuggeride_31bf3856ad364e35_8.0.6001.18372_none_1d97a2aa14b916c7\jsdebuggeride.dll + 2009-01-15 09:50:37 156,160 ----a-w c:\windows\winsxs\x86_microsoft-windows-msls31_31bf3856ad364e35_8.0.6001.18372_none_ae9f3f04b877fd43\msls31.dll + 2009-01-15 10:03:56 724,992 ----a-w c:\windows\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_8.0.6001.18372_none_657f53e50d289665\jscript.dll + 2009-01-15 10:03:34 420,352 ----a-w c:\windows\winsxs\x86_microsoft-windows-scripting-vbscript_31bf3856ad364e35_8.0.6001.18372_none_2af96e9d43eb42a1\vbscript.dll . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 413696] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-12-02 3882312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2006-12-20 77824] "TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-14 411768] "SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2006-12-14 493688] "00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 530552] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-11 90112] "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-12-16 188416] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 815104] "TOSHIBA Volume Indicator"="c:\program files\Toshiba\Utilities\VolControl.exe" [2006-12-13 94208] "topi"="c:\program files\TOSHIBA\Toshiba Online Product Information opi.exe" [2006-12-15 577536] "Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2006-12-13 554640] "fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2008-12-08 453984] "VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-20 155648] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-12 1601304] "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-01 c:\windows\RtHDVCpl.exe] "NDSTray.exe"="NDSTray.exe" [BU] c:\users\2007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2008-04-23 29696] Lancement rapide de Microsoft Office OneNote 2003.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=G [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-24 16:02 490952 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{5FD91A4C-4DB7-4928-B53A-6D5FC34295DB}c:\program files\bearshare applications\bearshare\bearshare.exe"= UDP:c:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "UDP Query User{419DCCF4-F449-4FAA-9255-14B244D9CD47}c:\program files\bearshare applications\bearshare\bearshare.exe"= TCP:c:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "TCP Query User{6DF018C9-6C18-4C79-AA7D-1E3C34979C0B}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus "UDP Query User{1B957FE3-F7B2-45B8-B14B-20E8D8BF36E3}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus "TCP Query User{BBBE5863-238E-4B75-8719-4F5342394360}c:\users\2007\appdata\local\temp\rar$ex00.171\emule\emule.exe"= UDP:c:\users\2007\appdata\local emp ar$ex00.171\emule\emule.exe:emule.exe "UDP Query User{67500115-DC8F-4C89-BA3C-A4744AD4E436}c:\users\2007\appdata\local\temp\rar$ex00.171\emule\emule.exe"= TCP:c:\users\2007\appdata\local emp ar$ex00.171\emule\emule.exe:emule.exe "TCP Query User{9CEF591D-A89A-4C92-BAEB-0D3CB26BD49F}c:\program files\limewire\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{4B70F833-BC74-460F-9282-3FB9FB9BB736}c:\program files\limewire\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{F56905EA-E544-4CC3-AB7E-EE1214E1E8CC}c:\program files\bittorrent\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:bittorrent "UDP Query User{F78F6B5B-FEF5-47C6-A315-7DE628CA3D75}c:\program files\bittorrent\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:bittorrent "{D7C874C2-43D8-479E-8B7A-AB41451EEF90}"= Disabled:UDP:c:\program files\fm.exe:Football Manager 2008 "{5B3DCBAC-B132-46F6-9393-B35D886DC396}"= Disabled:TCP:c:\program files\fm.exe:Football Manager 2008 "TCP Query User{20EDBEE9-47B9-4FDB-A3B1-41A241D2A7FE}c:\program files\sopcast\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "UDP Query User{9521B02B-9AC6-4227-8949-0E57CEB5B2B8}c:\program files\sopcast\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application "TCP Query User{161C8511-8AA2-4B90-98E3-4E7160E5F9E8}c:\program files\tvuplayer\tvuplayer.exe"= UDP:c:\program files vuplayer vuplayer.exe:TVUPlayer Component "UDP Query User{F4AA48FC-F466-4A90-9A76-9EA89684E16E}c:\program files\tvuplayer\tvuplayer.exe"= TCP:c:\program files vuplayer vuplayer.exe:TVUPlayer Component "TCP Query User{39F9BBEB-2BC8-43E3-BB42-FBCBCDCA3EAD}c:\program files\ppmate\ppmate\ppmate.exe"= UDP:c:\program files\ppmate\ppmate\ppmate.exe:PPMate P2P TV "UDP Query User{ACBAF6E3-97E3-45CB-8842-CAE637A0EF29}c:\program files\ppmate\ppmate\ppmate.exe"= TCP:c:\program files\ppmate\ppmate\ppmate.exe:PPMate P2P TV "TCP Query User{2A05CA98-2A5A-4F74-9CEF-7672D26610B5}c:\program files\tvants\tvants.exe"= UDP:c:\program files vants vants.exe:TVAnts "UDP Query User{75F44963-AB3D-44C1-A755-9B8940C9C4AB}c:\program files\tvants\tvants.exe"= TCP:c:\program files vants vants.exe:TVAnts "TCP Query User{9DDA4A41-30BD-4196-85D0-9EA7DB44F854}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{6763BFB0-A49B-4277-A9CE-A19578701E25}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{38713D86-3CA7-499A-9B2A-14AF270526B4}c:\users\2007\appdata\roaming\sopcast\adv\sopadver.exe"= UDP:c:\users\2007\appdata oaming\sopcast\adv\sopadver.exe:sopadver.exe "UDP Query User{299B3A3B-3B1C-4974-8F50-0153917864D8}c:\users\2007\appdata\roaming\sopcast\adv\sopadver.exe"= TCP:c:\users\2007\appdata oaming\sopcast\adv\sopadver.exe:sopadver.exe "TCP Query User{0D9D7D59-AADB-4947-87D4-98C717CDE973}c:\users\2007\appdata\local\temp\rar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= UDP:c:\users\2007\appdata\local emp ar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "UDP Query User{6DF04E2B-4701-4509-8054-4AE12924940E}c:\users\2007\appdata\local\temp\rar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= TCP:c:\users\2007\appdata\local emp ar$ex02.766\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "TCP Query User{17A35D09-AE7C-4F5C-B13D-FC286C30EF4D}c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= UDP:c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "UDP Query User{9A5627BA-9821-424D-8218-EF7212B6654F}c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe"= TCP:c:\users\2007\desktop\portable limewire pro 4.14.10_multilang\limewire pro 4.14.10 portable.exe:limewire pro 4.14.10 portable.exe "{41459E7D-92F3-4E24-8F71-D5C96095655D}"= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{13B6E290-630B-4DA0-84A9-1F716AFFAB55}"= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{A4673DA1-B535-40B4-94BC-1C31865E8EA3}"= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "{620635BF-FE10-4A5E-8303-A28AC3A25581}"= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "TCP Query User{55EE90A1-CE93-47BB-AE27-65FE0F2B89CA}c:\program files\azureus\azureus.exe"= UDP:c:\program files\azureus\azureus.exe:Azureus "UDP Query User{414DF850-822B-4472-A942-E2B9C9F47B22}c:\program files\azureus\azureus.exe"= TCP:c:\program files\azureus\azureus.exe:Azureus "TCP Query User{FCF6337D-B51F-488B-8F32-325683A80121}c:\program files\x-chat 2\xchat.exe"= UDP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client "UDP Query User{86EF4704-CDAE-4FFC-A2E3-2233AA84B20B}c:\program files\x-chat 2\xchat.exe"= TCP:c:\program files\x-chat 2\xchat.exe:X-Chat IRC Client "{8EE34478-C877-4132-8760-01BA327FEEA2}"= UDP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{A2A9274B-85DB-4921-A9B9-0AB54253676B}"= TCP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008 "{84BD71E7-5322-40FC-9D41-75009201E747}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe "{CCE87925-0BEA-4C21-A2C2-36BB72ECC53A}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{EB21003F-AFFE-4796-9980-E3DA1E3D189F}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe "{5DDEEE1B-4615-4B66-AFCE-91AD14CEEFD8}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync "{D21EC17D-59F9-4560-AF55-965F1D2F1680}"= UDP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009 "{5967084E-B8D9-4D40-AFE7-3EA8E4830CA3}"= TCP:c:\program files\Sports Interactive\Football Manager 2009\fm.exe:Football Manager 2009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\Program Files\BitTorrent\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent "c:\Program Files\PPMate\PPMate\ppmate.exe"= c:\program files\PPMate\PPMate\ppmate.exe:*:Enabled:PPMate "c:\Program Files\uusee\UUSeePlayer.exe"= c:\program files\uusee\UUSeePlayer.exe:*:Enabled:UUPlayer R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2008-11-15 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2008-11-15 325128] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2008-11-15 107272] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-12 298264] R2 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [2008-12-18 55264] R2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344] R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640] --- Autres Services/Pilotes en mémoire --- *Deregistered* - sptd [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\System32 undll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . - - - - ORPHELINS SUPPRIMES - - - - MSConfigStartUp-Steam - c:\program files\Steam\Steam.exe . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.facebook.com/home.php mWindow Title = IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: {{C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?FR DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - hxxps://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game01.zylom.com/activex/zylomgamesplayer.cab FF - ProfilePath - c:\users\Step\AppData\Roaming\Mozilla\Firefox\Profiles w1nhsww.default\ FF - plugin: c:\program files\Java\jre1.6.0\bin pjava11.dll FF - plugin: c:\program files\Java\jre1.6.0\bin pjava12.dll FF - plugin: c:\program files\Java\jre1.6.0\bin pjava13.dll FF - plugin: c:\program files\Java\jre1.6.0\bin pjava14.dll FF - plugin: c:\program files\Java\jre1.6.0\bin pjava32.dll FF - plugin: c:\program files\Java\jre1.6.0\bin pjpi160.dll FF - plugin: c:\program files\Java\jre1.6.0\bin poji610.dll FF - plugin: c:\program files\Microsoft\Office Live pOLW.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-18 12:58:21 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i?????P?Qe?U??0???X????????????? Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2009-02-18 13:03:14 ComboFix-quarantined-files.txt 2009-02-18 12:02:51 ComboFix2.txt 2009-02-17 02:33:54 ComboFix3.txt 2009-02-07 20:33:12 ComboFix4.txt 2009-02-02 14:04:21 Avant-CF: 13 687 234 560 octets libres Après-CF: 13,485,559,808 octets libres 455 --- E O F --- 2009-02-17 02:10:15

jlpjlp · Answer

si cela persiste vire avg et mets antivir à la place ou ignore avec avg

Kira · Answer

j'ai mis ignorer (enfin je crois) mmais sa marche pas des masses, et sa m'énerve un peu d'avoir payer AVG pour le virer quoi...
y'aurait-il un tutoriel expliquant comment ignorer sur AVG 8.0?

Kira · Answer

En mode sans échec je n'arrive pas a accéder a l'interface , en effet il lance direct une analyse ...

Kira · Answer

j'ai un gros problème plus important que ce rootkit, c'est que depuis son apparition , mon lecteur cd ne lis plus...
Pourtant le lecteur cd de mon portable s'ouvre, et le CD tourne.

Le lecteur est un toshiba K8032GSX ATA Device.
PQFERUV 1A7WA5A7 SCSI Cdrom Device.

jlpjlp · Answer

tu as regardé ici les pilotes?

https://fr.dynabook.com/support/drivers/

http://fr.computers.toshiba-europe.com/innovation/generic/SUPPORT_PORTAL/

Kira · Answer

Non car je ne m'y retrouve pas trop...
Mon PC est un portable satellite L-30 mais après je m'y perds.

jlpjlp · Answer

tu vas ici

https://fr.dynabook.com/support/drivers/



puis dans categorie tu mets portable

puis Famille   : sattelite

     Séries produit    :  L30


....

a
Type de Driver     tu mets    utilities

Rootkit Fichier caché.

73 réponses

Discussions similaires