Virus Win32:Swizzor Résolu

Question

Bonjour,
J'ai un micro HP avec XP , et j'avais Norton comme anti virus.
Je viens d'installer AVAST , et j'ai fait un scan du disque C , et il me détecte dans pleins de fichiers le Virus Win32: Swizzor.
J'ai commencé à mettre les premiers en quarantaine mais je me retrouve avec une mémoire insuffisante.

Tout ce que j'ai pu voir se trouve dans  :  C:\System Volume Information\_Restore

Comment puis je faire pour éradiquer ce virus?  ( Le disque dur est divisé en 2 , sur le D est installé la restauration) Il a été livré d'origine .

jlpjlp · Answer

slt

C:\System Volume Information\_Restore    c'est ta restauration systeme pour virer ce qui est dedans:


Désactive ta restauration systeme puis redemarre ton ordi puis réactive là comme ceci:
https://www.informatruc.com







pour verifier si il y en a d'autre:


tu télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 

* Double-clique dessus pour lancer l'installation 
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau 
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche) 
* Patiente jusqu'à la fin du scan 
* Poste le rapport généré (C:\lopR.txt)

Martial57 · Answer

Bonjour,

Merci à toi, rien que le fait de désactiver la restauration et ensuite j'ai passé le scan avec Bitdefender et plus rien.

Mais dès que j'ai le temps , j'installe Lop et Sd et je te poste le rapport.

jlpjlp · Answer

ok

a plus

Martial57 · Answer

Bonsoir,
Je viens de faire ce que tu m'as demandé avec Lop et Sd.
Ci dessous le .txt

Merci pour ta réponse.

  --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
   BIOS : Phoenix - Award BIOS v6.00PG
   USER : Compaq_Propriétaire ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1335 [VPS 090207-0] 4.8.1335 (Activated)
   C:\ (Local Disk) - NTFS - Total:181 Go (Free:156 Go)
   D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 08/02/2009|20:23 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [08/02/2009|17:40] C:\DOCUME~1\ADMIN\APPLIC~1\Bitdefender
   [26/10/2005|23:34] C:\DOCUME~1\ADMIN\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\ADMIN\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\ADMIN\APPLIC~1\Real
   [08/02/2009|17:40] C:\DOCUME~1\ADMIN\APPLIC~1\Windows Desktop Search

   [26/10/2005|23:34] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real

   [02/01/2005|00:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [08/02/2009|12:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
   [24/08/2006|18:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
   [25/01/2009|16:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
   [02/01/2005|00:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [25/01/2009|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [08/02/2009|16:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [02/01/2005|00:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [03/12/2006|11:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin
   [05/11/2006|17:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
   [08/05/2008|16:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [07/07/2007|11:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NannyMania
   [22/07/2007|14:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Oberon Games
   [13/12/2006|17:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
   [16/07/2007|17:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
   [02/01/2005|00:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [07/07/2006|18:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
   [02/01/2005|00:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [25/08/2008|18:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [07/02/2009|14:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [09/05/2008|14:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [13/09/2008|07:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [10/09/2006|12:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [06/01/2007|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [10/11/2008|19:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [27/01/2007|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [07/02/2009|14:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Adobe
   [28/07/2006|14:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\AdobeUM
   [08/11/2006|15:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Balloon Express
   [08/02/2009|17:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Bitdefender
   [19/11/2006|14:21] C:\DOCUME~1\COMPAQ~1\APPLIC~1\EA
   [15/10/2006|09:32] C:\DOCUME~1\COMPAQ~1\APPLIC~1\eConf
   [13/10/2007|12:23] C:\DOCUME~1\COMPAQ~1\APPLIC~1\EoRezo
   [27/01/2007|11:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Gaijin Ent
   [09/05/2008|09:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Gamelab
   [23/12/2007|17:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\GibbHill Properties Ltd
   [18/11/2006|10:16] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Google
   [26/10/2008|08:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\gtk-2.0
   [20/07/2006|19:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Help
   [06/07/2006|08:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HP
   [18/07/2006|18:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HPQ
   [27/01/2007|10:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Identities
   [03/12/2006|11:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\iWin
   [15/07/2006|12:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Leadertech
   [23/07/2006|20:07] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Macromedia
   [29/03/2008|09:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft
   [07/07/2006|18:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft Web Folders
   [24/03/2008|10:56] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Mozilla
   [06/01/2007|15:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\MSNInstaller
   [23/12/2008|14:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Odyssee_Sib
   [13/12/2006|17:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\PlayFirst
   [23/07/2006|20:47] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Real
   [01/01/2009|20:35] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Samsung
   [16/07/2007|17:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sandlot Games
   [15/07/2006|12:03] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sonic
   [27/07/2006|13:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sun
   [07/02/2009|14:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Symantec
   [02/07/2006|10:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Template
   [07/02/2009|15:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1	his poll
   [13/09/2008|07:48] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Viewpoint
   [09/05/2008|14:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ViquaSoft
   [30/09/2007|09:40] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Windows Desktop Search
   [30/09/2007|08:53] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Windows Live Writer
   [10/10/2007|16:19] C:\DOCUME~1\COMPAQ~1\APPLIC~1\WinRAR
   [27/01/2007|10:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Zylom

   [26/10/2005|23:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real

   [19/11/2006|10:45] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
   [06/10/2007|09:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [10/11/2008|18:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
   [29/08/2007|18:57] C:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [08/02/2009 17:32][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 12:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [19/05/2007|08:24] C:\Program Files\1-2oder3-Kamera
   [07/02/2009|09:17] C:\Program Files\Adobe
   [25/08/2006|18:45] C:\Program Files\Agfa
   [11/10/2008|16:55] C:\Program Files\Ahead
   [07/02/2009|14:56] C:\Program Files\Alwil Software
   [02/01/2005|00:32] C:\Program Files\ATI Technologies
   [25/08/2006|18:34] C:\Program Files\Boonty
   [25/08/2006|18:33] C:\Program Files\BoontyGames
   [20/10/2005|20:06] C:\Program Files\ComPlus Applications
   [13/10/2007|13:19] C:\Program Files\Controle Parental
   [29/10/2006|13:03] C:\Program Files\Core Design
   [20/03/2008|19:59] C:\Program Files\CPV
   [05/07/2006|18:54] C:\Program Files\Eko
   [04/07/2007|08:47] C:\Program Files\Emme
   [04/02/2009|16:55] C:\Program Files\eMule
   [08/02/2009|12:50] C:\Program Files\Fichiers communs
   [07/02/2009|14:36] C:\Program Files\Gamenext
   [25/01/2009|10:46] C:\Program Files\Google
   [02/01/2005|01:02] C:\Program Files\Hewlett-Packard
   [02/01/2005|00:42] C:\Program Files\HP
   [26/10/2006|18:25] C:\Program Files\IncrediMail
   [07/02/2009|13:55] C:\Program Files\InstallShield Installation Information
   [07/02/2009|16:18] C:\Program Files\Internet Explorer
   [02/01/2005|00:22] C:\Program Files\Java
   [25/12/2006|19:21] C:\Program Files\Maxis
   [21/04/2008|18:06] C:\Program Files\Meine Tierpension
   [24/08/2006|18:41] C:\Program Files\Mes Jeux T‚l‚charg‚s
   [07/02/2009|16:22] C:\Program Files\Messenger
   [11/05/2007|16:40] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [07/07/2006|18:56] C:\Program Files\microsoft frontpage
   [07/07/2006|18:57] C:\Program Files\Microsoft Office
   [30/09/2007|08:47] C:\Program Files\Microsoft SQL Server Compact Edition
   [02/01/2005|00:43] C:\Program Files\Microsoft Works
   [08/02/2009|20:19] C:\Program Files\Mindscape
   [07/02/2009|16:18] C:\Program Files\Movie Maker
   [29/03/2008|13:20] C:\Program Files\MSN
   [26/10/2005|23:36] C:\Program Files\MSN Gaming Zone
   [08/11/2008|10:08] C:\Program Files\MSN Messenger
   [18/11/2006|11:14] C:\Program Files\MSXML 4.0
   [07/02/2009|16:15] C:\Program Files\NetMeeting
   [19/07/2008|16:02] C:\Program Files\Norton Security Scan
   [26/10/2005|23:36] C:\Program Files\Online Services
   [04/11/2006|15:25] C:\Program Files\orange
   [07/02/2009|16:28] C:\Program Files\Outlook Express
   [02/03/2008|11:50] C:\Program Files\PC Camera
   [02/01/2005|00:49] C:\Program Files\PC-Doctor 5 for Windows
   [18/08/2007|10:25] C:\Program Files\PhotoFiltre
   [02/01/2005|00:39] C:\Program Files\Real
   [04/01/2008|18:09] C:\Program Files\Rondomedia
   [20/07/2006|18:54] C:\Program Files\SAGEM
   [25/12/2008|20:51] C:\Program Files\Samsung
   [21/08/2007|09:34] C:\Program Files\Seagrand
   [31/08/2007|12:47] C:\Program Files\Serif
   [02/01/2005|00:52] C:\Program Files\Services en ligne
   [09/06/2007|14:33] C:\Program Files\SimsLoft
   [07/07/2006|18:57] C:\Program Files\Snapshot Viewer
   [08/02/2009|12:51] C:\Program Files\Softwin
   [02/01/2005|00:41] C:\Program Files\Sonic
   [07/02/2009|14:33] C:\Program Files\SupraASCIIArt
   [25/08/2008|18:35] C:\Program Files\SweetIM
   [18/03/2008|18:51] C:\Program Files\Temporary
   [03/01/2007|14:57] C:\Program Files\The Learning Company
   [25/08/2008|18:43] C:\Program Files	his poll
   [29/03/2008|09:49] C:\Program Files\Ubi Soft
   [20/10/2005|20:06] C:\Program Files\Uninstall Information
   [05/04/2008|06:54] C:\Program Files\USB Disk Win98 Driver
   [06/08/2006|12:52] C:\Program Files\Viewpoint
   [08/02/2009|20:16] C:\Program Files\VS Revo Group
   [08/02/2009|20:14] C:\Program Files\Wanadoo
   [30/09/2007|08:46] C:\Program Files\Windows Desktop Search
   [10/02/2007|15:14] C:\Program Files\Windows Journal Viewer
   [07/02/2009|14:06] C:\Program Files\Windows Live
   [31/10/2007|19:15] C:\Program Files\Windows Live Toolbar
   [07/02/2009|16:15] C:\Program Files\Windows Media Player
   [07/02/2009|16:15] C:\Program Files\Windows NT
   [20/10/2005|20:05] C:\Program Files\WindowsUpdate
   [10/10/2007|16:19] C:\Program Files\WinRAR
   [26/10/2005|23:37] C:\Program Files\xerox
   [22/03/2008|16:18] C:\Program Files\YouTube Video Downloader
   [29/03/2008|09:47] C:\Program Files\Zylom Games

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [07/02/2009|13:49] C:\Program Files\Fichiers communs\Adobe
   [11/10/2008|16:55] C:\Program Files\Fichiers communs\Ahead
   [24/08/2006|18:41] C:\Program Files\Fichiers communs\BOONTY Shared
   [07/07/2006|18:54] C:\Program Files\Fichiers communs\Designer
   [02/01/2005|00:36] C:\Program Files\Fichiers communs\HP
   [27/05/2007|09:36] C:\Program Files\Fichiers communs\InstallShield
   [02/01/2005|00:22] C:\Program Files\Fichiers communs\Java
   [02/03/2008|18:21] C:\Program Files\Fichiers communs\Microsoft Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\MSSoap
   [08/05/2008|16:37] C:\Program Files\Fichiers communs\Oberon Media
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\ODBC
   [02/03/2008|11:50] C:\Program Files\Fichiers communs\PAC207
   [02/01/2005|00:39] C:\Program Files\Fichiers communs\Real
   [08/11/2006|15:39] C:\Program Files\Fichiers communs\Sandlot Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\Services
   [08/02/2009|12:51] C:\Program Files\Fichiers communs\Softwin
   [02/01/2005|00:40] C:\Program Files\Fichiers communs\Sonic Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\SpeechEngines
   [02/01/2005|00:40] C:\Program Files\Fichiers communs\SureThing Shared
   [08/02/2009|17:21] C:\Program Files\Fichiers communs\Symantec Shared
   [07/02/2009|16:28] C:\Program Files\Fichiers communs\System
   [02/01/2005|00:41] C:\Program Files\Fichiers communs\TiVo Shared
   [08/11/2008|16:53] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [02/01/2005|00:39] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 64 Processes )

   iexplore.exe ~ [PID:3712]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
   C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sa14.tmp
   C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sj13.tmp
   C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sl4.tmp
   C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Starware370.txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@advertising[2].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-02-08 20:24:34
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 148
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\Pack.epk
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\COMPAQ~1\Local Settings\Application Data\ApplicationHistory\cri du cochon crack.exe.6e4e16dd.ini


   [F:11077][D:365]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
   [F:55][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
   [F:634][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 08/02/2009|20:25 - Option : [1]

   --------------------\  Fin du rapport a 20:25:36

jlpjlp · Answer

ok il en reste du swizzor et d'autre .....


___________

lop sd:

* Choisis cette fois ci l'Option 2 (Suppression)
* Ne ferme pas la fenêtre lors de la suppression !
* Poste le rapport généré (C:\lopR.txt)


(Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide)

___________


télécharge OTMoveIt 
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved. 
(attention bien mettre :files)

:files
C:\DOCUME~1\COMPAQ~1\Local Settings\Application Data\ApplicationHistory\cri du cochon crack.exe.6e4e16dd.ini
:commands
[purity]
[emptytemp]
[start explorer]


clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

_____________________


Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord) 

Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche comme demandé, le blocnote va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

Martial57 · Answer

Salut.
Ci joint le .txt de Lop


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
   BIOS : Phoenix - Award BIOS v6.00PG
   USER : Compaq_Propriétaire ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1335 [VPS 090209-0] 4.8.1335 (Activated)
   C:\ (Local Disk) - NTFS - Total:181 Go (Free:156 Go)
   D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 09/02/2009|19:49 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sa14.tmp
   Supprime! - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sj13.tmp
   Supprime! - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sl4.tmp
   Supprime! - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Starware370.txt
   Supprime! - C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@advertising[2].txt
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
 
   \\\\\\\\\\\\\\\ 

   Supprime! - C:\Program Files\Viewpoint
   Supprime! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\Viewpoint
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
 
   \\\\\\\\\\\\\\\

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [08/02/2009|17:40] C:\DOCUME~1\ADMIN\APPLIC~1\Bitdefender
   [26/10/2005|23:34] C:\DOCUME~1\ADMIN\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\ADMIN\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\ADMIN\APPLIC~1\Real
   [08/02/2009|17:40] C:\DOCUME~1\ADMIN\APPLIC~1\Windows Desktop Search

   [26/10/2005|23:34] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real

   [02/01/2005|00:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [08/02/2009|12:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
   [24/08/2006|18:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
   [02/01/2005|00:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [25/01/2009|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [09/02/2009|19:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [02/01/2005|00:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [03/12/2006|11:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin
   [05/11/2006|17:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
   [08/05/2008|16:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [07/07/2007|11:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NannyMania
   [22/07/2007|14:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Oberon Games
   [13/12/2006|17:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
   [16/07/2007|17:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
   [02/01/2005|00:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [07/07/2006|18:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
   [02/01/2005|00:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [25/08/2008|18:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [07/02/2009|14:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [09/05/2008|14:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [10/09/2006|12:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [06/01/2007|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [10/11/2008|19:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [27/01/2007|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [07/02/2009|14:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Adobe
   [28/07/2006|14:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\AdobeUM
   [08/11/2006|15:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Balloon Express
   [08/02/2009|17:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Bitdefender
   [19/11/2006|14:21] C:\DOCUME~1\COMPAQ~1\APPLIC~1\EA
   [15/10/2006|09:32] C:\DOCUME~1\COMPAQ~1\APPLIC~1\eConf
   [13/10/2007|12:23] C:\DOCUME~1\COMPAQ~1\APPLIC~1\EoRezo
   [27/01/2007|11:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Gaijin Ent
   [09/05/2008|09:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Gamelab
   [23/12/2007|17:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\GibbHill Properties Ltd
   [18/11/2006|10:16] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Google
   [26/10/2008|08:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\gtk-2.0
   [20/07/2006|19:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Help
   [06/07/2006|08:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HP
   [18/07/2006|18:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HPQ
   [27/01/2007|10:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Identities
   [03/12/2006|11:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\iWin
   [15/07/2006|12:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Leadertech
   [23/07/2006|20:07] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Macromedia
   [29/03/2008|09:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft
   [07/07/2006|18:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft Web Folders
   [24/03/2008|10:56] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Mozilla
   [06/01/2007|15:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\MSNInstaller
   [23/12/2008|14:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Odyssee_Sib
   [13/12/2006|17:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\PlayFirst
   [23/07/2006|20:47] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Real
   [01/01/2009|20:35] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Samsung
   [16/07/2007|17:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sandlot Games
   [15/07/2006|12:03] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sonic
   [27/07/2006|13:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sun
   [07/02/2009|14:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Symantec
   [02/07/2006|10:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Template
   [07/02/2009|15:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1	his poll
   [09/05/2008|14:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ViquaSoft
   [30/09/2007|09:40] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Windows Desktop Search
   [30/09/2007|08:53] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Windows Live Writer
   [10/10/2007|16:19] C:\DOCUME~1\COMPAQ~1\APPLIC~1\WinRAR
   [27/01/2007|10:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Zylom

   [26/10/2005|23:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real

   [19/11/2006|10:45] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
   [06/10/2007|09:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [10/11/2008|18:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
   [29/08/2007|18:57] C:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [09/02/2009 19:43][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 12:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [19/05/2007|08:24] C:\Program Files\1-2oder3-Kamera
   [07/02/2009|09:17] C:\Program Files\Adobe
   [25/08/2006|18:45] C:\Program Files\Agfa
   [11/10/2008|16:55] C:\Program Files\Ahead
   [07/02/2009|14:56] C:\Program Files\Alwil Software
   [02/01/2005|00:32] C:\Program Files\ATI Technologies
   [25/08/2006|18:34] C:\Program Files\Boonty
   [25/08/2006|18:33] C:\Program Files\BoontyGames
   [20/10/2005|20:06] C:\Program Files\ComPlus Applications
   [13/10/2007|13:19] C:\Program Files\Controle Parental
   [29/10/2006|13:03] C:\Program Files\Core Design
   [20/03/2008|19:59] C:\Program Files\CPV
   [05/07/2006|18:54] C:\Program Files\Eko
   [04/07/2007|08:47] C:\Program Files\Emme
   [04/02/2009|16:55] C:\Program Files\eMule
   [08/02/2009|12:50] C:\Program Files\Fichiers communs
   [07/02/2009|14:36] C:\Program Files\Gamenext
   [25/01/2009|10:46] C:\Program Files\Google
   [02/01/2005|01:02] C:\Program Files\Hewlett-Packard
   [02/01/2005|00:42] C:\Program Files\HP
   [26/10/2006|18:25] C:\Program Files\IncrediMail
   [07/02/2009|13:55] C:\Program Files\InstallShield Installation Information
   [07/02/2009|16:18] C:\Program Files\Internet Explorer
   [02/01/2005|00:22] C:\Program Files\Java
   [25/12/2006|19:21] C:\Program Files\Maxis
   [21/04/2008|18:06] C:\Program Files\Meine Tierpension
   [24/08/2006|18:41] C:\Program Files\Mes Jeux T‚l‚charg‚s
   [07/02/2009|16:22] C:\Program Files\Messenger
   [11/05/2007|16:40] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [07/07/2006|18:56] C:\Program Files\microsoft frontpage
   [07/07/2006|18:57] C:\Program Files\Microsoft Office
   [30/09/2007|08:47] C:\Program Files\Microsoft SQL Server Compact Edition
   [02/01/2005|00:43] C:\Program Files\Microsoft Works
   [08/02/2009|20:19] C:\Program Files\Mindscape
   [07/02/2009|16:18] C:\Program Files\Movie Maker
   [29/03/2008|13:20] C:\Program Files\MSN
   [26/10/2005|23:36] C:\Program Files\MSN Gaming Zone
   [08/11/2008|10:08] C:\Program Files\MSN Messenger
   [18/11/2006|11:14] C:\Program Files\MSXML 4.0
   [07/02/2009|16:15] C:\Program Files\NetMeeting
   [19/07/2008|16:02] C:\Program Files\Norton Security Scan
   [26/10/2005|23:36] C:\Program Files\Online Services
   [04/11/2006|15:25] C:\Program Files\orange
   [07/02/2009|16:28] C:\Program Files\Outlook Express
   [02/03/2008|11:50] C:\Program Files\PC Camera
   [02/01/2005|00:49] C:\Program Files\PC-Doctor 5 for Windows
   [18/08/2007|10:25] C:\Program Files\PhotoFiltre
   [02/01/2005|00:39] C:\Program Files\Real
   [04/01/2008|18:09] C:\Program Files\Rondomedia
   [20/07/2006|18:54] C:\Program Files\SAGEM
   [25/12/2008|20:51] C:\Program Files\Samsung
   [21/08/2007|09:34] C:\Program Files\Seagrand
   [31/08/2007|12:47] C:\Program Files\Serif
   [02/01/2005|00:52] C:\Program Files\Services en ligne
   [09/06/2007|14:33] C:\Program Files\SimsLoft
   [07/07/2006|18:57] C:\Program Files\Snapshot Viewer
   [08/02/2009|12:51] C:\Program Files\Softwin
   [02/01/2005|00:41] C:\Program Files\Sonic
   [07/02/2009|14:33] C:\Program Files\SupraASCIIArt
   [25/08/2008|18:35] C:\Program Files\SweetIM
   [18/03/2008|18:51] C:\Program Files\Temporary
   [03/01/2007|14:57] C:\Program Files\The Learning Company
   [25/08/2008|18:43] C:\Program Files	his poll
   [29/03/2008|09:49] C:\Program Files\Ubi Soft
   [20/10/2005|20:06] C:\Program Files\Uninstall Information
   [05/04/2008|06:54] C:\Program Files\USB Disk Win98 Driver
   [08/02/2009|20:16] C:\Program Files\VS Revo Group
   [09/02/2009|19:45] C:\Program Files\Wanadoo
   [30/09/2007|08:46] C:\Program Files\Windows Desktop Search
   [10/02/2007|15:14] C:\Program Files\Windows Journal Viewer
   [07/02/2009|14:06] C:\Program Files\Windows Live
   [31/10/2007|19:15] C:\Program Files\Windows Live Toolbar
   [07/02/2009|16:15] C:\Program Files\Windows Media Player
   [07/02/2009|16:15] C:\Program Files\Windows NT
   [20/10/2005|20:05] C:\Program Files\WindowsUpdate
   [10/10/2007|16:19] C:\Program Files\WinRAR
   [26/10/2005|23:37] C:\Program Files\xerox
   [22/03/2008|16:18] C:\Program Files\YouTube Video Downloader
   [29/03/2008|09:47] C:\Program Files\Zylom Games

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [07/02/2009|13:49] C:\Program Files\Fichiers communs\Adobe
   [11/10/2008|16:55] C:\Program Files\Fichiers communs\Ahead
   [24/08/2006|18:41] C:\Program Files\Fichiers communs\BOONTY Shared
   [07/07/2006|18:54] C:\Program Files\Fichiers communs\Designer
   [02/01/2005|00:36] C:\Program Files\Fichiers communs\HP
   [27/05/2007|09:36] C:\Program Files\Fichiers communs\InstallShield
   [02/01/2005|00:22] C:\Program Files\Fichiers communs\Java
   [02/03/2008|18:21] C:\Program Files\Fichiers communs\Microsoft Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\MSSoap
   [08/05/2008|16:37] C:\Program Files\Fichiers communs\Oberon Media
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\ODBC
   [02/03/2008|11:50] C:\Program Files\Fichiers communs\PAC207
   [02/01/2005|00:39] C:\Program Files\Fichiers communs\Real
   [08/11/2006|15:39] C:\Program Files\Fichiers communs\Sandlot Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\Services
   [08/02/2009|12:51] C:\Program Files\Fichiers communs\Softwin
   [02/01/2005|00:40] C:\Program Files\Fichiers communs\Sonic Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\SpeechEngines
   [02/01/2005|00:40] C:\Program Files\Fichiers communs\SureThing Shared
   [08/02/2009|17:21] C:\Program Files\Fichiers communs\Symantec Shared
   [07/02/2009|16:28] C:\Program Files\Fichiers communs\System
   [02/01/2005|00:41] C:\Program Files\Fichiers communs\TiVo Shared
   [08/11/2008|16:53] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [02/01/2005|00:39] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 54 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@advertising[3].txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@adopt.euroclick[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-02-09 19:50:13
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 148
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\Pack.epk
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\COMPAQ~1\Local Settings\Application Data\ApplicationHistory\cri du cochon crack.exe.6e4e16dd.ini


   [F:11072][D:362]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
   [F:120][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
   [F:3048][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 08/02/2009|20:25 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 09/02/2009|19:51 - Option : [2]

   --------------------\  Fin du rapport a 19:51:37

Martial57 · Answer

Salut.
Ci joint le .txt de Lop


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
   BIOS : Phoenix - Award BIOS v6.00PG
   USER : Compaq_Propriétaire ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1335 [VPS 090209-0] 4.8.1335 (Activated)
   C:\ (Local Disk) - NTFS - Total:181 Go (Free:156 Go)
   D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 09/02/2009|19:49 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sa14.tmp
   Supprime! - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sj13.tmp
   Supprime! - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
sl4.tmp
   Supprime! - C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\Starware370.txt
   Supprime! - C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@advertising[2].txt
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
 
   \\\\\\\\\\\\\\\ 

   Supprime! - C:\Program Files\Viewpoint
   Supprime! - C:\DOCUME~1\COMPAQ~1\APPLIC~1\Viewpoint
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
 
   \\\\\\\\\\\\\\\

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [08/02/2009|17:40] C:\DOCUME~1\ADMIN\APPLIC~1\Bitdefender
   [26/10/2005|23:34] C:\DOCUME~1\ADMIN\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\ADMIN\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\ADMIN\APPLIC~1\Real
   [08/02/2009|17:40] C:\DOCUME~1\ADMIN\APPLIC~1\Windows Desktop Search

   [26/10/2005|23:34] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real

   [02/01/2005|00:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [08/02/2009|12:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BitDefender
   [24/08/2006|18:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
   [02/01/2005|00:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [25/01/2009|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [09/02/2009|19:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [02/01/2005|00:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [03/12/2006|11:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin
   [05/11/2006|17:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
   [08/05/2008|16:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [07/07/2007|11:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NannyMania
   [22/07/2007|14:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Oberon Games
   [13/12/2006|17:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
   [16/07/2007|17:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
   [02/01/2005|00:20] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [07/07/2006|18:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
   [02/01/2005|00:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [25/08/2008|18:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
   [07/02/2009|14:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [09/05/2008|14:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [10/09/2006|12:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [06/01/2007|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [10/11/2008|19:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [27/01/2007|10:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [07/02/2009|14:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Adobe
   [28/07/2006|14:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\AdobeUM
   [08/11/2006|15:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Balloon Express
   [08/02/2009|17:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Bitdefender
   [19/11/2006|14:21] C:\DOCUME~1\COMPAQ~1\APPLIC~1\EA
   [15/10/2006|09:32] C:\DOCUME~1\COMPAQ~1\APPLIC~1\eConf
   [13/10/2007|12:23] C:\DOCUME~1\COMPAQ~1\APPLIC~1\EoRezo
   [27/01/2007|11:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Gaijin Ent
   [09/05/2008|09:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Gamelab
   [23/12/2007|17:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\GibbHill Properties Ltd
   [18/11/2006|10:16] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Google
   [26/10/2008|08:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\gtk-2.0
   [20/07/2006|19:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Help
   [06/07/2006|08:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HP
   [18/07/2006|18:43] C:\DOCUME~1\COMPAQ~1\APPLIC~1\HPQ
   [27/01/2007|10:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Identities
   [03/12/2006|11:06] C:\DOCUME~1\COMPAQ~1\APPLIC~1\iWin
   [15/07/2006|12:02] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Leadertech
   [23/07/2006|20:07] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Macromedia
   [29/03/2008|09:58] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft
   [07/07/2006|18:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Microsoft Web Folders
   [24/03/2008|10:56] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Mozilla
   [06/01/2007|15:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\MSNInstaller
   [23/12/2008|14:51] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Odyssee_Sib
   [13/12/2006|17:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\PlayFirst
   [23/07/2006|20:47] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Real
   [01/01/2009|20:35] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Samsung
   [16/07/2007|17:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sandlot Games
   [15/07/2006|12:03] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sonic
   [27/07/2006|13:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Sun
   [07/02/2009|14:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Symantec
   [02/07/2006|10:05] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Template
   [07/02/2009|15:01] C:\DOCUME~1\COMPAQ~1\APPLIC~1	his poll
   [09/05/2008|14:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\ViquaSoft
   [30/09/2007|09:40] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Windows Desktop Search
   [30/09/2007|08:53] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Windows Live Writer
   [10/10/2007|16:19] C:\DOCUME~1\COMPAQ~1\APPLIC~1\WinRAR
   [27/01/2007|10:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\Zylom

   [26/10/2005|23:34] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [02/01/2005|01:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [02/01/2005|00:39] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real

   [19/11/2006|10:45] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
   [06/10/2007|09:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [10/11/2008|18:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
   [29/08/2007|18:57] C:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [09/02/2009 19:43][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 12:00][-rah-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [19/05/2007|08:24] C:\Program Files\1-2oder3-Kamera
   [07/02/2009|09:17] C:\Program Files\Adobe
   [25/08/2006|18:45] C:\Program Files\Agfa
   [11/10/2008|16:55] C:\Program Files\Ahead
   [07/02/2009|14:56] C:\Program Files\Alwil Software
   [02/01/2005|00:32] C:\Program Files\ATI Technologies
   [25/08/2006|18:34] C:\Program Files\Boonty
   [25/08/2006|18:33] C:\Program Files\BoontyGames
   [20/10/2005|20:06] C:\Program Files\ComPlus Applications
   [13/10/2007|13:19] C:\Program Files\Controle Parental
   [29/10/2006|13:03] C:\Program Files\Core Design
   [20/03/2008|19:59] C:\Program Files\CPV
   [05/07/2006|18:54] C:\Program Files\Eko
   [04/07/2007|08:47] C:\Program Files\Emme
   [04/02/2009|16:55] C:\Program Files\eMule
   [08/02/2009|12:50] C:\Program Files\Fichiers communs
   [07/02/2009|14:36] C:\Program Files\Gamenext
   [25/01/2009|10:46] C:\Program Files\Google
   [02/01/2005|01:02] C:\Program Files\Hewlett-Packard
   [02/01/2005|00:42] C:\Program Files\HP
   [26/10/2006|18:25] C:\Program Files\IncrediMail
   [07/02/2009|13:55] C:\Program Files\InstallShield Installation Information
   [07/02/2009|16:18] C:\Program Files\Internet Explorer
   [02/01/2005|00:22] C:\Program Files\Java
   [25/12/2006|19:21] C:\Program Files\Maxis
   [21/04/2008|18:06] C:\Program Files\Meine Tierpension
   [24/08/2006|18:41] C:\Program Files\Mes Jeux T‚l‚charg‚s
   [07/02/2009|16:22] C:\Program Files\Messenger
   [11/05/2007|16:40] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [07/07/2006|18:56] C:\Program Files\microsoft frontpage
   [07/07/2006|18:57] C:\Program Files\Microsoft Office
   [30/09/2007|08:47] C:\Program Files\Microsoft SQL Server Compact Edition
   [02/01/2005|00:43] C:\Program Files\Microsoft Works
   [08/02/2009|20:19] C:\Program Files\Mindscape
   [07/02/2009|16:18] C:\Program Files\Movie Maker
   [29/03/2008|13:20] C:\Program Files\MSN
   [26/10/2005|23:36] C:\Program Files\MSN Gaming Zone
   [08/11/2008|10:08] C:\Program Files\MSN Messenger
   [18/11/2006|11:14] C:\Program Files\MSXML 4.0
   [07/02/2009|16:15] C:\Program Files\NetMeeting
   [19/07/2008|16:02] C:\Program Files\Norton Security Scan
   [26/10/2005|23:36] C:\Program Files\Online Services
   [04/11/2006|15:25] C:\Program Files\orange
   [07/02/2009|16:28] C:\Program Files\Outlook Express
   [02/03/2008|11:50] C:\Program Files\PC Camera
   [02/01/2005|00:49] C:\Program Files\PC-Doctor 5 for Windows
   [18/08/2007|10:25] C:\Program Files\PhotoFiltre
   [02/01/2005|00:39] C:\Program Files\Real
   [04/01/2008|18:09] C:\Program Files\Rondomedia
   [20/07/2006|18:54] C:\Program Files\SAGEM
   [25/12/2008|20:51] C:\Program Files\Samsung
   [21/08/2007|09:34] C:\Program Files\Seagrand
   [31/08/2007|12:47] C:\Program Files\Serif
   [02/01/2005|00:52] C:\Program Files\Services en ligne
   [09/06/2007|14:33] C:\Program Files\SimsLoft
   [07/07/2006|18:57] C:\Program Files\Snapshot Viewer
   [08/02/2009|12:51] C:\Program Files\Softwin
   [02/01/2005|00:41] C:\Program Files\Sonic
   [07/02/2009|14:33] C:\Program Files\SupraASCIIArt
   [25/08/2008|18:35] C:\Program Files\SweetIM
   [18/03/2008|18:51] C:\Program Files\Temporary
   [03/01/2007|14:57] C:\Program Files\The Learning Company
   [25/08/2008|18:43] C:\Program Files	his poll
   [29/03/2008|09:49] C:\Program Files\Ubi Soft
   [20/10/2005|20:06] C:\Program Files\Uninstall Information
   [05/04/2008|06:54] C:\Program Files\USB Disk Win98 Driver
   [08/02/2009|20:16] C:\Program Files\VS Revo Group
   [09/02/2009|19:45] C:\Program Files\Wanadoo
   [30/09/2007|08:46] C:\Program Files\Windows Desktop Search
   [10/02/2007|15:14] C:\Program Files\Windows Journal Viewer
   [07/02/2009|14:06] C:\Program Files\Windows Live
   [31/10/2007|19:15] C:\Program Files\Windows Live Toolbar
   [07/02/2009|16:15] C:\Program Files\Windows Media Player
   [07/02/2009|16:15] C:\Program Files\Windows NT
   [20/10/2005|20:05] C:\Program Files\WindowsUpdate
   [10/10/2007|16:19] C:\Program Files\WinRAR
   [26/10/2005|23:37] C:\Program Files\xerox
   [22/03/2008|16:18] C:\Program Files\YouTube Video Downloader
   [29/03/2008|09:47] C:\Program Files\Zylom Games

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [07/02/2009|13:49] C:\Program Files\Fichiers communs\Adobe
   [11/10/2008|16:55] C:\Program Files\Fichiers communs\Ahead
   [24/08/2006|18:41] C:\Program Files\Fichiers communs\BOONTY Shared
   [07/07/2006|18:54] C:\Program Files\Fichiers communs\Designer
   [02/01/2005|00:36] C:\Program Files\Fichiers communs\HP
   [27/05/2007|09:36] C:\Program Files\Fichiers communs\InstallShield
   [02/01/2005|00:22] C:\Program Files\Fichiers communs\Java
   [02/03/2008|18:21] C:\Program Files\Fichiers communs\Microsoft Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\MSSoap
   [08/05/2008|16:37] C:\Program Files\Fichiers communs\Oberon Media
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\ODBC
   [02/03/2008|11:50] C:\Program Files\Fichiers communs\PAC207
   [02/01/2005|00:39] C:\Program Files\Fichiers communs\Real
   [08/11/2006|15:39] C:\Program Files\Fichiers communs\Sandlot Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\Services
   [08/02/2009|12:51] C:\Program Files\Fichiers communs\Softwin
   [02/01/2005|00:40] C:\Program Files\Fichiers communs\Sonic Shared
   [26/10/2005|23:35] C:\Program Files\Fichiers communs\SpeechEngines
   [02/01/2005|00:40] C:\Program Files\Fichiers communs\SureThing Shared
   [08/02/2009|17:21] C:\Program Files\Fichiers communs\Symantec Shared
   [07/02/2009|16:28] C:\Program Files\Fichiers communs\System
   [02/01/2005|00:41] C:\Program Files\Fichiers communs\TiVo Shared
   [08/11/2008|16:53] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [02/01/2005|00:39] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 54 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@advertising[3].txt
   C:\DOCUME~1\COMPAQ~1\Cookies\compaq_propriétaire@adopt.euroclick[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-02-09 19:50:13
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 148
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\Pack.epk
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\COMPAQ~1\Local Settings\Application Data\ApplicationHistory\cri du cochon crack.exe.6e4e16dd.ini


   [F:11072][D:362]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
   [F:120][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
   [F:3048][D:4]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 08/02/2009|20:25 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 09/02/2009|19:51 - Option : [2]

   --------------------\  Fin du rapport a 19:51:37

Martial57 · Answer

C'est encore moi,

Ci dessous le rapport de Movit:

========== FILES ==========
C:\DOCUME~1\COMPAQ~1\Local Settings\Application Data\ApplicationHistory\cri du cochon crack.exe.6e4e16dd.ini moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\~DF89D5.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Historique\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_518.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02092009_200054

Martial57 · Answer

Une dernière fois avant ton avis:

Ci dessous le rapport de NAVILOG:

Search Navipromo version 3.7.2 commencé le 09/02/2009 à 20:14:39,39

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 07.02.2009 à 10h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : Compaq_Propriétaire ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1335 [VPS 090209-0] 4.8.1335 (Activated)


C:\ (Local Disk) - NTFS - Total:181 Go (Free:157 Go)
D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)


Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMIN\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMIN\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMIN\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" *** 


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\ADMIN\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 



*** Recherche fichiers *** 


C:\WINDOWS\pack.epk trouvé !

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\ADMIN\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 09/02/2009 à 20:15:11,01 ***

jlpjlp · Answer

= Lance navilog1 
= Cette fois-ci choisi l'option 2 
= Navilog va faire le nettoyage.. patient jusqu'à ce qui soit marqué *** Nettoyage Termine le ..... *** 
= Un rapport va être génrer sur ton C:\ qui sera en option 2 
Note: le bureau disparaît 

= colle le contenu du rapport de navilog (qui est en option2) 


PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches. 
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter" 
Tape explorer et valide. Celà te fera apparaitre ton bureau. 



---------------------- 


et voilà tu ne devrais plus avior de pubs!!!!


______________

pour tout verifier:

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

Martial57 · Answer

Salut , 
Voila le résultat suite au lancement de Navilog avec option 2; (le micro a redémarré et le bloc notes s'est ouvert automatiquement.

Clean Navipromo version 3.7.2 commencé le 10/02/2009 à 19:44:27,00

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 07.02.2009 à 10h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : Compaq_Propriétaire ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1335 [VPS 090210-0] 4.8.1335 (Activated)


C:\ (Local Disk) - NTFS - Total:181 Go (Free:157 Go)
D:\ (Local Disk) - FAT32 - Total:5 Go (Free:0 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)


Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" * 


* Suppression dans "C:\DOCUME~1\ADMIN\locals~1\applic~1" * 

* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMIN\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMIN\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Compaq_Propriétaire\menudm~1\progra~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMIN\menudm~1\progra~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" *** 



*** Suppression fichiers ***

C:\WINDOWS\pack.epk supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Compaq_Propri‚taire\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Compaq_Propriétaire\locals~1\applic~1" * 


* Dans "C:\DOCUME~1\ADMIN\locals~1\applic~1" * 


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 10/02/2009 à 19:48:55,54 ***

Martial57 · Answer

Ci dessous d'abord le log.txt puis info.txt.
Merci pour toutes tes informations. Tu me diras comment je peux te remercier.


Logfile of random's system information tool 1.05 (written by random/random)
Run by Compaq_Propriétaire at 2009-02-10 19:55:31
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 162 GB (87%) free of 185 GB
Total RAM: 958 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:55:45, on 10/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\PixArt\PAC207\Monitor.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\issch.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Documents and Settings\Compaq_Propriétaire\Bureau\RSIT.exe
C:\Program Files	rend micro\Compaq_Propriétaire.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66005
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66005
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66005
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [FFHollywood.exe] C:\DOCUME~1\COMPAQ~1\Bureau\FFHOLL~1.EXE /r
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [5E39J1V19L] C:\WINDOWS\whsyst32.exe
O4 - HKLM\..\Policies\Explorer\Run: [win aggiornamento] C:\WINDOWS\winupdate.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?b7817a7667844101befe6f17ebd48f11
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?b7817a7667844101befe6f17ebd48f11
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin
pjpi150_05.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.viewpoint.com/...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A1A52584-9E42-425D-9E3A-58C4029D2B74}: NameServer = 81.253.149.9 80.10.246.132
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Control Parental (OPTENET_FILTER) - Contrôle Parental - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
O24 - Desktop Component 0: (no name) - http://monmatou.playmoa.com/
O24 - Desktop Component 1: (no name) - C:\Documents and Settings\Compaq_Propriétaire\Mes documents\lollotte57\Photos\Laura3.jpg
O24 - Desktop Component 10: (no name) - http://tbn0.google.com/...
O24 - Desktop Component 11: (no name) - http://www.monchval.com/img/pres/pres14.jpg
O24 - Desktop Component 2: (no name) - C:\Documents and Settings\Compaq_Propriétaire\Mes documents\lollotte57\Photos\Laura1.jpg
O24 - Desktop Component 3: (no name) - C:\Documents and Settings\Compaq_Propriétaire\Mes documents\lollotte57\Photos\Laura2.jpg
O24 - Desktop Component 4: (no name) - http://monmatou.playmoa.com/
O24 - Desktop Component 5: (no name) - http://monmatou.playmoa.com/
O24 - Desktop Component 6: (no name) - http://monmatou.playmoa.com/
O24 - Desktop Component 7: (no name) - http://monmatou.playmoa.com/
O24 - Desktop Component 8: (no name) - http://monmatou.playmoa.com/
O24 - Desktop Component 9: (no name) - http://galaxie-net.com/smileys/001.gif

jlpjlp · Answer

ok il en reste!!!


_______________

1/ sur un ordi il ne faut qu'un seul antivirus alors vire bitdefender ou avast

pour virer avast:

https://www.avast.com/fr-fr/uninstall-utility

_________________

2/


Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
guide: http://site-naheulbeuk.com/
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
• Redémarre ton ordinateur 
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
• Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuie sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuie sur une touche pour redémarrer le PC. 
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

-------------------------------------

3/



scan rapide avec 
MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ 

-------------------------------------

4/
mettre a jour internet explorer
https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html

mettre à jour adobe reader
https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html







Mettre a jour java:

Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries. 
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.) 
Double-clique sur le répertoire JavaRa obtenu. 
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher) 
Clique sur Search For Updates. 
Sélectionne Update Using jucheck.exe puis clique sur Search. 
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes. 
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions. 
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok. 
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse. 
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log 
(c:\JavaRa.log) 
Ferme l'application. 

si cela ne fonctionne pas 

https://www.java.com/fr/download/windows_manual.jsp?locale=fr&host=www.java.com:80 

tu peux désinstaller les vieilles versions. 


_____________________________



Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau : 
http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

/!\ Déconnectes toi et fermes toutes applications en cours 

&#9679; Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files ) 
&#9679; Double clique sur l'icône Ad-removersituée sur ton bureau 
&#9679; Au menu principal choisi l'option "A" 
&#9679; Postes le rapport qui apparait à la fin . 

( le rapport est sauvegardé aussi sous C:\Ad-report(date).log ) 

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Note : 

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Martial57 · Answer

Bonsoir,
Concernant AVAST et Bit defender  , je suis abonné à Micro Hebdo, et il conseillait dans un numéro , d'installer AVAST comme Anti Virus, et en complément Bit Defender Version Free.
Maintenant si tu me conseille de le désinstaller, je désinstallerais Bit defender.

Ci dessous le rapport SDFix.


[b]SDFix: Version 1.240 [/b]
Run by Compaq_Propri‚taire on 11/02/2009 at 20:40

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\Documents and Settings\Compaq_Propri‚taireeal.txt - Deleted



Folder C:\Program Files\CPV - Removed
Folder C:\Program Files\Temporary - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 20:48:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL France"
"C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\lollotte57\incredimail_install.exe"="C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\lollotte57\incredimail_install.exe:*:Enabled:IncrediMail Installer"
"C:\Program Files\IncrediMail\bin\IncMail.exe"="C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail"
"C:\Program Files\Orange Link\Application\Exe\Orange Link.exe"="C:\Program Files\Orange Link\Application\Exe\Orange Link.exe:*:Enabled:Orange Link"
"C:\Program Files\Orange Link\Application\eConfv4\olinkp.exe"="C:\Program Files\Orange Link\Application\eConfv4\olinkp.exe:*:Enabled:Orange Link Player"
"C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\services.exe"="C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\services.exe:*:Enabled:Flash Media"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sun  2 Jul 2006           218 A.SHR --- "C:\BOOT.BAK"
Tue 25 Jul 2006            22 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys"
Wed 26 Sep 2007         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 26 Sep 2007         4,348 ...H. --- "C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Sun 24 Feb 2008            20 A..H. --- "C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Wed 26 Sep 2007         9,655 A.SH. --- "C:\Documents and Settings\Compaq_Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

[b]Finished![/b]

Martial57 · Answer

Ci dessous la détection faite avec Malware . Je fais ensuite supprimer.


Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1749
Windows 5.1.2600 Service Pack 3

11/02/2009 21:05:45
mbam-log-2009-02-11 (21-05-24).txt

Type de recherche: Examen rapide
Eléments examinés: 72333
Temps écoulé: 4 minute(s), 35 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\AppID	estCPV6.DLL (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Martial57 · Answer

Ci dessous le rapport après suppression des Malware.

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1749
Windows 5.1.2600 Service Pack 3

11/02/2009 21:06:59
mbam-log-2009-02-11 (21-06-59).txt

Type de recherche: Examen rapide
Eléments examinés: 72333
Temps écoulé: 4 minute(s), 35 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID	estCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.SoftMate) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Martial57 · Answer

C'est encore moi,

Je me suis arrêté à l'essai de  l'installation de IE7 , il me mets un message d'erreur à la fin et me renvoie vers un site ou il explique une procédure si problème ( Apparement mAJ  Windows , c'est fait ) j'ai réessayé une 2 ème fois mais même message.

J'arrête pour ce soir, il me restera également à mettre à jour Adobe ,
à télécharger JAVARA.zip de Paul  (Je n'ai pas le lien , Ou je le trouve??
Et ensuite encore AD-Remover à installer.

A demain soir.
Bonne Nuit.

jlpjlp · Answer

pour java:

http://www.libellules.ch/dotclear/index.php?post/2008/07/13/2689-javara

Martial57 · Answer

Bonsoir,

Je n'arrive pas à installer la MAJ de Internet Explorer, toujours un message d'erreur à la fin.
J'ai donc installé la MAJ de ADOBE et j'ai installé JAVA RAP.
Ci dessous le rapport de Java.

JavaRa 1.13 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Thu Feb 12 20:03:20 2009

Found and removed: C:\Program Files\Java\jre1.5.0_05

Found and removed: Software\JavaSoft\Java2D\1.5.0_05

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510005

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510005

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510005

Found and removed: SOFTWARE\Classes\JavaPlugin.150_05

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_05

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_05

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510005

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510005

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150050}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_05

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.5.0_05\

------------------------------------

Finished reporting.

Martial57 · Answer

C'est encore moi,
Ci dessous le rapport de AD-Remover:


------- LOGFILE OF AD-REMOVER 1.1.1.1 | ONLY XP/VISTA -------

Updated by C_XX on 12/02/2009 at 19:00

Start at: 20:09:58 | Jeu 12/02/2009 | Boot mode: Normal Boot
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™  Service Pack 3 (version 5.1.2600)
Computer Name: LAURA
User(s):
- Compaq_Propri‚taire - Current User - Administrator
- ADMIN - Not Current User
- Compaq_Propri‚taire - Not Current User
Drive(s): 
- C:\  (File System: NTFS)
- D:\  (File System: FAT32)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 56

+--------------------| Boonty/Boonty Games Elements Found:

Service: Boonty Games
.
HKCR\boontybox
HKCU\Software\Boonty
HKLM\Software\Boonty
HKLM\Software\Classes\boontybox
HKLM\System\ControlSet001\Services\Boonty Games
HKLM\System\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES
HKLM\System\ControlSet002\Services\Boonty Games
HKLM\System\CurrentControlSet\Services\Boonty Games
.
C:\Program Files\Boonty
C:\Program Files\Boonty\Components
C:\Program Files\BoontyGames
C:\Program Files\BoontyGames\Components
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses

+--------------------| Eorezo Elements Found:

HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\Software\EoRezo
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\EoRezo
HKLM\Software\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Classes\EoRezoBHO.EoBho
HKLM\Software\Classes\EoRezoBHO.EoBho.1
HKLM\Software\Classes\TypeLib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoweather
.
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\EoRezo
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\EoRezo\db
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\EoRezo\eoStats
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\EoRezo\EoWeather
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\EoRezo\EoWeather\images
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\EoRezo\EoWeather\images_classic
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\EoRezo\EoWeather\images_station_meteo
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\Eorezo
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\Eorezo\db
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\Eorezo\eoStats
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\Eorezo\EoWeather
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\Eorezo\EoWeather\images
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\Eorezo\EoWeather\images_classic
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\Eorezo\EoWeather\images_station_meteo

+--------------------| Infected Poker Softwares Elements Found:

.

+--------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Found:

.
.

+--------------------| It's TV Elements Found:

.

+--------------------| Sweetim Elements Found:

HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\MediaPlayer.GraphicsUtils
HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
HKLM\Software\Classes\MgMediaPlayer.GifAnimator
HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
HKLM\Software\Classes\SWEETIE.IEToolbar
HKLM\Software\Classes\SWEETIE.IEToolbar.1
HKLM\Software\Classes\SWEETIE.SWEETIE
HKLM\Software\Classes\SWEETIE.SWEETIE.3
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Classes\Toolbar3.SWEETIE
HKLM\Software\Classes\Toolbar3.SWEETIE.1
HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{83FA27D5-25B5-4D24-B796-DF742F08A5CF}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\Installer\Products\428C9AFC877ABE7409DCBBD48BC23F84
HKCR\Installer\Products\5D72AF385B5242D47B69FD47F2805AFC
HKLM\Software\Classes\Installer\Products\428C9AFC877ABE7409DCBBD48BC23F84
HKLM\Software\Classes\Installer\Products\5D72AF385B5242D47B69FD47F2805AFC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\428C9AFC877ABE7409DCBBD48BC23F84
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\5D72AF385B5242D47B69FD47F2805AFC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\WINDOWS\Installer\284d93.msi
C:\WINDOWS\Installer\284d99.msi
C:\Program Files\SweetIM
C:\Program Files\SweetIM\Messenger
C:\Program Files\SweetIM\Toolbars
C:\Program Files\SweetIM\Messengeresources
C:\Program Files\SweetIM\Messengeresources\images
C:\Program Files\SweetIM\Toolbars\Internet Explorer
C:\Program Files\SweetIM\Toolbars\Internet Explorer\conf
C:\Program Files\SweetIM\Toolbars\Internet Exploreresources
C:\WINDOWS\Installer\{83FA27D5-25B5-4D24-B796-DF742F08A5CF}
C:\WINDOWS\Installer\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\logs
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\update
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\conf\users\ponpon57@hotmail.fr
C:\Documents and Settings\All Users\Application Data\SweetIM\Messenger\data\contentdb
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer
C:\Documents and Settings\All Users\Application Data\SweetIM\Toolbars\Internet Explorer\cache

+--------------------| Added Scan:

---- Mozilla FireFox Version  [Unable to get version] ----

ProfilePath: i3jm6k3v.default
.
.
.
.
.
.

---- Internet Explorer Version 6.0.2900.5512 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Search bar: hxxp://www.google.com/ie
Search Page: hxxp://www.google.com
Start page: hxxp://www.google.fr/

+-[HKEY_USERS\S-1-5-21-778576681-3486025056-2296940051-1008\..\Internet Explorer\Main]

Search bar: hxxp://www.google.com/ie
Search Page: hxxp://www.google.com
Start page: hxxp://www.google.fr/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.google.com/ie
SearchAssistant: hxxp://www.crawler.com/search/ie.aspx?tb_id=66005
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]


+---------------------------------------------------------------------------+

[~15703 Bytes] - "C:\Ad-Report-Scan-12.02.2009.log"
-

End at: 20:10:51 | 12/02/2009
.
+--------------------| E.O.F - 239 Lines
.

jlpjlp · Answer

relance ad remover choisi l'option B , selectionne ceci qui a été trouvé:


Boonty/Boonty Games Elements Found:
Eorezo Elements Found:
 Sweetim Elements Found:




et vire les et colle le rapport

puis dis comment se comporte ton pc

Martial57 · Answer

J'ai supprimé les 3 éléments  (par contre il y en avait plus   (   Logiciel de poker infectés / funWebProducts/MyWay/MyWeb search  ...)


Après tout ce nettoyage, (Puis je également déinstaller l'ensemble des logiciels  (LopSD , RevoUninstaller - JavaRA - etc  )  en fait tout ce qui a été mis sur le bureau   par ajout suppression de programmes ? 

Ci dessous le rapport:



------- LOGFILE OF AD-REMOVER 1.1.1.1 | ONLY XP/VISTA -------

Updated by C_XX on 12/02/2009 at 19:00

*** LIMITED TO ***

Boonty/BoontyGames
Eorezo
Sweetim

******************

Start at: 20:48:40 | Jeu 12/02/2009 | Boot mode: Normal Boot
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Operating System: Microsoft® Windows XP™  Service Pack 3 (version 5.1.2600)
Computer Name: LAURA
User(s):
- Compaq_Propri‚taire - Current User - Administrator
- ADMIN - Not Current User
- Compaq_Propri‚taire - Not Current User
Drive(s): 
- C:\  (File System: NTFS)
- D:\  (File System: FAT32)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 66

(!) ---- IE start pages/Tabs reset

+--------------------| Boonty/Boonty Games Elements Deleted :

Service: "Boonty Games"
.
HKCR\boontybox
HKCU\Software\Boonty
HKLM\Software\Boonty
HKLM\System\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES
HKLM\System\ControlSet002\Services\Boonty Games
.
C:\Program Files\Boonty
C:\Program Files\Services en ligne\Boonty
C:\Program Files\BoontyGames
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Documents and Settings\All Users\Application Data\BOONTY

+--------------------| Eorezo Elements Deleted :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoengine
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Eoweather
HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\Software\EoRezo
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\EoRezo
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
.
C:\Documents and Settings\Compaq_Propri‚taire\Application Data\EoRezo

+--------------------| Sweetim Elements Deleted :

HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{83FA27D5-25B5-4D24-B796-DF742F08A5CF}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKCR\Installer\Products\428C9AFC877ABE7409DCBBD48BC23F84
HKCR\Installer\Products\5D72AF385B5242D47B69FD47F2805AFC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\428C9AFC877ABE7409DCBBD48BC23F84
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\5D72AF385B5242D47B69FD47F2805AFC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\WINDOWS\Installer\284d93.msi
C:\WINDOWS\Installer\284d99.msi
C:\Program Files\SweetIM
C:\WINDOWS\Installer\{83FA27D5-25B5-4D24-B796-DF742F08A5CF}
C:\WINDOWS\Installer\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}
C:\Documents and Settings\All Users\Application Data\SweetIM

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+--------------------| Added Scan :

---- Mozilla FireFox Version  [Unable to get version] ----

ProfilePath: i3jm6k3v.default
.
.
.
.
.
.

---- Internet Explorer Version 6.0.2900.5512 ----

+-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://www.google.com/ie
Search Page: hxxp://www.google.com
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+-[HKEY_USERS\S-1-5-21-778576681-3486025056-2296940051-1008\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://www.google.com/ie
Search Page: hxxp://www.google.com
Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchAssistant: hxxp://www.crawler.com/search/ie.aspx?tb_id=66005
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start page: hxxp://fr.msn.com/

+-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

+---------------------------------------------------------------------------+

[~11566 Bytes] - "C:\Ad-Report-Clean-12.02.2009.log"
[~15840 Bytes] - "C:\Ad-Report-Scan-12.02.2009.log"
-
C:\Program Files\Ad-remover\TOOLS\BACKUP\12.02.2009 - Prefs.js

End at: 20:52:15 | 12/02/2009
.
+--------------------| E.O.F - 177 Lines
.

Martial57 · Answer

Le micro a l'air de fonctionner correctement , et assez rapide.

jlpjlp · Answer

pour verifier

coole avec un des trois suivant:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

scan en ligne firefox

https://www.trendmicro.com/fr_fr/business.html­_launch.php

Panda en ligne :
http://pandasoftware.fr

Martial57 · Answer

Bonsoir,
J'ai fait un scan en ligne avec BitDefender.
Il a trouvé Virtool.1992 et les a supprimé.
Ci dessous le rapport.

BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Fri, Feb 13, 2009 - 20:45:50
 
 
  
  
 
Voie d'analyse: C:\;D:\;E:\;F:\;G:\;H:\;I:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 00:31:18
 
Fichiers
 127374
 
Directoires
 8368
 
Secteurs de boot
 0
 
Archives
 2285
 
Paquets programmes
 9303
 
  
  
 
Résultats
 
Virus identifiés
 1
 
Fichiers infectés
 2
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 2
 
  
  
 
Info sur les moteurs
 
Définition virus
 2656683
 
Version des moteurs
 AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)
 
Analyse des plugins
 17
 
Archive des plugins
 45
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 4
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\hp\bin\KillWind.exe
 Infecté par: Virtool.1992
 
C:\hp\bin\KillWind.exe
 Supprimé
 
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0001379.exe
 Infecté par: Virtool.1992
 
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP12\A0001379.exe
 Supprimé

jlpjlp · Answer

lance tool cleaner pour virer ce qui a été utilisé:
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

___________________

désactive ta restauration puis redemarre ton ordi puis réactive la:

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020830101856924

__________________

encore des soucis?

Martial57 · Answer

Bonjour,

Merci beaucoup pour ton aide , ça marche nickel.
Je te recontacterais peut être bientot , j'ai un micro avec Windows 2000, qui j'ai l'impression tourne un peu au ralenti aussi.

Encore Merci et à Bientôt.
Le Lorrain.

jlpjlp · Answer

ok parfait

et ok pour le deuxieme pc , tu mettra un rapport RSIT (si impossible hijakhcits)

a plus

Martial57 · Answer

Bonsoir,

Je viens de lancer le RSIT sur le 2ème micro  (Windows 2000)/
La 1ère fois , il est resté bloqué, je l'ai annulé et relancé, ci dessous le rapport/

Logfile of random's system information tool 1.05 (written by random/random)
Run by DORKEL at 2009-02-15 20:43:32
Microsoft Windows 2000 Professionnel Service Pack 4
System drive C: has 6 GB (26%) free of 23 GB
Total RAM: 640 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:43:43, on 15/02/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\FTRTSVC.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINNT\system32
vsvc32.exe
C:\WINNT\system32egsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\starter.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINNT\system32\RUNDLL32.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Brother\Brmfcmon\BrMfimon.exe
C:\WINNT\system32\internat.exe
C:\PROGRA~1\MI3AA1~1\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MI3AA1~1apimgr.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINNT\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Documents and Settings\DORKEL\Bureau\RSIT.exe
C:\Program Files	rend micro\DORKEL.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop]  (User 'Default user')
O4 - Startup: Pense-bête.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Reference 2001\EROProj.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\webelated.htm
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5l.incredimail.com/contents/setup/2007120201/downloader_nu/imloader.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINNT\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32
vsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

jlpjlp · Answer

slt le principal souci sur ce pc c'est d'avoir deux antivirus: avast et bitdefender! vire un des deux

_______________


scan avec 
MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Martial57 · Answer

Bonsoir,
J'ai viré BitDefender Free.

Ci dessous le rapport après passage Malaware:  (Tout n'a pas été supprimé. Je redémarre après avoir posté ce message.

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1766
Windows 5.0.2195 Service Pack 4

16/02/2009 21:15:59
mbam-log-2009-02-16 (21-15-59).txt

Type de recherche: Examen rapide
Eléments examinés: 88235
Temps écoulé: 14 minute(s), 4 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internat.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINNT\system32\internat.exe (Trojan.Agent) -> Delete on reboot.
C:\WINNT\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\DORKEL\Local Settings\Temp\wrdwn2 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

jlpjlp · Answer

ok

puis


Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
• Redémarre ton ordinateur 
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
• Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuie sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuie sur une touche pour redémarrer le PC. 
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

____________________


 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Martial57 · Answer

Bonsoir,

Ci dessous le rapport de SDFix. Je vais encore scanner avec Bitdefender en ligne et je le posterais.


[b]SDFix: Version 1.240 [/b]
Run by DORKEL on mar. 17/02/2009 at 21:56 

Microsoft Windows 2000 [Version 5.00.2195]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-17 22:08:02
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:



[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Sat  3 Jun 2006            56 ..SHR --- "C:\WINNT\system32\461D480EDE.sys"
Sat  3 Jun 2006         1,682 A.SH. --- "C:\WINNT\system32\KGyGaAvL.sys"
Sat 18 Aug 2007         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

[b]Finished![/b]

jlpjlp · Answer

ok

j'attends le scan en ligne et dis aussi les soucis de ton pc par la suite

Martial57 · Answer

Salut,

J'ai passé le Scan en ligne avec BitDefender , aucun problème détecté.
Je vais encore faire une défragmentation du DD.

Merci

jlpjlp · Answer

ok

pour virer ce qui a été utilisé:



Télécharge ToolsCleaner sur ton bureau. 
-->  http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

Martial57 · Answer

sALUT jLPJLP,

Je suis un peu en retard, je n'ai pas eu le temps en cette fin de semaine.
J'ai télécharge Toolscleaner sur le bureau mais impossible à lancer , il indique:

La bibliothèque de liaison dynamique  Srclient.dll est introuvable sur le chemin spécifié .........

Merci

jlpjlp · Answer

alors vire manuellement ce qui a été utilisé

bonne suite

Martial57 · Answer

Salut.
Fait. Merci beaucoup pour ton aide.

A plus.

jlpjlp · Answer

ok bonne continuation

Virus Win32:Swizzor

40 réponses

Votre réponse

Discussions similaires

Newsletters