Infection

Réponse 21 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

et voilà:
ComboFix 09-03-06.02 - d.pelletier 2009-03-07 17:43:03.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2038.1425 [GMT 1:00]
Lancé depuis: c:\documents and settings\d.pelletier\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
* Resident AV is active

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\vlc-0.9.4-win32.exe
C:\Documents
c:\windows\regedit.com
c:\windows\system32\baewwjbx.ini
c:\windows\system32\blncivrc.ini
c:\windows\system32\blncivrc.ini2
c:\windows\system32\nqtss.ini
c:\windows\system32\nqtss.tmp2
c:\windows\system32\taskmgr.com
c:\windows\system32\tmp.reg
c:\windows\system32\zip32.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys

((((((((((((((((((((((((((((( Fichiers créés du 2009-02-07 au 2009-03-07 ))))))))))))))))))))))))))))))))))))
.

2009-03-07 15:17 . 2009-03-07 15:17 579,584 --a--c--- c:\windows\system32\dllcache\user32.dll
2009-03-07 10:04 . 2009-03-07 10:04 <REP> d-------- c:\documents and settings\d.pelletier\Application Data\com.adobe.example.widget-programmes.40247E01796E652D304FB5752B197AB47987A585.1
2009-03-06 20:05 . 2009-03-06 20:05 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-06 20:05 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-06 20:05 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-06 18:47 . 2009-03-06 18:47 <REP> d-------- c:\program files\EsetOnlineScanner
2009-03-06 18:34 . 2009-03-06 18:34 <REP> d--hs---- C:\$RECYCLE.BIN
2009-03-06 17:31 . 2009-03-06 18:36 <REP> d--h----- C:\$AVG8.VAULT$
2009-03-06 16:38 . 2009-03-06 16:38 <REP> d-------- c:\program files\PDM
2009-03-06 15:15 . 2009-03-06 15:16 <REP> d-------- C:\rsit
2009-03-06 14:31 . 2009-03-06 14:30 410,984 --a------ c:\windows\system32\deploytk.dll
2009-03-06 09:34 . 2009-03-06 20:30 0 --a------ c:\windows\system32\drivers\4783b148.sys
2009-03-06 09:24 . 2009-03-06 09:52 <REP> d-------- c:\program files\Driver Detective
2009-03-06 09:24 . 2009-03-06 09:24 <REP> d-------- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-03-05 18:16 . 2009-03-05 18:16 12,644 --a------ c:\windows\system32\setup.stf
2009-03-05 18:12 . 2008-03-27 03:17 89,896 --a------ c:\windows\system32\drivers\btwsecfl.sys
2009-03-05 17:36 . 2009-03-05 17:36 <REP> d-------- c:\program files\ImageMagick-6.3.6-Q16
2009-03-05 17:33 . 2009-03-05 17:33 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-03-05 16:42 . 2009-03-05 16:42 <REP> d-------- c:\program files\Fichiers communs\Logitech
2009-03-05 16:42 . 2009-03-05 17:35 <REP> d-------- c:\program files\Anoto
2009-03-05 16:42 . 2009-03-05 16:42 <REP> d-------- c:\documents and settings\All Users\Application Data\Anoto
2009-03-05 16:10 . 2009-03-05 16:45 <REP> d-------- c:\documents and settings\d.pelletier\Application Data\anoto
2009-03-05 16:00 . 2009-03-05 17:35 <REP> d-------- c:\program files\Fichiers communs\Anoto
2009-03-05 16:00 . 2009-03-05 16:48 <REP> d-------- C:\Anotopgc
2009-03-05 15:10 . 2009-03-05 15:10 <REP> d-------- c:\documents and settings\d.pelletier\RouterRecordStore
2009-03-04 13:55 . 2009-03-04 13:55 <REP> d-------- c:\program files\IBE
2009-03-03 14:53 . 2009-03-07 09:52 <REP> d-------- c:\program files\Smartione
2009-02-27 18:44 . 2008-07-17 15:06 1,495,552 --a------ c:\windows\system32\epoPGPsdk.dll
2009-02-27 18:44 . 2008-07-17 15:06 280 --a------ c:\windows\system32\epoPGPsdk.dll.sig
2009-02-25 11:13 . 2009-02-25 11:13 <REP> d-------- C:\Nouveau dossier
2009-02-25 09:37 . 2007-06-09 18:07 778,240 --a------ c:\windows\system32\f_rc09.dll
2009-02-25 09:37 . 2007-06-09 19:02 741,376 --a------ c:\windows\system32\f_rc12.dll
2009-02-25 09:37 . 2007-02-14 16:04 32,768 --a------ c:\windows\system32\fphstat.dll
2009-02-25 09:37 . 2003-07-09 18:34 567 --a------ c:\windows\mime_type.ini
2009-02-25 09:36 . 2009-02-25 09:36 <REP> d-------- c:\windows\system32\IOSUBSYS
2009-02-25 09:36 . 2007-06-09 18:07 778,240 --a------ c:\windows\system32\f_rc0c.dll
2009-02-24 14:53 . 2009-02-24 14:53 <REP> d-------- c:\documents and settings\All Users\Application Data\InstallShield
2009-02-24 14:53 . 2009-02-24 14:53 <REP> d-------- c:\documents and settings\All Users\Application Data\Downloaded Installations
2009-02-23 17:49 . 2009-02-23 17:54 <REP> d-------- c:\program files\K-Lite Codec Pack
2009-02-23 17:49 . 2007-06-03 14:31 10,752 --a------ c:\windows\system32\ff_vfw.dll
2009-02-23 17:49 . 2005-02-24 18:56 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-02-23 17:15 . 2009-03-06 19:53 <REP> d-------- c:\program files\MP4 Player
2009-02-20 15:38 . 2009-02-20 17:19 <REP> d-------- c:\program files\IconsExtract
2009-02-20 15:38 . 2009-02-20 15:38 39,424 --a------ c:\windows\zipinst.exe
2009-02-20 15:32 . 2009-02-20 17:20 <REP> d-------- c:\program files\Extricon
2009-02-20 15:24 . 2009-02-20 17:21 <REP> d-------- c:\program files\Easy Extract Icon
2009-02-19 12:24 . 2009-02-19 12:28 <REP> d-------- C:\test
2009-02-17 16:13 . 2009-02-17 16:13 <REP> d-------- c:\documents and settings\d.pelletier\Application Data\ROUTE 66 Sync
2009-02-17 16:12 . 2009-02-17 16:12 <REP> d-------- c:\program files\Fichiers communs\ROUTE 66

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-07 16:55 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-07 16:30 --------- d-----w c:\program files\Mozilla Firefox 3
2009-03-07 16:30 --------- d-----w c:\documents and settings\d.pelletier\Application Data\Spamihilator
2009-03-07 15:46 --------- d-----w c:\program files\Navilog1
2009-03-07 12:51 --------- d-----w c:\program files\SmarThru Office
2009-03-07 12:51 --------- d-----w c:\documents and settings\d.pelletier\Application Data\Samsung
2009-03-07 09:49 --------- d-----w c:\program files\Microsoft Visual Studio 8
2009-03-07 09:48 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-07 08:51 --------- d-----w c:\program files\SAMSUNG
2009-03-07 00:09 --------- d--h--w c:\documents and settings\All Users\Application Data\catalog.wci
2009-03-06 19:26 --------- d-----w c:\program files\OpenAL
2009-03-06 19:05 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-06 18:53 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-06 18:53 --------- d-----w c:\program files\Microsoft Visual Studio 9.0
2009-03-06 18:52 --------- d-----w c:\program files\CCP Systems
2009-03-06 15:42 --------- d-----w c:\program files\CCleaner
2009-03-06 14:45 --------- d-----w c:\program files\Mozilla Thunderbird
2009-03-06 13:30 --------- d-----w c:\program files\Java
2009-03-06 11:39 --------- d-----w c:\program files\Spyware Doctor
2009-03-06 09:31 --------- d-----w c:\documents and settings\d.pelletier\Application Data\uTorrent
2009-03-06 09:22 --------- d-----w c:\program files\ALZip
2009-03-04 15:32 --------- d-----w c:\program files\Microsoft ActiveSync
2009-03-02 13:29 --------- d-----w c:\documents and settings\d.pelletier\Application Data\VMware
2009-02-24 15:37 --------- d-----w c:\program files\Registry Easy
2009-02-24 13:53 --------- d-----w c:\program files\Fichiers communs\InstallShield
2009-02-20 14:32 74,752 ----a-w c:\windows\ST6UNST.EXE
2009-02-20 14:32 253,952 ------w c:\windows\Setup1.exe
2009-02-20 08:31 --------- d-----w c:\documents and settings\d.pelletier\Application Data\skypePM
2009-02-19 20:43 --------- d-----w c:\documents and settings\d.pelletier\Application Data\Skype
2009-02-11 13:29 --------- d-----w c:\documents and settings\d.pelletier\Application Data\FileZilla
2009-02-02 15:41 --------- d-----w c:\documents and settings\All Users\Application Data\VMware
2009-02-02 15:37 --------- d-----w c:\program files\VMware
2009-02-02 15:26 --------- d-----w c:\documents and settings\d.pelletier\Application Data\Thinstall
2009-01-26 13:18 --------- d-----w c:\program files\Fichiers communs\Skype
2009-01-21 10:31 --------- d-----w c:\program files\Spamihilator
2009-01-19 09:11 --------- d-----w c:\program files\Symantec
2009-01-19 09:11 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-30 08:21 77,824 ----a-w c:\windows\system32\kdfapi.dll
2008-12-30 08:21 53,248 ----a-w c:\windows\system32\Kdfhok.dll
2008-12-30 08:21 192,512 ----a-w c:\windows\system32\kdfvmgr.exe
2008-12-23 09:24 665,088 ----a-w c:\windows\system32\spsplib1.dll
2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
2007-12-13 15:43 20,792 ----a-w c:\documents and settings\d.pelletier\Application Data\GDIPFONTCACHEV1.DAT
2007-09-24 08:27 195,645 ----a-w c:\documents and settings\d.pelletier\unlocker1.8.5.exe
2008-07-02 08:30 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-07-02 08:30 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-07-02 08:30 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-07-02 08:30 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-07-02 08:30 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-08-28 09:59 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008082820080829\index.dat
2008-04-03 15:28 6,938,656 --sha-w c:\windows\system32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-06-02 1957888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1024000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Spamihilator"="c:\program files\Spamihilator\spamihilator.exe" [2008-12-23 1321984]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UdaterUI.exe" [2008-07-17 136512]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-06 136600]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-08-16 45056]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\d.pelletier\Menu D‚marrer\Programmes\D‚marrage\
Memeo Launcher.lnk - c:\documents and settings\d.pelletier\Application Data\Microsoft\Installer\{78A39E62-605C-4E8E-9674-31E03BEC29B7}\_8F1B0A23F0AC40B99A091F7F3D92B106.exe [2007-10-19 208896]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"AllowMultipleTSSessions"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlic3]
2004-12-16 01:15 61440 c:\windows\system32\WLIC3Pk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=mnhbvp.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \[u]0/u

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ic3pwflt

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Assistant d'Acrobat.lnk]
backup=c:\windows\pss\Assistant d'Acrobat.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HOTSYNCSHORTCUTNAME.lnk]
backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SAMSUNG NETWORKS SAMSUNG NETWORKS VPN Client.lnk]
backup=c:\windows\pss\SAMSUNG NETWORKS SAMSUNG NETWORKS VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TB-Tray.lnk]
backup=c:\windows\pss\TB-Tray.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dr.Fasoo
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RestoreIT!
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSCSysTrayUI]
--------- 2007-01-05 14:23 270336 c:\program files\SAMSUNG\NetworkScan\NSCSysTrayUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"InCDsrvR"=2 (0x2)
"InCDsrv"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"SWAS_Core"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\incops3\\pcdist.exe"= c:\\WINDOWS\\INCOPS3\\PCDIST.EXE
"c:\\WINDOWS\\incops3\\ic3fd.exe"= c:\\WINDOWS\\INCOPS3\\IC3FD.EXE
"c:\\WINDOWS\\incops3\\forcemon.exe"= c:\\WINDOWS\\INCOPS3\\FORCEMON.EXE
"c:\\WINDOWS\\incops3\\incops3.exe"= c:\\WINDOWS\\INCOPS3\\INCOPS3.EXE
"c:\\WINDOWS\\incops3\\icsng.exe"= c:\\WINDOWS\\INCOPS3\\ICSNG.EXE
"c:\\WINDOWS\\incops3\\icourl.exe"= c:\\WINDOWS\\INCOPS3\\ICOURL.EXE
"c:\\WINDOWS\\incops3\\pc2link.exe"= c:\\WINDOWS\\INCOPS3\\PC2LINK.EXE
"c:\\WINDOWS\\incops3\\pc2links.exe"= c:\\WINDOWS\\INCOPS3\\PC2LINKS.EXE
"c:\\WINDOWS\\incops3\\pcftp.exe"= c:\\WINDOWS\\INCOPS3\\PCFTP.EXE
"c:\\WINDOWS\\incops3\\pc_mail.exe"= c:\\WINDOWS\\INCOPS3\\PC_MAIL.EXE
"c:\\WINDOWS\\incops3\\ivpatch.exe"= c:\\WINDOWS\\INCOPS3\\IVPATCH.EXE
"c:\\WINDOWS\\incops3\\icvsetup.exe"= c:\\WINDOWS\\INCOPS3\\ICVSETUP.EXE
"c:\\WINDOWS\\incops3\\icvupdo.exe"= c:\\WINDOWS\\INCOPS3\\ICVUPDO.EXE
"c:\\WINDOWS\\incops3\\wpatchdo.exe"= c:\\WINDOWS\\INCOPS3\\WPATCHDO.EXE
"c:\\WINDOWS\\incops3\\wpatchrb.exe"= c:\\WINDOWS\\INCOPS3\\WPATCHRB.EXE
"c:\\WINDOWS\\incops3\\wpatchdn.exe"= c:\\WINDOWS\\INCOPS3\\WPATCHDN.EXE
"c:\\PROGRA~1\\FICHIE~1\\MICROW~1\\Agent\\MWAGENT.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\SAMSUNG\\NetworkScan\\NSCSysTrayUI.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"62515:UDP"= 62515:UDP:SVPN
"62515:TCP"= 62515:TCP:SVPN
"80:TCP"= 80:TCP:test bouygues
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2007-10-18 3026]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2007-07-24 58464]
R2 CVPNDRV;SAMSUNG NETWORKS IPsec Driver;c:\windows\system32\drivers\CVPNDrv.sys [2007-08-31 263751]
R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [2005-09-10 4300]
R2 gateman;gateman;c:\windows\incops3\GateMan.exe [2007-03-21 57344]
R2 GtDetectSc;GtDetectSc;c:\program files\Option\GlobeTrotter Mobility Manager\GtDetectSc.exe [2007-12-18 196704]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-06-29 42512]
R2 SNM WLAN Service;SNM WLAN Service;c:\program files\SAMSUNG\Samsung Network Manager\SNMWLANService.exe [2005-05-28 36864]
R2 SRS_PostInstaller;SRS PostInstaller Service;c:\program files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe [2005-11-28 31744]
R3 wowfilter;WOW XT Filter Driver;c:\windows\system32\drivers\WOWFilter.sys [2005-11-28 19456]
S0 fwgvksa;fwgvksa;c:\windows\system32\drivers\eljt.sys --> c:\windows\system32\drivers\eljt.sys [?]
S1 4783b148;4783b148;c:\windows\system32\drivers\4783b148.sys [2009-03-06 0]
S3 f_kp;f_kp;c:\windows\system32\drivers\f_kp.sys [2007-10-05 4598]
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\drivers\Gt51Ip.sys [2008-02-18 106624]
S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\drivers\gt72ubus.sys [2008-02-08 59648]
S3 GTMM Device Service;GTMM Device Service;c:\program files\Option\GlobeTrotter Mobility Manager\GtmmDeviceService.exe [2008-03-05 106496]
S3 GTPTSER;GT PT SER;c:\windows\system32\drivers\gtptser.sys [2007-03-30 8064]
S3 PcounterData;Pcounter Data Server;c:\windows\system32\PCNTDATA.EXE [2007-11-28 306688]
S3 PcounterPrint;Pcounter Printer Control;c:\windows\system32\PCOUNTER.EXE [2007-11-28 368640]
S3 Phal;Phal - Logitech io2 USB driver;c:\windows\system32\drivers\LPhalUsb.sys [2005-03-07 56832]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2008-02-25 356920]
S3 SSB2413;SSB2413 Wireless Network Adapter Service;c:\windows\system32\drivers\SSB2413.sys [2007-05-04 470112]
S4 winfil32;winfil32;c:\windows\system32\WinFil32.exe [2006-09-14 77824]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adbc625f-a9b9-11dd-ae51-001b7735c6bf}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL website\index.html
.
Contenu du dossier 'Tâches planifiées'

2009-03-07 c:\windows\Tasks\User_Feed_Synchronization-{E819D56D-AC38-4354-A635-A7077769F3A7}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:58]
.
- - - - ORPHELINS SUPPRIMES - - - -

ShellIconOverlayIdentifiers- - (no file)
HKLM-Run-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
Notify-yayxvWQK - yayxvWQK.dll

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.samsung.com/fr/
uDefault_Search_URL = hxxp://www.google.com
mStart Page =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Capture Selection
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Save as HTML
IE: Save Selected Text
LSP: c:\windows\system32\Anywall3.dll
Trusted Zone: samsung-emp.com
Trusted Zone: samsung.com\*.sec
Trusted Zone: samsung.net
Trusted Zone: samsunggsbn.com
Trusted Zone: samsungportal.com
Trusted Zone: samsungvpn.com
Trusted Zone: samsungwireless.com
DPF: {00B4EB57-5F54-4A6A-BC1A-DE9ABA26C0E2} - hxxp://drm.samsung.net/activex/EPDRM.fasoo.cab
DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} - hxxp://210.118.63.201:8080/SiteRoots/main/Install/win32/CentraUpdaterAx.cab
DPF: {03F49E0E-C43A-4037-BBD6-D681E998A08E} - hxxp://sso.sec.samsung.net/cabfiles/CM_CodeAx.cab
DPF: {08BCD971-A13B-4D6E-A2A5-E9B2324FC00D} - hxxp://europe.samsungportal.com/EP/web/common/cabfiles/CM_ClientEXE.cab
DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} - hxxp://minitelweb.minitel.com/imin_data/ocx/MDM.cab
DPF: {124250DD-E2CC-4B5B-AE7E-C9AC8A11DF43} - hxxp://gppm.sec.samsung.net/SIMSV3_Manual/StreamNote2.cab
DPF: {18C690F8-769B-4F07-A687-0FC0D45FFCC8} - hxxps://partnerlogin.samsungelectronics.com/ko/secui/SecuiB2BIE-ko.cab
DPF: {223216F6-B9FE-406D-9ED6-143FCE3A07B8} - file:///C:/WINDOWS/Temp/MxLogicalTRU.cab
DPF: {2FF8F8B7-1B3F-4E5F-93B1-FEF1D703C0F4} - hxxp://w1.samsung.net/cabs/LocalFolder2004/Cab/mySingleLocal_U.cab
DPF: {3042C30E-50B7-44EF-B4B6-C9AB391DEF78} - hxxp://eofficeeu.sec.samsung.net:8088/eoffice1/gauce/cabfiles/Manager.cab
DPF: {3F3531B7-024F-48F5-A159-F45949473CFE} - hxxp://eu.samsungvpn.com/english/data/cabFile/SVPNModule.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
DPF: {6EA553AE-9B6D-4025-B3A9-CC3454F86E7B} - file:///C:/DOCUME~1/D4C71~1.PEL/LOCALS~1/Temp/SamNetIssac.cab
DPF: {714E667D-360C-4BFB-8C1A-E4812B608CC1} - hxxp://europe.samsungportal.com/EP/web/common/cabfiles/ACUBETrustChecker.cab
DPF: {71E7ACA0-EF63-4055-9894-229B056E9C31} - file:///C:/WINDOWS/Temp/MxGridU.cab
DPF: {7D73D9AC-9E28-47E7-B496-867A2341DD6F} - hxxp://eu.ghr.sec.samsung.net:8801/activex/pdss40.cab
DPF: {88DDFD7D-14F7-4E89-8F85-737B90B1A0D0} - hxxp://w1.samsung.net/cabs/LocalFolder2004/Cab/mySingle_Trust.CAB
DPF: {9683681E-FAD6-45F1-86B3-FD60C7101BC9} - file:///C:/WINDOWS/Temp/MxReportU.cab
DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} - hxxp://europe.samsungportal.com/EP/web/common/cabfiles/UniSSOCheck.cab
DPF: {9F0AA341-1D10-4B18-B70B-6AA49CE7F5D6} - file:///C:/WINDOWS/Temp/MxImageSetU.cab
DPF: {A4508A45-F1C4-40F3-99B4-0CA08AC77E3B} - file:///C:/DOCUME~1/D4C71~1.PEL/LOCALS~1/Temp/kdfense8.cab
DPF: {AF989B7C-8AC3-40BC-B749-EB335BDFD190} - file:///C:/WINDOWS/Temp/MxDataSetU.cab
DPF: {B06ECF02-E502-4737-BA32-91CA0CECFBD1} - hxxp://europe.samsungportal.com/km/htdocs/include/cabfiles/MultiDownload.cab
DPF: {BB4533A0-85E0-4657-9BF2-E8E7B100D47E} - file:///C:/WINDOWS/Temp/MxComboU.cab
DPF: {BB783B43-D0E8-4EF2-A275-D147A4709E4E} - hxxp://ecms.samsungelectronics.com/include/activex/treeview.cab
DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} - hxxp://europe.samsungportal.com/EP/web/common/cabfiles/ActiveXSetup.cab
DPF: {D7779973-9954-464E-9708-DA774CA50E13} - file:///C:/WINDOWS/Temp/MxMaskEditU.cab
DPF: {DE6ABA6A-095B-43E3-BEBB-879868DC5C8A} - hxxp://mysingle5.samsung.net/portalWeb/cabs/messenger/SSLinks.cab
DPF: {DF1AD5D9-977A-4A1F-9392-2AFFCCE6211F} - hxxp://edms-ab.sec.samsung.net/edms/lib/IxSheet_U.cab
DPF: {E1D1DACA-5BA2-4376-89AD-3A213B916779} - hxxp://eu.ghr.sec.samsung.net:8801/activex/IBSheet4Unicode.CAB
DPF: {E463DD62-1D07-425E-B82A-539FBA2F4162} - hxxps://www.samsunggsbn.com/PSI3/Cab/GSBN_Updater.CAB
DPF: {F2B7C894-49BD-4582-A142-0AE1C99460C2} - hxxp://stels.sec.samsung.com/common/cabfiles/CM_CodeAxNew.cab
DPF: {F36BB72B-9876-4C6D-B22F-D68E480A39B5} - hxxp://www.samsungprins.com/F_Include/XFileUpload/XFileUpload_OnlyOne.CAB
DPF: {F9C6BABD-843A-419E-996A-8FB7C8F77A78} - hxxp://www.samsungprins.com/f_product/Pims_download/productkey.cab
DPF: {FEA96871-7BA4-496B-B020-6B078839891E} - file:///C:/DOCUME~1/D4C71~1.PEL/LOCALS~1/Temp/SVPNEnvModule.cab
FF - ProfilePath - c:\documents and settings\d.pelletier\Application Data\Mozilla\Firefox\Profiles\nf7ma3rh.default\
FF - component: c:\documents and settings\d.pelletier\Application Data\Mozilla\Firefox\Profiles\nf7ma3rh.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll
FF - plugin: c:\program files\Mozilla Firefox 3\plugins\npornap.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-07 17:52:36
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
"ImagePath"="system32\DRIVERS\aic78xx.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Alea Server: Connection]

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Alea Server: Events]

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Alea Server: General]

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Alea Server: Startup]

Réponse 22 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

Télécharges FindyKill de Chiquitine29 :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

->Enregistres le sur ton bureau et pas ailleurs !

!! Déconnectes toi et fermes toute applications en cours !!

-> Cliques sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.

--> Double cliques sur le raccourci " FindyKill " qui est sur ton bureau .
-->choisis l'option 1 ( recherche ) . Puis laisses travailler l'outil sans rien toucher ...

Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

Réponse 23 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

résultat:

############################## [ FindyKill V4.719 ]

# User : d.pelletier () # PELLETIERX11
# Update on 06/03/09 by Chiquitine29
# Start at: 19:00:14 | 2009-03-07

# Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 101.26 Go (55.94 Go free) [PELLETIER] # NTFS
# D:\ # Disque CD-ROM
# Z:\ # Connexion réseau

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Tanagra\Memeo\MemeoService.exe
C:\program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\incops3\gateman.exe
C:\Program Files\Option\GlobeTrotter Mobility Manager\GtDetectSc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Fichiers communs\MicroWorld\Agent\MWASER.EXE
C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe
C:\Program Files\Fichiers communs\MicroWorld\Agent\MWAgent.exe
C:\Program Files\Fichiers communs\Logitech\Pen\Phal\Service\LPhal.exe
C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe
C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\INCOPS3\incops3.EXE
C:\WINDOWS\INCOPS3\ictray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers / Dossiers infectieux C:\ ]

################## [ C:\WINDOWS ]

################## [ C:\WINDOWS\system32 ]

################## [ C:\WINDOWS\system32\drivers ]

################## [ C:\.. Application Data ... ]

################## [ Registre / Clés infectieuses ]

################## [ Recherche dans supports amovibles]

# Presence des fichiers :

################## [ Registre / Mountpoint2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.719 ! ]

Réponse 24 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Salut Ced_King. As-tu de nouvelles instructions pour moi? Je pense que je traine encore 2 ou 3 cochonneries.

Réponse 25 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

Bonjour,

-Clique sur Démarrer puis Exécuter. Tapes combofix /u dans la zone de saisie puis OK.
- Puis va à la racine du disque dur et supprimes ceci : c/qobox

____________________
- Il y a un an exactement, tu étais sur le forum de 01net.com ( Caellyn), mais le travail n'a pas été fait serieusement >> Constat

- Pour le scan Combofix, j'avais precisé :/!\ Desactives ton antivirus et la garde de ton antispyware ( si tu en as un) /!\

- Rapport Combofix :* Resident AV is active

- Si on vous le dis, c'est que c'est vraiment necessaire, la garde de tes defenses a certainement géné le scan...

- En ce qui concerne SpywareDoctor, regardes ce que dit Malekal_morte à son sujet:
http://www.malekal.com/tutorial_SpywareDoctor.php

- De plus, tu as plusieurs antivirus >> AVG8 dans la corbeille, MacaFee ( a virer), et j'ai pu aussi voir quelques traces de Symantec... Il ne faut qu'un seul antivirus sur ton pc > risque de conflits entre eux, etc...
( un antivirus et un pare-feu par PC )

___________________________

- Si tu eprouves de la difficulté a supprimer Macafee, voici un utilitaire qui le permet :
1.tu as une fenetre avec un lien pour télécharger l'utilitaire
http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe
2. Cliquez sur Enregistrer et enregistrez le fichier dans un dossier de votre ordinateur.
3. Allez au dossier où est enregistré le fichier.
4. Double-cliquez sur MCPR.exe.
5. Cliquez sur Exécuter. Une fenêtre de commande apparaît, puis se referme automatiquement. Attendez que la seconde fenêtre de commande s'affiche (ne double-cliquez pas une seconde fois sur MCPR.exe.). Le programme va lancer le nettoyage.
6. Attendez la fin du processus, qui peut prendre quelques minutes. Le message suivant apparaîtra dans la fenêtre de commande :

L'ordinateur doit être redémarré pour conclure la désinstallation. Souhaitez-vous redémarrer maintenant ? [o.n]
7. Tapez O (ou Y si l'interface vous propose [y.n] comme choix) sur votre clavier.
8. Attendez que votre ordinateur redémarre.

- Pour verifier, vas sur " Demarrer " > " Executer > tapes " regedit " dans le champs, et supprimes cette clé :
HKEY_ LOCAL_MACHINE/software/Microsoft/windows/currentversion/run - macafeeUpdaterUI -Networkassociates

___________________________

- Je te conseille de prendre Avira antivir, beaucoup plus performant, c'est ce que l'on fait de mieux en gratuits

https://www.avira.com/ et un tuto : https://www.malekal.com/avira-free-security-antivirus-gratuit/

____________________________

- En ce qui concerne INCOPS3, j'ai trouvé ceci : [http://spywarefiles.prevx.com/RRDIHJ2988250/INCOPS3.EXE.html

- Pareil pour " FASOO : http://spywarefiles.prevx.com/RRAACG2267902/FPH.EXE.html

___________________________
- Si tu ne l'as pas encore,
- Telecharges Ccleaner : https://filehippo.com/download_ccleaner/

- Pendant l'installation, décoches la case proposant la barre Yahoo et celle proposant d'ajouter l'options des mises a jours..
- Une fois installé, fermes toutes les applications en cours et lances Ccleaner
- clic sur mode avancé et décoche la case " effacer les fichiers du....plus vieux que 48h, ne touches pas aux autres parametres
- Clic sur "Nettoyeur " >> " analyse " >> et lances le nettoyage, puis refermes le programme

____________________________

Telecharges OTMoveIt3 de Oldtimer et enregistre le sur le bureau

http://oldtimer.geekstogo.com/OTMoveIt3.exe

- Desactives la garde de ton antivirus
- Fermes toutes les applications en cours et double clic sur OTMoveIT
- Assures toi que la case " Unregister Dll's and ocx's " soit bien cochée et copie ( ctrl+ C) ce qui est ci dessous " :

:processes
explorer.exe

:files
c:\windows\system32\drivers\4783b148.sys
c:\windows\system32\drivers\eljt.sys
c:\windows\mime_type.ini

:reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=mnhbvp.dll
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2
\{adbc625f-a9b9-11dd-ae51-001b7735c6bf}]

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]

- Colles les ( CTRL + V) dans le cadre de gauche OTMoveIt nommé : " Past List of Files\Folders to be moved "
- Clic sur " Moveit! " pour lancer la suppression et laisse l'outil travailler
- Ton bureau va disparaitre, c'est normal...
- Lorque le resultat apparait dans le cadre " results " cliques sur " Exit "
- Otmoveit devra peut etre redemarrer le pc pour finir la suppression, clic sur " yes " si cela s'avère utile...

- Le rapport se trouve à C:\_OtmoeIt\Moved Files\x x x x x x.log

___________________________

- Telecharges Smitfraudfix : http://siri.urz.free.fr/Fix/SmitfraudFix.exe

- Desactives la garde residente de ton antivirus et la garde de ton antispyware ( si tu en as)

- double clic sur le raccourci de ton bureau > un fichier est créé
- Double clic sur SmitfraudFix.exe et choisis la langue
- Laisses toi guider et selectionnes l'option1 ( recherche)
- Patientes jusqu'à la fin du scan et postes le contenu du rapport qui s'etablira
.

Réponse 26 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Bonjour,

Quelques petites précisions...

J'ai en effet déjà eu un soucis mais je n'ai pas les compétences pour juger si le travail a été bien ou mal fait. Si je me rappelle bien, mon interlocuteur a cessé de m'aider soudainement.

Au sujet de MCAfee, j'ai peur de ne rien pouvoir y faire vu que cela m'est imposé par ma boite donc il faudra que je fasse avec mais je note ta suggestion pour ma machine perso.

INCOPS et FASOO sont aussi des softs imposés par nos amis Coréens et dont je ne peux me passer.

Quand à combofix...je fais de mon mieux pour suivre tes instructions mais je ne suis pas un spécialiste donc je fais des erreurs. Pour moi, j'avais arrêté antivirus et antispyware. Que dois-je faire pour être sûr que c'est ok?

Ceci étant dit, je te remercie pour ton aide et ta patience et je reprends la procédure.

Toast3r

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Alors...tout d'abord j'espère avoir bien désactivé mon McAfee mais il y a un service que je ne peux pas arrêter (Error 5).

Ensuite, j'ai bien désinstallé combofix mais je n'ai pas trouvé de qobox.

Et pour finir, OTmoveit tourne depuis 20mn mais il m'a l'air bloqué. J'ai des résultats dans la fenêtre "results" mais je ne peux pas cliquer sur exit car j'ai un sablier au lieu de mon pointeur.

Que fais-je?

Réponse 27 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

- Arretes le et redemarres l'ordi manuellement...
-si ton bureau ne reapparait pas, presses les touches Ctrl + Alt + supp > gestionnaire de taches >onglet " processus " > " executer " puis tapes " Explorer " et valides..

- Passes à Smitfraudfix...

PS : tu diras si tu peux à ton patron, que tout son systeme a été victime d'un detournement, que Macafee est loin d'etre un antivirus performant, qu'il fasse changer tous les mots de passe, que les programmes qu'il vous fait utiliser sont pour la plupart malsains, enfin bref... XD !
.

Réponse 28 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Alors là, j'ai l'impression que mon cas ne s'arrange pas... Je ne peux même plus redémarrer mon PC. Il boote, me demande mon mdp, commence à charger le bureau et puis il se bloque. La led du disque clignote environ 1 fois par seconde mais il ne finit jamais de démarrer et je ne peux rien lancer.

Par contre, je peux démarrer en mode sans échec. Puis-je faire le Smitfraudfix en sans échec?

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Je suis de retour dans la course. Voilà le rapport SmitFraudfix:

SmitFraudFix v2.400

Rapport fait à 20:01:24.79, 2009-03-09
Executé à partir de C:\Documents and Settings\d.pelletier\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Tanagra\Memeo\MemeoService.exe
C:\program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\incops3\gateman.exe
C:\Program Files\Option\GlobeTrotter Mobility Manager\GtDetectSc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Fichiers communs\MicroWorld\Agent\MWASER.EXE
C:\Program Files\Fichiers communs\MicroWorld\Agent\MWAgent.exe
C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe
C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\INCOPS3\incops3.EXE
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\INCOPS3\ictray.exe
C:\Program Files\Mozilla Firefox 3\firefox.exe
C:\WINDOWS\system32\msfeedssync.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\d.pelletier\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\d.pelletier

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\D4C71~1.PEL\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\d.pelletier\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\D4C71~1.PEL\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="mnhbvp.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom NetXtreme Gigabit Ethernet - Miniport d'ordonnancement de paquets
DNS Server Search Order: 106.102.1.235
DNS Server Search Order: 106.10.93.51
DNS Server Search Order: 194.2.0.20
DNS Server Search Order: 194.98.65.65
DNS Server Search Order: 203.241.132.34

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9355E87A-FE5C-4FE0-80DA-12CD703923AA}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{E49683D0-D819-4852-92E4-6B6EF6F73E0D}: DhcpNameServer=106.102.1.235 106.10.93.51 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9355E87A-FE5C-4FE0-80DA-12CD703923AA}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E49683D0-D819-4852-92E4-6B6EF6F73E0D}: DhcpNameServer=106.102.1.235 106.10.93.51 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CS2\Services\Tcpip\..\{E49683D0-D819-4852-92E4-6B6EF6F73E0D}: DhcpNameServer=106.102.1.235 106.102.1.111 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9355E87A-FE5C-4FE0-80DA-12CD703923AA}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E49683D0-D819-4852-92E4-6B6EF6F73E0D}: DhcpNameServer=106.102.1.235 106.10.93.51 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=106.102.1.235 106.102.1.111 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Réponse 29 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

Redemarres le pc en mode sans echec et choisis l'option2
- reponds " oui " aux questions
- Patientes le temps du nettoyage
- Postes le contenu du rapport généré et un nouveau rapport RSIT

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

rapport SmitFraudFix:

SmitFraudFix v2.400

Rapport fait à 7:22:09.00, 2009-03-10
Executé à partir de C:\Documents and Settings\d.pelletier\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Broadcom NetXtreme Gigabit Ethernet - Miniport d'ordonnancement de paquets
DNS Server Search Order: 106.102.1.235
DNS Server Search Order: 106.10.93.51
DNS Server Search Order: 194.2.0.20
DNS Server Search Order: 194.98.65.65
DNS Server Search Order: 203.241.132.34

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.40.241
DNS Server Search Order: 212.27.40.240

HKLM\SYSTEM\CCS\Services\Tcpip\..\{9355E87A-FE5C-4FE0-80DA-12CD703923AA}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CCS\Services\Tcpip\..\{E49683D0-D819-4852-92E4-6B6EF6F73E0D}: DhcpNameServer=106.102.1.235 106.10.93.51 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CS1\Services\Tcpip\..\{9355E87A-FE5C-4FE0-80DA-12CD703923AA}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E49683D0-D819-4852-92E4-6B6EF6F73E0D}: DhcpNameServer=106.102.1.235 106.10.93.51 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CS2\Services\Tcpip\..\{E49683D0-D819-4852-92E4-6B6EF6F73E0D}: DhcpNameServer=106.102.1.235 106.102.1.111 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9355E87A-FE5C-4FE0-80DA-12CD703923AA}: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E49683D0-D819-4852-92E4-6B6EF6F73E0D}: DhcpNameServer=106.102.1.235 106.10.93.51 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=106.102.1.235 106.102.1.111 194.2.0.20 194.98.65.65 203.241.132.34
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.241 212.27.40.240

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

raport RSIT

Logfile of random's system information tool 1.05 (written by random/random)
Run by d.pelletier at 2009-03-10 07:30:23
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 59 GB (57%) free of 104 GB
Total RAM: 2038 MB (82% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:30:37, on 2009-03-10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\INCOPS3\incops3.EXE
C:\WINDOWS\INCOPS3\ictray.exe
C:\WINDOWS\system32\cleanmgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\d.pelletier\Bureau\RSIT.exe
C:\Program Files\HijackThis\d.pelletier.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: PMURLMObj Class - {922C022A-E97F-4FB6-890E-D167DA951D5E} - C:\WINDOWS\INCOPS3\PMURLMon.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\anywall3.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\anywall3.dll
O11 - Options group: [java_sun] Java (Sun)
O15 - Trusted Zone: *.samsung-emp.com
O15 - Trusted Zone: *.sec.samsung.com
O15 - Trusted Zone: http://*.samsung.net
O15 - Trusted Zone: *.samsunggsbn.com
O15 - Trusted Zone: *.samsungportal.com
O15 - Trusted Zone: http://*.samsungvpn.com
O15 - Trusted Zone: *.samsungwireless.com
O16 - DPF: {56762dec-6b0d-4ab4-a8ad-989993b5d08b} - https://www.eset.com/
O16 - DPF: {7D73D9AC-9E28-47E7-B496-867A2341DD6F} (PdssRun Class) - http://eu.ghr.sec.samsung.net:8801/activex/pdss40.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sef_dms.lan
O17 - HKLM\Software\..\Telephony: DomainName = sef_dms.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sef_dms.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sef_dms.lan
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = sef_dms.lan
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: mnhbvp.dll
O20 - Winlogon Notify: wlic3 - C:\WINDOWS\SYSTEM32\WLIC3Pk.dll
O20 - Winlogon Notify: yayxvWQK - yayxvWQK.dll (file missing)
O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Memeo (BMUService) - Tanagra, Inc. - C:\Program Files\Tanagra\Memeo\MemeoService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: gateman - SDS - C:\WINDOWS\incops3\gateman.exe
O23 - Service: GtDetectSc - OptionNV - C:\Program Files\Option\GlobeTrotter Mobility Manager\GtDetectSc.exe
O23 - Service: GTMM Device Service - Option nv - C:\Program Files\Option\GlobeTrotter Mobility Manager\GtmmDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (javaquickstarterservice) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Service McAfee Framework (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Program Files\Fichiers communs\MicroWorld\Agent\MWASER.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pcounter Data Server (PcounterData) - A.N.D. Technologies, Inc. - C:\WINDOWS\System32\PCNTDATA.EXE
O23 - Service: Pcounter Printer Control (PcounterPrint) - A.N.D. Technologies, Inc. - C:\WINDOWS\System32\PCOUNTER.EXE
O23 - Service: Digital Pen rendezvous server (PenRendezvous) - Logitech - C:\Program Files\Fichiers communs\Logitech\Pen\Phal\Service\LPhal.exe
O23 - Service: Digital Pen Socket to USB protocol (PenSup) - Logitech - C:\Program Files\Fichiers communs\Logitech\Pen\Phal\Service\LPhal.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: SNM WLAN Service - Unknown owner - C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe
O23 - Service: SRS PostInstaller Service (SRS_PostInstaller) - SRS Labs, Inc. - C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe

Réponse 30 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

voilà le rapport rsit:

Logfile of random's system information tool 1.05 (written by random/random)
Run by d.pelletier at 2009-03-10 20:07:37
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 58 GB (56%) free of 104 GB
Total RAM: 2038 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:08:05, on 2009-03-10
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\incops3\gateman.exe
C:\Program Files\Option\GlobeTrotter Mobility Manager\GtDetectSc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Fichiers communs\MicroWorld\Agent\MWASER.EXE
C:\Program Files\Fichiers communs\MicroWorld\Agent\MWAgent.exe
C:\Program Files\Fichiers communs\Logitech\Pen\Phal\Service\LPhal.exe
C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe
C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\INCOPS3\incops3.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\INCOPS3\ictray.exe
C:\Documents and Settings\d.pelletier\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\HijackThis\d.pelletier.exe
C:\WINDOWS\system32\msfeedssync.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w1.samsung.net/portalWeb/default.jsp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: PMURLMObj Class - {922C022A-E97F-4FB6-890E-D167DA951D5E} - C:\WINDOWS\INCOPS3\PMURLMon.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\anywall3.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\anywall3.dll
O11 - Options group: [java_sun] Java (Sun)
O15 - Trusted Zone: *.samsung-emp.com
O15 - Trusted Zone: *.sec.samsung.com
O15 - Trusted Zone: http://*.samsung.net
O15 - Trusted Zone: *.samsunggsbn.com
O15 - Trusted Zone: *.samsungportal.com
O15 - Trusted Zone: http://*.samsungvpn.com
O15 - Trusted Zone: *.samsungwireless.com
O16 - DPF: {56762dec-6b0d-4ab4-a8ad-989993b5d08b} - https://www.eset.com/
O16 - DPF: {7D73D9AC-9E28-47E7-B496-867A2341DD6F} (PdssRun Class) - http://eu.ghr.sec.samsung.net:8801/activex/pdss40.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sef_dms.lan
O17 - HKLM\Software\..\Telephony: DomainName = sef_dms.lan
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sef_dms.lan
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sef_dms.lan
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = sef_dms.lan
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: mnhbvp.dll
O20 - Winlogon Notify: wlic3 - C:\WINDOWS\SYSTEM32\WLIC3Pk.dll
O20 - Winlogon Notify: yayxvWQK - yayxvWQK.dll (file missing)
O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Memeo (BMUService) - Tanagra, Inc. - C:\Program Files\Tanagra\Memeo\MemeoService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: gateman - SDS - C:\WINDOWS\incops3\gateman.exe
O23 - Service: GtDetectSc - OptionNV - C:\Program Files\Option\GlobeTrotter Mobility Manager\GtDetectSc.exe
O23 - Service: GTMM Device Service - Option nv - C:\Program Files\Option\GlobeTrotter Mobility Manager\GtmmDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (javaquickstarterservice) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Service McAfee Framework (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Program Files\Fichiers communs\MicroWorld\Agent\MWASER.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pcounter Data Server (PcounterData) - A.N.D. Technologies, Inc. - C:\WINDOWS\System32\PCNTDATA.EXE
O23 - Service: Pcounter Printer Control (PcounterPrint) - A.N.D. Technologies, Inc. - C:\WINDOWS\System32\PCOUNTER.EXE
O23 - Service: Digital Pen rendezvous server (PenRendezvous) - Logitech - C:\Program Files\Fichiers communs\Logitech\Pen\Phal\Service\LPhal.exe
O23 - Service: Digital Pen Socket to USB protocol (PenSup) - Logitech - C:\Program Files\Fichiers communs\Logitech\Pen\Phal\Service\LPhal.exe
O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE (file missing)
O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: SNM WLAN Service - Unknown owner - C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe
O23 - Service: SRS PostInstaller Service (SRS_PostInstaller) - SRS Labs, Inc. - C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe
End of file - 9815 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\User_Feed_Synchronization-{E819D56D-AC38-4354-A635-A7077769F3A7}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497bb-d6f0-462c-b6eb-d4daf1d92d43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-03-06 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{922C022A-E97F-4FB6-890E-D167DA951D5E}]
PMURLMObj Class - C:\WINDOWS\INCOPS3\PMURLMon.dll [2006-03-23 69632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dbc80044-a445-435b-bc74-9c25c1c588a9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-06 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e7e6f031-17ce-4c07-bc86-eabfe594f69c}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-06 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-12-06 1024000]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-06 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"H/PC Connection Agent"=C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]
"SuperCopier2.exe"=C:\Program Files\SuperCopier2\SuperCopier2.exe [2006-07-07 1052672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-10-10 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dr.Fasoo]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
C:\Program Files\Microsoft ActiveSync\wcescomm.exe [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
C:\Program Files\Network Associates\Common Framework\udaterui.exe [2008-03-14 136512]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\Windows Live\Messenger\msnmsgr.exe /background []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
C:\Program Files\Ahead\Nero BackItUp\NBJ.exe [2005-06-02 1957888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSCSysTrayUI]
C:\Program Files\Samsung\NetworkScan\NSCSysTrayUI.exe [2007-01-05 270336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2007-06-29 286720]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2006-08-16 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RestoreIT!]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE /STANDALONE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spamihilator]
C:\Program Files\Spamihilator\spamihilator.exe [2008-12-23 1321984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Assistant d'Acrobat.lnk]
C:\PROGRA~1\Adobe\ACROBA~2.0\Distillr\acrotray.exe [2003-10-24 217194]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HOTSYNCSHORTCUTNAME.lnk]
C:\PROGRA~1\palmOne\Hotsync.exe [2004-06-09 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SAMSUNG NETWORKS SAMSUNG NETWORKS VPN Client.lnk]
C:\PROGRA~1\CISCOS~1\VPNCLI~1\IPSECD~1.EXE [2002-09-03 1269836]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^TB-Tray.lnk]
C:\PROGRA~1\THUNDE~1\TBTray.exe [2005-11-08 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^d.pelletier^Menu Démarrer^Programmes^Démarrage^Memeo Launcher.lnk]
C:\Documents and Settings\d.pelletier\Application Data\Microsoft\Installer\{78A39E62-605C-4E8E-9674-31E03BEC29B7}\_8F1B0A23F0AC40B99A091F7F3D92B106.exe [2007-10-19 208896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3
"InCDsrvR"=2
"InCDsrv"=2
"Apple Mobile Device"=2
"SWAS_Core"=2

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="mnhbvp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-12-14 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlic3]
C:\WINDOWS\system32\WLIC3Pk.dll [2004-12-16 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayxvWQK]
yayxvWQK.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
ic3pwflt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"AllowMultipleTSSessions"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\incops3\pcdist.exe"="C:\WINDOWS\INCOPS3\PCDIST.EXE:*:Enabled:INCOPS DIST"
"C:\WINDOWS\incops3\ic3fd.exe"="C:\WINDOWS\INCOPS3\IC3FD.EXE:*:Enabled:INCOPS FILE-DOWN"
"C:\WINDOWS\incops3\forcemon.exe"="C:\WINDOWS\INCOPS3\FORCEMON.EXE:*:Enabled:INCOPS FM"
"C:\WINDOWS\incops3\incops3.exe"="C:\WINDOWS\INCOPS3\INCOPS3.EXE:*:Enabled:INCOPS III"
"C:\WINDOWS\incops3\icsng.exe"="C:\WINDOWS\INCOPS3\ICSNG.EXE:*:Enabled:INCOPS IS"
"C:\WINDOWS\incops3\icourl.exe"="C:\WINDOWS\INCOPS3\ICOURL.EXE:*:Enabled:INCOPS IU"
"C:\WINDOWS\incops3\pc2link.exe"="C:\WINDOWS\INCOPS3\PC2LINK.EXE:*:Enabled:INCOPS PC2LINK"
"C:\WINDOWS\incops3\pc2links.exe"="C:\WINDOWS\INCOPS3\PC2LINKS.EXE:*:Enabled:INCOPS PC2LINKS"
"C:\WINDOWS\incops3\pcftp.exe"="C:\WINDOWS\INCOPS3\PCFTP.EXE:*:Enabled:INCOPS PCFTP"
"C:\WINDOWS\incops3\pc_mail.exe"="C:\WINDOWS\INCOPS3\PC_MAIL.EXE:*:Enabled:INCOPS PC-MAIL"
"C:\WINDOWS\incops3\ivpatch.exe"="C:\WINDOWS\INCOPS3\IVPATCH.EXE:*:Enabled:INCOPS UPDATE"
"C:\WINDOWS\incops3\icvsetup.exe"="C:\WINDOWS\INCOPS3\ICVSETUP.EXE:*:Enabled:INCOPS VACCINE"
"C:\WINDOWS\incops3\icvupdo.exe"="C:\WINDOWS\INCOPS3\ICVUPDO.EXE:*:Enabled:INCOPS VERUP"
"C:\WINDOWS\incops3\wpatchdo.exe"="C:\WINDOWS\INCOPS3\WPATCHDO.EXE:*:Enabled:INCOPS WPDLG"
"C:\WINDOWS\incops3\wpatchrb.exe"="C:\WINDOWS\INCOPS3\WPATCHRB.EXE:*:Enabled:INCOPS WPRBT"
"C:\WINDOWS\incops3\wpatchdn.exe"="C:\WINDOWS\INCOPS3\WPATCHDN.EXE:*:Enabled:INCOPS WPSIG"
"C:\PROGRA~1\FICHIE~1\MICROW~1\Agent\MWAGENT.EXE"="C:\PROGRA~1\FICHIE~1\MICROW~1\Agent\MWAGENT.EXE:*:Enabled:MicroWorld Management Agent"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\SAMSUNG\NetworkScan\NSCSysTrayUI.exe"="C:\Program Files\SAMSUNG\NetworkScan\NSCSysTrayUI.exe:*:Enabled:SysTrayUI Module"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Network Associates\Common Framework\FrameworkService.exe"="C:\Program Files\Network Associates\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe"="C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"
"C:\Program Files\SAMSUNG\NetworkScan\NSCSysTrayUI.exe"="C:\Program Files\SAMSUNG\NetworkScan\NSCSysTrayUI.exe:*:Enabled:SysTrayUI Module"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Documents and Settings\d.pelletier\Local Settings\Temporary Internet Files\Content.IE5\KR5OL1W1\PCMANIII(v3.43).exe"="C:\Documents and Settings\d.pelletier\Local Settings\Temporary Internet Files\Content.IE5\KR5OL1W1\PCMANIII(v3.43).exe:*:Enabled:INCOPS INSTALL"
"C:\WINDOWS\incops3\pcdist.exe"="C:\WINDOWS\INCOPS3\PCDIST.EXE:*:Enabled:INCOPS DIST"
"C:\WINDOWS\incops3\ic3fd.exe"="C:\WINDOWS\INCOPS3\IC3FD.EXE:*:Enabled:INCOPS FILE-DOWN"
"C:\WINDOWS\incops3\forcemon.exe"="C:\WINDOWS\INCOPS3\FORCEMON.EXE:*:Enabled:INCOPS FM"
"C:\WINDOWS\incops3\incops3.exe"="C:\WINDOWS\INCOPS3\INCOPS3.EXE:*:Enabled:INCOPS III"
"C:\WINDOWS\incops3\icsng.exe"="C:\WINDOWS\INCOPS3\ICSNG.EXE:*:Enabled:INCOPS IS"
"C:\WINDOWS\incops3\icourl.exe"="C:\WINDOWS\INCOPS3\ICOURL.EXE:*:Enabled:INCOPS IU"
"C:\WINDOWS\incops3\pc2link.exe"="C:\WINDOWS\INCOPS3\PC2LINK.EXE:*:Enabled:INCOPS PC2LINK"
"C:\WINDOWS\incops3\pc2links.exe"="C:\WINDOWS\INCOPS3\PC2LINKS.EXE:*:Enabled:INCOPS PC2LINKS"
"C:\WINDOWS\incops3\pcftp.exe"="C:\WINDOWS\INCOPS3\PCFTP.EXE:*:Enabled:INCOPS PCFTP"
"C:\WINDOWS\incops3\pc_mail.exe"="C:\WINDOWS\INCOPS3\PC_MAIL.EXE:*:Enabled:INCOPS PC-MAIL"
"C:\WINDOWS\incops3\ivpatch.exe"="C:\WINDOWS\INCOPS3\IVPATCH.EXE:*:Enabled:INCOPS UPDATE"
"C:\WINDOWS\incops3\icvsetup.exe"="C:\WINDOWS\INCOPS3\ICVSETUP.EXE:*:Enabled:INCOPS VACCINE"
"C:\WINDOWS\incops3\icvupdo.exe"="C:\WINDOWS\INCOPS3\ICVUPDO.EXE:*:Enabled:INCOPS VERUP"
"C:\WINDOWS\incops3\wpatchdo.exe"="C:\WINDOWS\INCOPS3\WPATCHDO.EXE:*:Enabled:INCOPS WPDLG"
"C:\WINDOWS\incops3\wpatchrb.exe"="C:\WINDOWS\INCOPS3\WPATCHRB.EXE:*:Enabled:INCOPS WPRBT"
"C:\WINDOWS\incops3\wpatchdn.exe"="C:\WINDOWS\INCOPS3\WPATCHDN.EXE:*:Enabled:INCOPS WPSIG"
"C:\WINDOWS\incops3\pmsAgent.exe"="C:\WINDOWS\incops3\pmsAgent.exe:*:Enabled:INCOPS PMS"
"C:\WINDOWS\twain_32\Samsung\CLX6200\Scan2Pc.exe"="C:\WINDOWS\twain_32\Samsung\CLX6200\Scan2Pc.exe:*:Enabled:ScanToPC"
"C:\WINDOWS\twain_32\Samsung\CLX6200\Sscan2io.exe"="C:\WINDOWS\twain_32\Samsung\CLX6200\Sscan2io.exe:*:Enabled:SScanToIO"
"C:\PROGRA~1\FICHIE~1\MICROW~1\Agent\MWAGENT.EXE"="C:\PROGRA~1\FICHIE~1\MICROW~1\Agent\MWAGENT.EXE:*:Enabled:MicroWorld Management Agent"
"C:\PROGRA~1\FICHIE~1\MICROW~1\eScanRAD\ESCANRAD.EXE"="C:\PROGRA~1\FICHIE~1\MICROW~1\eScanRAD\ESCANRAD.EXE:*:Enabled:eScan Remote Administration Tool"
"C:\Program Files\WinPhone Ultimate Edition\winphone.exe"="C:\Program Files\WinPhone Ultimate Edition\winphone.exe:*:Enabled:Winphone"
"C:\Program Files\WinPhone Ultimate Edition\BvrpKrnl.exe"="C:\Program Files\WinPhone Ultimate Edition\BvrpKrnl.exe:*:Enabled:Bvrpkrnl"
"C:\Program Files\Foxit Software\PDF Editor\PDFEdit.exe"="C:\Program Files\Foxit Software\PDF Editor\PDFEdit.exe:*:Enabled:Foxit PDF Editor, the first REAL editor for PDF files!"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\WINDOWS\system32\muzapp.exe"="C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player"
"G:\ACTStart\Cassini\1.1\CassiniWebServer.exe"="G:\ACTStart\Cassini\1.1\CassiniWebServer.exe:*:Enabled: "
"C:\Program Files\CCP Systems\JScribe Software Development Kit 4.1\jsdk.exe"="C:\Program Files\CCP Systems\JScribe Software Development Kit 4.1\jsdk.exe:*:Enabled:JScribe Software Development Kit Application"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\Program Files\FileZilla Client\filezilla.exe"="C:\Program Files\FileZilla Client\filezilla.exe:*:Enabled:FileZilla FTP Client"
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"="C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"="C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Spamihilator\cdcc.exe"="C:\Program Files\Spamihilator\cdcc.exe:*:Enabled:Spamihilator DCC Filter Configuration"
"C:\Program Files\Spamihilator\dccproc.exe"="C:\Program Files\Spamihilator\dccproc.exe:*:Enabled:Spamihilator DCC Filter"
"C:\Program Files\Spamihilator\spamihilator.exe"="C:\Program Files\Spamihilator\spamihilator.exe:*:Enabled:Spamihilator"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe"="C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\java.exe"="C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adbc625f-a9b9-11dd-ae51-001b7735c6bf}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL website\index.html

======List of files/folders created in the last 1 months======

2009-03-10 17:03:39 ----D---- C:\Program Files\SuperCopier2
2009-03-10 16:33:28 ----D---- C:\WINDOWS\4DCA27399D164B55808CE72CD70A5BD3.TMP
2009-03-09 19:42:24 ----SHD---- C:\Config.Msi
2009-03-09 17:30:41 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-03-09 17:09:46 ----D---- C:\Program Files\Common Files
2009-03-09 14:48:44 ----D---- C:\_OTMoveIt
2009-03-09 14:40:26 ----D---- C:\ComboFix
2009-03-09 14:31:17 ----SHD---- C:\RECYCLER
2009-03-09 14:00:41 ----D---- C:\Program Files\PDM
2009-03-07 18:59:41 ----D---- C:\Program Files\FindyKill
2009-03-07 17:40:27 ----RASHD---- C:\cmdcons
2009-03-07 10:04:16 ----D---- C:\Documents and Settings\d.pelletier\Application Data\com.adobe.example.widget-programmes.40247E01796E652D304FB5752B197AB47987A585.1
2009-03-06 20:05:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-03-06 18:34:42 ----SHD---- C:\$RECYCLE.BIN
2009-03-06 15:15:30 ----D---- C:\rsit
2009-03-06 14:31:28 ----A---- C:\WINDOWS\system32\javaws.exe
2009-03-06 14:31:28 ----A---- C:\WINDOWS\system32\javaw.exe
2009-03-06 14:31:28 ----A---- C:\WINDOWS\system32\java.exe
2009-03-06 14:31:28 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-03-06 10:08:26 ----A---- C:\WINDOWS\system32\d74e65cc-.txt
2009-03-06 09:24:53 ----D---- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
2009-03-05 17:36:22 ----D---- C:\Program Files\ImageMagick-6.3.6-Q16
2009-03-05 17:33:39 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
2009-03-05 16:42:54 ----D---- C:\Documents and Settings\All Users\Application Data\Anoto
2009-03-05 16:42:22 ----D---- C:\Program Files\Fichiers communs\Logitech
2009-03-05 16:42:22 ----D---- C:\Program Files\Anoto
2009-03-05 16:10:49 ----D---- C:\Documents and Settings\d.pelletier\Application Data\anoto
2009-03-05 16:00:58 ----D---- C:\Anotopgc
2009-03-05 16:00:12 ----D---- C:\Program Files\Fichiers communs\Anoto
2009-02-27 18:44:46 ----A---- C:\WINDOWS\system32\epoPGPsdk.dll.sig
2009-02-27 18:44:46 ----A---- C:\WINDOWS\system32\epoPGPsdk.dll
2009-02-25 11:14:53 ----D---- C:\Documents and Settings\d.pelletier\Application Data\WinRAR
2009-02-25 09:37:12 ----A---- C:\WINDOWS\system32\fphstat.dll
2009-02-25 09:37:05 ----A---- C:\WINDOWS\system32\f_rc12.dll
2009-02-25 09:37:05 ----A---- C:\WINDOWS\system32\f_rc09.dll
2009-02-25 09:36:44 ----D---- C:\WINDOWS\system32\IOSUBSYS
2009-02-25 09:36:43 ----A---- C:\WINDOWS\system32\f_rc0c.dll
2009-02-24 14:53:58 ----D---- C:\Documents and Settings\All Users\Application Data\InstallShield
2009-02-24 14:53:19 ----D---- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2009-02-23 17:45:13 ----H---- C:\Documents and Settings\d.pelletier\Application Data\swk.ini
2009-02-20 15:38:18 ----A---- C:\WINDOWS\zipinst.exe
2009-02-19 12:24:05 ----D---- C:\test
2009-02-17 16:12:34 ----D---- C:\Program Files\Fichiers communs\ROUTE 66

======List of files/folders modified in the last 1 months======

2009-03-10 20:07:50 ----D---- C:\WINDOWS\Prefetch
2009-03-10 20:07:43 ----D---- C:\Program Files\HijackThis
2009-03-10 20:05:50 ----D---- C:\WINDOWS\Tempinternet
2009-03-10 20:03:59 ----D---- C:\WINDOWS\system32
2009-03-10 20:03:59 ----D---- C:\WINDOWS\incops3
2009-03-10 20:03:57 ----D---- C:\WINDOWS\TEMP
2009-03-10 20:01:11 ----D---- C:\WINDOWS
2009-03-10 18:28:33 ----D---- C:\Documents and Settings\d.pelletier\Application Data\Spamihilator
2009-03-10 18:28:19 ----A---- C:\WINDOWS\mySingle.ini
2009-03-10 18:27:37 ----D---- C:\Program Files\Mozilla Firefox 3
2009-03-10 17:24:35 ----D---- C:\Program Files\ALZip
2009-03-10 17:24:06 ----D---- C:\Program Files\Microsoft ActiveSync
2009-03-10 17:03:39 ----D---- C:\Program Files
2009-03-10 11:58:00 ----D---- C:\Program Files\Mozilla Thunderbird
2009-03-10 11:11:52 ----D---- C:\WINDOWS\security
2009-03-10 10:23:53 ----D---- C:\Program Files\Adobe
2009-03-10 10:19:50 ----D---- C:\Documents and Settings
2009-03-10 10:19:13 ----D---- C:\QUARANTINE
2009-03-10 10:16:53 ----SHD---- C:\WINDOWS\Installer
2009-03-10 09:36:12 ----AH---- C:\WINDOWS\system32\si32ic.ini
2009-03-10 07:29:26 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-03-10 07:22:36 ----A---- C:\WINDOWS\system32\tmp.txt
2009-03-09 19:49:25 ----D---- C:\Program Files\Aspell
2009-03-09 19:47:14 ----D---- C:\Program Files\Fichiers communs
2009-03-09 19:42:41 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee
2009-03-09 19:42:31 ----D---- C:\WINDOWS\system32\drivers
2009-03-09 19:23:30 ----D---- C:\WINDOWS\system32\CatRoot2
2009-03-09 18:19:30 ----RASH---- C:\boot.ini
2009-03-09 18:19:30 ----A---- C:\WINDOWS\win.ini
2009-03-09 18:19:30 ----A---- C:\WINDOWS\system.ini
2009-03-09 17:59:41 ----D---- C:\WINDOWS\pss
2009-03-09 17:54:15 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-09 17:50:23 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-03-09 17:46:30 ----SHD---- C:\WINDOWS\CSC
2009-03-09 14:41:11 ----SHD---- C:\System Volume Information
2009-03-09 14:41:11 ----D---- C:\WINDOWS\system32\Restore
2009-03-09 14:40:46 ----D---- C:\WINDOWS\erdnt
2009-03-09 09:34:08 ----D---- C:\Program Files\Network Associates
2009-03-09 09:31:09 ----D---- C:\Program Files\Fichiers communs\Network Associates
2009-03-08 23:37:22 ----D---- C:\WINDOWS\inf
2009-03-08 22:11:05 ----D---- C:\WINDOWS\BDOSCAN8
2009-03-08 19:10:34 ----D---- C:\Program Files\Navilog1
2009-03-07 17:49:01 ----D---- C:\WINDOWS\system32\config
2009-03-07 17:46:20 ----D---- C:\WINDOWS\AppPatch
2009-03-07 15:17:51 ----DC---- C:\WINDOWS\system32\dllcache
2009-03-07 13:58:06 ----SD---- C:\WINDOWS\Tasks
2009-03-07 13:51:58 ----D---- C:\Documents and Settings\d.pelletier\Application Data\Samsung
2009-03-07 13:41:55 ----A---- C:\WINDOWS\ODBC.INI
2009-03-07 10:49:21 ----D---- C:\Program Files\Microsoft Visual Studio 8
2009-03-07 10:49:20 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
2009-03-07 10:48:26 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-03-07 10:37:48 ----RSD---- C:\WINDOWS\assembly
2009-03-07 09:51:16 ----D---- C:\Program Files\SAMSUNG
2009-03-07 01:09:01 ----HD---- C:\Documents and Settings\All Users\Application Data\catalog.wci
2009-03-06 20:26:06 ----D---- C:\Program Files\OpenAL
2009-03-06 20:05:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-03-06 19:53:55 ----D---- C:\Program Files\Microsoft Visual Studio 9.0
2009-03-06 16:45:41 ----D---- C:\WINDOWS\Minidump
2009-03-06 16:45:41 ----D---- C:\WINDOWS\Debug
2009-03-06 16:42:05 ----D---- C:\Program Files\CCleaner
2009-03-06 14:30:27 ----D---- C:\Program Files\Java
2009-03-06 10:06:14 ----D---- C:\WINDOWS\Microsoft.NET
2009-03-05 18:16:09 ----D---- C:\WINDOWS\system32\Setup
2009-03-04 18:00:47 ----D---- C:\WINDOWS\system32\NtmsData
2009-03-04 13:23:55 ----D---- C:\WINDOWS\Downloaded Installations
2009-03-02 14:29:39 ----D---- C:\Documents and Settings\d.pelletier\Application Data\VMware
2009-02-27 18:22:26 ----A---- C:\WINDOWS\NeroDigital.ini
2009-02-25 09:37:22 ----A---- C:\WINDOWS\Uninstall.ini
2009-02-25 09:10:00 ----D---- C:\WINDOWS\$hf_mig$
2009-02-24 14:53:44 ----D---- C:\Program Files\Fichiers communs\InstallShield
2009-02-23 15:48:08 ----A---- C:\WINDOWS\system32\NamoWec6_samsung_mysingle_eaa9a9b9.ini
2009-02-20 15:36:59 ----A---- C:\WINDOWS\MDSEX.ini
2009-02-20 15:36:59 ----A---- C:\WINDOWS\Alea.ini
2009-02-20 15:32:45 ----N---- C:\WINDOWS\Setup1.exe
2009-02-20 15:32:40 ----A---- C:\WINDOWS\ST6UNST.EXE
2009-02-20 09:31:02 ----D---- C:\Documents and Settings\d.pelletier\Application Data\skypePM
2009-02-19 21:43:22 ----D---- C:\Documents and Settings\d.pelletier\Application Data\Skype
2009-02-13 14:50:03 ----D---- C:\Program Files\Internet Explorer
2009-02-13 11:59:21 ----D---- C:\WINDOWS\ie7updates
2009-02-12 05:56:17 ----A---- C:\WINDOWS\system32\MRT.exe
2009-02-11 14:29:25 ----D---- C:\Documents and Settings\d.pelletier\Application Data\FileZilla

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 hwinterface;hwinterface; C:\WINDOWS\System32\Drivers\hwinterface.sys [2007-10-18 3026]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2008-09-17 5632]
R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
R2 CVPNDRV;SAMSUNG NETWORKS IPsec Driver; \??\C:\WINDOWS\system32\Drivers\CVPNDRV.sys []
R2 DOSMEMIO;MEMIO; \??\C:\WINDOWS\system32\MEMIO.SYS []
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2005-10-25 140288]
R3 AEAudioService;AEAudio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2005-06-07 152960]
R3 AgereSoftModem;SENS LT56ADW Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-06-29 1160320]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-07-22 134272]
R3 btaudio;Périphérique audio Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys [2006-10-15 329901]
R3 BTDriver;Pilote de communications virtuelles Bluetooth; C:\WINDOWS\system32\DRIVERS\btport.sys [2006-10-10 30459]
R3 BTKRNL;Enumérateur de bus Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2006-11-28 863402]
R3 BTWDNDIS;Serveur d'accès au réseau local Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2006-10-15 149123]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-03-27 47272]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 DNE;Deterministic Network Enhancer Miniport; C:\WINDOWS\system32\DRIVERS\dne2000.sys [2002-01-09 128380]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-12-14 1354620]
R3 NETw3x32;Pilote de carte réseau Intel(R) PRO/Wireless 3945ABG pour Windows XP 32 bits; C:\WINDOWS\system32\DRIVERS\NETw3x32.sys [2006-09-27 1709696]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-07-01 9856]
R3 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928]
R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-11-01 51584]
R3 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-11-01 308992]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-12-06 220032]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 wowfilter;WOW XT Filter Driver; C:\WINDOWS\system32\drivers\wowfilter.sys [2005-11-28 19456]
S1 4783b148;4783b148; C:\WINDOWS\System32\drivers\4783b148.sys []
S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
S2 DgiVecp;DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys []
S3 agnc9o97;agnc9o97; C:\WINDOWS\system32\drivers\agnc9o97.sys []
S3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2006-05-17 44544]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 EntDrv51;EntDrv51; \??\C:\WINDOWS\system32\drivers\EntDrv51.sys []
S3 f_kp;f_kp; \??\C:\WINDOWS\system32\drivers\f_kp.sys []
S3 GT72NDISIPXP;GT 72 IP NDIS; C:\WINDOWS\system32\DRIVERS\Gt51Ip.sys [2008-02-18 106624]
S3 GT72UBUS;GT 72 U BUS; C:\WINDOWS\system32\DRIVERS\gt72ubus.sys [2008-02-08 59648]
S3 GTPTSER;GT PT SER; C:\WINDOWS\system32\DRIVERS\gtptser.sys [2007-03-30 8064]
S3 HdAudAddService;Pilote de fonction Microsoft UAA pour Service High Definition Audio; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 neokdss;neokdss; C:\WINDOWS\system32\Drivers\neokdss.sys []
S3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 nm;Pilote du Moniteur réseau; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-12-08 3611168]
S3 PalmUSBD;PalmUSBD; C:\WINDOWS\system32\drivers\PalmUSBD.sys [2007-09-12 16694]
S3 Phal;Phal - Logitech io2 USB driver; C:\WINDOWS\System32\Drivers\LPhalUsb.sys [2005-03-07 56832]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-05 5888]
S3 sffdisk;Pilote de classe de stockage SFF; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
S3 sffp_sd;Pilote de protocole de stockage SFF pour SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 58320]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 8304]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 94000]
S3 SSB2413;SSB2413 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\SSB2413.sys [2006-01-16 470112]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2007-07-03 80552]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2007-07-03 11944]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2007-07-03 106792]
S3 sscdserd;SAMSUNG Mobile Modem Diagnostic Serial Port (WDM); C:\WINDOWS\system32\DRIVERS\sscdserd.sys [2007-07-03 86824]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2005-08-30 58320]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2005-08-30 8336]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2005-08-30 94000]
S3 TSP;TSP; \??\C:\WINDOWS\system32\drivers\klif.sys []
S3 usb_rndisx;Carte ISDN USB; C:\WINDOWS\system32\DRIVERS\usb8023x.sys [2008-04-13 12800]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 wceusbsh;Windows CE USB Serial Host Driver; C:\WINDOWS\system32\DRIVERS\wceusbsh.sys [2004-12-30 104576]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 mchInjDrv;mchInjDrv; \??\C:\DOCUME~1\D4C71~1.PEL\LOCALS~1\Temp\mc22.tmp []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2006-12-11 266295]
R2 CVPND;Cisco Systems, Inc. VPN Service; C:\program Files\Cisco Systems\VPN Client\cvpnd.exe [2002-09-03 1282112]
R2 gateman;gateman; C:\WINDOWS\incops3\gateman.exe [2007-03-21 57344]
R2 GtDetectSc;GtDetectSc; C:\Program Files\Option\GlobeTrotter Mobility Manager\GtDetectSc.exe [2007-12-18 196704]
R2 javaquickstarterservice;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-06 152984]
R2 McAfeeFramework;Service McAfee Framework; C:\Program Files\Network Associates\Common Framework\FrameworkService.exe [2008-03-14 103744]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe [2003-06-20 322120]
R2 MWAgent;MWAgent; C:\Program Files\Fichiers communs\MicroWorld\Agent\MWASER.EXE [2007-12-13 415232]
R2 PenRendezvous;Digital Pen rendezvous server; C:\Program Files\Fichiers communs\Logitech\Pen\Phal\Service\LPhal.exe [2005-11-09 397312]
R2 PenSup;Digital Pen Socket to USB protocol; C:\Program Files\Fichiers communs\Logitech\Pen\Phal\Service\LPhal.exe [2005-11-09 397312]
R2 SNM WLAN Service;SNM WLAN Service; C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe [2005-05-28 36864]
R2 SRS_PostInstaller;SRS PostInstaller Service; C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe [2005-11-28 31744]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 BMUService;Memeo; C:\Program Files\Tanagra\Memeo\MemeoService.exe [2005-12-19 192512]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-12-08 143426]
S2 Samsung Update Plus;Samsung Update Plus; C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe [2006-07-21 57344]
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 GTMM Device Service;GTMM Device Service; C:\Program Files\Option\GlobeTrotter Mobility Manager\GtmmDeviceService.exe [2008-03-05 106496]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe [2006-06-20 49152]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PcounterData;Pcounter Data Server; C:\WINDOWS\System32\PCNTDATA.EXE [2007-11-27 306688]
S3 PcounterPrint;Pcounter Printer Control; C:\WINDOWS\System32\PCOUNTER.EXE [2007-11-27 368640]
S3 PSEXESVC;PsExec; C:\WINDOWS\PSEXESVC.EXE []
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S4 winfil32;winfil32; C:\WINDOWS\system32\winfil32.exe [2006-09-14 77824]

-----------------EOF-----------------

Réponse 31 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

- Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (Avec Internet Explorer)

- En bas à droite, clique sur Démarrer Online-scanner

- Dans la nouvelle fenêtre qui s'affiche, clique sur J'accepte

- Accepte les Contrôles ActiveX

- Choisis Poste de travail pour le scan.

- Celui-ci terminé, sauvegarde (Choisis fichier texte) et poste le rapport

- Pour t'aider à utiliser le scan en ligne :
https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.

Réponse 32 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Et voilà le rapport:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Wednesday, March 11, 2009 6:44:24 AM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 10/03/2009
Enregistrements dans la base antivirus Kaspersky : 1704203
-------------------------------------------------------------------------------

Paramètres d'analyse:
Analyser avec la base antivirus suivante: standard
Analyser les archives: vrai
Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
C:\
D:\
Z:\

Statistiques de l'analyse:
Total d'objets analysés: 80778
Nombre de virus trouvés: 1
Nombre d'objets infectés: 1 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 05:11:25

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\admin\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\admin\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_PELLETIERX11.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_PELLETIERX11_error.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.14.Crwl L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.14.gthr L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.ci L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wsb L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010012.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010014.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001D.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010024.wid L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy40.gthr L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_354.dat L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\.housecall6.6\Quarantine\qrtqddo.exe.bac_a01464 Infecté : Trojan.Win32.Obfuscated.aqn ignoré
C:\Documents and Settings\d.pelletier\Application Data\$_hpcst$.hpc L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Application Data\Adobe\Acrobat\8.0\Updater\updater.log L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Application Data\Adobe\Updater5\aumLib.log L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Historique\History.IE5\MSHist012009031020090311\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Temp\AVP43E.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Temp\AVP43F.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Temp\WCESLog.log L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Temporary Internet Files\Content.IE5\E4Y9Y7S6\pub_worldgame[1].swf L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\Local Settings\Temporary Internet Files\Content.IE5\W2BQ83DE\dmplayer-fr[1].swf L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\d.pelletier\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\SEFAdmin\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\SEFAdmin\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
C:\System Volume Information\_restore{99A4FE25-ED57-4AAB-BC10-3A50C8D400E9}\RP11\change.log L'objet est verrouillé ignoré
C:\WINDOWS\CSC\00000001 L'objet est verrouillé ignoré
C:\WINDOWS\Debug\Netlogon.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Canal+.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\ODiag.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\OSession.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\drivers\sptd.sys L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\TEMP\Perflib_Perfdata_5bc.dat L'objet est verrouillé ignoré
C:\WINDOWS\TEMP\Perflib_Perfdata_e4.dat L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

Analyse terminée.

Réponse 33 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

Salut,

- De quelle quarantaine s'agit-il ? >>
C:\Documents and Settings\d.pelletier\.housecall6.6\Quarantine\qrtqddo.exe.bac_a01464 Infecté : Trojan.Win32.Obfuscated.aqn ignoré

- regardes dans la quarantaine de ton antivirus et vides là

- Pour Fasoo, que comptes tu en faire ? >> si tu continues a utiliser de tels programmes, ton pc sera reinfecté

- Fermes toutes les applications en cours et deconnectes toi

- Lances Hijackthis et clic sur " Do a scan Only " et coches les lignes ci-dessous :

O20 - AppInit_DLLs: mnhbvp.dll
O20 - Winlogon Notify: wlic3 - C:\WINDOWS\SYSTEM32\WLIC3Pk.dll
O20 - Winlogon Notify: yayxvWQK - yayxvWQK.dll (file missing)

et clic sur Fix Checked

Ensuite, des applications telles que Java ou adobe non à jour >> failles de sécurité

* Mets Adobe à jour : ( n'installes pas la barre d'outil google, décoches la)
https://get2.adobe.com/reader/otherversions/

---------------------
* Installes la dernière version de Java :
https://www.java.com/fr/download/manual.jsp

-------------------
* Une fois à jour, télécharges JavaRa.zip
http://raproducts.org/click/click.php?id=1
---> Autorise le processus a se connecter si il te le demande
. Cliques sur Install et suis les instructions

- Quand l'installation est finie, reviens à l'écran JavaRa

-Clic sur " Remove Old Versions " ou " recherches d'anciennes versions " --> cliques sur " oui "

-l'outil va travailler, cliques ensuite sur " Ok " et à nouveau sur Ok

- Un rapport s'ouvrira, refermes l'application puis postes le

* Afin de mettre à jour les applications de ton pc et de verifier leur vulnerabilité, Installes le PCI de secunia :

https://www.flexera.com/products/operations/software-vulnerability-management.html

aides toi du tuto :

https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/
.

Réponse 34 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Les réponses à tes questions:

- De quelle quarantaine s'agit-il ? >>
C:\Documents and Settings\d.pelletier\.housecall6.6\Quarantine\qrtqddo.exe.bac_a01464 Infecté : Trojan.Win32.Obfuscated.aqn ignoré ----> Il s'agit de la quarantaine du scan en ligne de trend micro.

- regardes dans la quarantaine de ton antivirus et vides là ----> Vidé

- Pour Fasoo, que comptes tu en faire ? >> si tu continues a utiliser de tels programmes, ton pc sera reinfecté ----> J'ai peur de ne pas avoir le choix, c'est utilisé par nos systèmes et si je le vire, il va se réinstaller. Le mieux que je peux faire est de signaler le danger à notre admin.

De même, je vais devoir réinstaller McAfee même si ce n'est pas le meilleur des AV car c'est la politique maison.

Réponse 35 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

OK, profites-en pour lui montrer ceci ( ce n'est que pour Malwarebytes) :

-------- FASOO-----------

Processus mémoire infecté(s):
C:\Program Files\Fasoo DRM\fpm.exe (Trojan.BHO) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Program Files\Fasoo DRM\f_blksc.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_xlus.dll (Trojan.BHO) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\f_webdc.xwebdc (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{487b489f-95c2-44c1-b31f-f7fd71ffa5be} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3474531e-ccf0-494b-8ec5-254e93effaf9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4aaa2f98-2d2f-4938-afb1-3ec1b51c41d9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4aaa2f98-2d2f-4938-afb1-3ec1b51c41d9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4aaa2f98-2d2f-4938-afb1-3ec1b51c41d9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\f_webdc.xwebdc.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{1de3791c-e723-447a-a402-37fd2f133750} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d827611e-de82-4010-b6d6-1df3f63f5065} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{a7e8de60-4dea-11d6-a03d-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a7e8de6c-4dea-11d6-a03d-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5e705a09-557a-4ceb-8177-c94e0400c902} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b4c942e7-57d6-41fd-bb18-15c077179dcc} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{72917d60-46aa-11d6-a038-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{72917d6d-46aa-11d6-a038-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{72917d6e-46aa-11d6-a038-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{236cc5e0-d591-442b-a070-0e2bc4d707e8} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{80fb062c-3d5d-11d6-a031-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1687b15d-e5fd-47a7-8a3a-0ed326a54fa7} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1687b15d-e5fd-47a7-8a3a-0ed326a54fa7} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{f7e4275d-81cb-4cc9-bf45-cc3b86eb9570} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{da74df6a-4b0b-4e42-9166-290b56239b69} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1773a6ae-93d3-4ce2-9965-ae29f1e59db1} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{49086551-9514-11d5-9772-0090273528bb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dd846afe-9557-11d5-9772-0090273528bb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dd846b02-9557-11d5-9772-0090273528bb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{3a48d2b8-2ea5-418a-a4d4-52b6bbfc7e95} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{81abbbb2-c869-4e35-ae7a-583b470d3ed9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{a77c1658-358a-484a-ac86-bcfc0ef1d216} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{979e5fcf-eb94-4532-adc7-dcbe57dc1203} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{da3144f1-fce0-4012-a289-e4ceada25ee6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{d55001f0-20eb-11d6-a01a-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d55001fd-20eb-11d6-a01a-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e547fb26-f94d-4b3c-99cb-c65003542a0a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e9b499c0-539b-11d6-a044-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{94768d6c-32eb-4db4-ac31-a3b6181adef5} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4d4e0637-5d6e-4f4c-823d-82efc637541a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fde46f8c-d05c-43d3-81dd-06e17bb7060d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{952eb86c-14bf-4cff-bb1b-af65b473bc5d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{372b030e-ff2e-4c43-952f-fd02a5fbe1a9} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b04a9325-39b1-414d-8923-0186fca1c40a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{30a39e90-1c8a-4ea4-8733-8c3dd0818281} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{30a39e90-1c8a-4ea4-8733-8c3dd0818281} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{30a39e90-1c8a-4ea4-8733-8c3dd0818281} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{a82eed52-7466-4fb6-b8b5-1107c1828b4f} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e467ddd-f8a8-4845-acdf-775746a79725} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{934cefdc-e880-446f-880f-6560f613d8aa} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{934cefdc-e880-446f-880f-6560f613d8aa} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{934cefdc-e880-446f-880f-6560f613d8aa} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e4159d60-810b-4f8c-aaa0-7aa8aa18faac} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{087aac2c-6ce2-4518-9dc2-729244730629} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4feba4f2-1906-44bb-b269-7b5a4ae8cc6d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4feba4f2-1906-44bb-b269-7b5a4ae8cc6d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4feba4f2-1906-44bb-b269-7b5a4ae8cc6d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{26904ce0-3007-11d6-a025-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{26904ced-3007-11d6-a025-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{02443f1f-2ff1-11d6-a025-00d0b7909b4d} (Trojan.BHO) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\Fasoo DRM (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\Log (Trojan.BHO) -> Quarantined and deleted successfully.

C:\Program Files\Fasoo DRM\f_webdc.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\FasooAcrobatManager4x.api (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\FasooAcrobatManager5x.api (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\fph.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\fpm.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\fsmLoader.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_agent.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_ai.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_blksc.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_cie.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_cie_ep_sso.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_cm.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_dc.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_diag.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_dm.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_dn.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_info.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_kcl(htmlviewer).fac (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_pm.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\Fasoo DRM\f_smgbd.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_sps.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_swv.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_ver.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_vh.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_vi.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_vt.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_webdm.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_websn.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\f_xlus.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\InstAcro.exe (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\SMGBD.dll (Trojan.BHO) -> Delete on reboot.
C:\Program Files\Fasoo DRM\Log\101.log (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\Fasoo DRM\Log\21.log (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\Fasoo DRM\Log\70.log (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\Fasoo DRM\Log\f_1507.log (Trojan.BHO) -> Quarantined and deleted successfully.

- Sinon, as tu fais le reste ?
.

Réponse 36 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Voilà le rapport JavaRa:

JavaRa 1.13 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Mar 11 12:12:35 2009

Found and removed: C:\Program Files\Java\jre1.5.0

Found and removed: C:\Program Files\Java\jre1.6.0_02

Found and removed: C:\Program Files\Java\jre1.6.0_03

Found and removed: Software\JavaSoft\Java2D\1.5.0

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510000

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510000

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510000

Found and removed: SOFTWARE\Classes\JavaPlugin.150

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510000

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510000

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150000}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\JavaPlugin.160_02

Found and removed: SOFTWARE\Classes\JavaPlugin.160_03

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_02

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_02

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610002

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610002

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160020}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0

Found and removed: Software\Classes\JavaPlugin.160_02

Found and removed: Software\Classes\JavaPlugin.160_03

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_03

Found and removed: Software\JavaSoft\Java2D\1.6.0_01

Found and removed: Software\JavaSoft\Java2D\1.6.0_02

Found and removed: Software\JavaSoft\Java2D\1.6.0_03

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_02

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_02\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_02\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\bin\

------------------------------------

Finished reporting.

Je vais tenter de faire la partie secunia tout de suite mais je vais partir en clientèle alors c'est pas gagné. Je te tiens au courant/

Réponse 37 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

Suite au scan, j'ai mis à jour la plupart des applis qui ne l'étaient pas. Il reste deux versions de Flash Player 9 que je ne sais pas comment mettre à jour vu qu'il détecte aussi une version 10.

Il m'indique aussi une erreur dans la rubrique Error with the scan mais le message n'est pas très détaillé: "An error occured while searching for missing windows updates".

Dois-je faire autre chose?

Réponse 38 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

pour flashplayer ici : https://get.adobe.com/flashplayer/?loc=fr

- Pour terminer correctement, fais ceci :
- Desactives la garde de ton antivirus
- Fermes toutes les applications en cours et double clic sur OTMoveIT
- Assures toi que la case " Unregister Dll's and ocx's " soit bien cochée et copie ( ctrl+ C) ce qui est ci dessous " :

:processes
explorer.exe

:reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2
\{adbc625f-a9b9-11dd-ae51-001b7735c6bf}]

:commands
[purity]
[emptytemp]
[reboot]

- Colles les ( CTRL + V) dans le cadre de gauche OTMoveIt nommé : " Past List of Files\Folders to be moved "
- Clic sur " Moveit! " pour lancer la suppression et laisse l'outil travailler
- Ton bureau va disparaitre, c'est normal...
- Lorque le resultat apparait dans le cadre " results " cliques sur " Exit "
- Otmoveit devra peut etre redemarrer le pc pour finir la suppression, clic sur " yes " si cela s'avère utile...

- Le rapport se trouve à C:\_OtmoeIt\Moved Files\x x x x x x.log
.

___________________________

Réponse 39 / 41

toast3r Messages postés 68 Date d'inscription Statut Membre Dernière intervention

J'ai fait la mise à jour de flash mais il me trouve toujours 2 versions de Flash 9.

Par contre, même soucis que la dernière fois avec OTMoveit. Il est bloqué et ne réponds plus, donc je ne pas cliquer sur exit et je n'ai pas de rapport.

Réponse 40 / 41

Ced_King Messages postés 3519 Date d'inscription Statut Contributeur Dernière intervention 572

- Telecharges Toolscleaner2 sur ton bureau : http://pc-system.fr/

- Cliques sur " Recherche " et patientes
- Ciques ensuites sur supprimer " pour finaliser
- Clic sur exit >> un rapport sera généré, postes son contenu

_____________

- Ouvres Ccleaner et clic sur " Nettoyeur " >> lances une analyse et le nettoyage
- Clic ensuite sur " Registres " >> Chercher des erreurs >> reparer les erreurs >> recommences jusqu'à 0 erreurs ( sauvegarde le registre, tu le supprimeras d'ici 2 à 3 jours)

_________________

- Comment va le pc ? pour un nettoyage optimal >

- Purges la restauration systeme :

Désactive la restauration système sur tous les lecteurs :

- Clique droit sur le Poste de travail sur le bureau, dans propriété tu cliques sur l'onglet Restauration système

- Coche la case désactiver la restauration et applique

Redémarre l’ordinateur puis réactive la restauration système.

Tutoriel : http://www.libellules.ch/desactiver_restauration.php

____________________

Si tu estimes que ton problème est réglé, penses a mettre le topic en resolu >> en haut de la page..

- Bonne continuation et prudence !
.

Infection

41 réponses

Votre réponse

Discussions similaires