VIRUS USB + MAJ impossible Antivirus Résolu

Question

Bonjour,

Je sais qu'il existe bien des topic sur ce virus, néanmoins je ne m'en sort pas...
Mon PC est infecté par le virus "au travail" ( déclenché par le processus "wscript.exe" ) et semble contaminer tous mes périphérique USB, dont mon HDD externe ... Je cherche donc la solution pour nettoyer mes periphérique de ce virus.

Pour mon pc je compte formater, car mes pages Google sont redirigé, impossible d'installer Spybot ( "error sending request" lors de l'install ) les mises à jours de mon antivirus sont bloqués ( j'ai testé 3 antivirus differents, et le constat est le meme...) bref, ça devient impossible a gérer.

Si quelqu'un connais la solutions pour m'éviter de formater je suis preneur ! ( sachant que le mode sans échec de mon pc ne fonctionne plus...)

Merci de votre aide !!

Mmsl35_ · Answer

Salut

>>>>>>Envoie un log hijackthis -- stp

F - Hijackthis - Outil de diagnostic et réparation

télécharge HijackThis ici: https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html
https://kerio.probb.fr/

Dézippe le dans un dossier prévu à cet effet.
	Par exemple C:\hijackthis < Enregistre le bien dans c : !
	Démo : (Merci a Balltrap34 pour cette réalisation)
	http://pageperso.aol.fr/balltrap34/Hijenr.gif

Lance le puis: clique sur "do a system scan and save logfile" (cf démo)

faire un copier coller du log entier sur le forum

	Démo : (Merci a Balltrap34 pour cette réalisation)
	http://pageperso.aol.fr/balltrap34/demohijack.htm
	http://www.tutoriaux-excalibur.com/hijackthis.htm
	https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html 


as tu essayé les antivirus en ligne?

NONO · Answer

Merci pour la réponse rapide ! 

Je n'ai pas encore essayer les antivirus en ligne non.

Voila le rapport de HiJackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:55:48, on 09/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscript.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Travaillez plus.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = google.net-studio.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Au travail !Arrêtez de surfer!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\antinul.vbe
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\MediaCenter\LaunchList.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [gfhfyqjjkj] c:\documents and settings\fabien\local settings\application data\gfhfyqjjkj.exe gfhfyqjjkj
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
O4 - Startup: Y'z Toolbar.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WiFi Station.lnk = ?
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O20 - AppInit_DLLs: karna.dat
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

SeiFeR_HxC · Answer

Quelqu'un peut m'aider avec ce rapport ? 

Merci..


(je suis nono )

Mmsl35_ · Answer

salut 

--> Télécharge UsbFix (de Chiquitine29) sur ton Bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix sur ton Bureau.

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide) 


puis tu refait un nouveau rapport HiJackThis .

SeiFeR_HxC · Answer

Salut ! 

Le lien pour USBFIX est mort, et je ne le trouve meme pas sur google =(
Aurai-tu un autre lien?


Merci !

Mmsl35_ · Answer

salut oups dezolé! je vient de voir que son téléchargement a été suspendu!

pour vacciner tes clés usb et disque dur externe: fais ceci

http://perso.orange.fr/-Gof/DL/VaccinUSB.exe
tu colles l'executable dans ta clé usb puis tu l'exécutes.il va installer
des répertoires qui empêcheront les fichiers infectieux de s'installer
dans ton support.
si au moment du téléchargement de ton antivirus y voit une menace ignore-le
c'est un fichier tout à fait sur.

Mmsl35_ · Answer

voici 2equivalents a usbfix

* Télécharge RAV antivirus (d'Evosla)

http://ww25.evosla.com/compteur.php?soft=rav_antivirus

* Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX

* Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau

* Doucle-clique sur >> RAV.exe << afin de lancer l'outil.

* Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles)

* Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain .

* Retire tes disques amovibles et redémarrer le PC.

* Poste le rapport, si infection!

=============

Fais ceci à la suite:

* Télécharge l'outil Flash_Disinfector (de sUBs) et enregistre le sur ton bureau :

https://download.bleepingcomputer.com/sUBs/Flash_Disinfector.exe

* Double clique sur Flash_Disinfector.exe pour l'exécuter.

* Quand le message : [Plug in yours flash drive & clic Ok to begin disinfection] apparaitra :

* Connecte au pc, clé USB, DD externes, susceptibles d'avoir été infectés.

* Puis clic sur Ok

* Les icônes sur le bureau vont disparaître jusqu'à l'apparition du message: [Done!!]

* Appuie ensuite sur OK, pour faire réapparaître le bureau.

SeiFeR_HxC · Answer

J'ai suivi toutes les manips ( VaccinUSB.exe) puis RAV ( qui me dis que mon pc est sain), et la j'ai éxécuté Flash disinfector.exe depuis 10 min et je n'ai toujours pas de message ( [done] ) Je vais encore attendre voir s'il apparait sinon je redémarre..

Voila !

Il y a t il encore des manip a faire? car j'ai l'impression que mon pc n'est si sain que ça ^^

Merci beaucoup !

Mmsl35_ · Answer

salut fais ceci si tu peut dis moi ensuite si tuas toujours ce virus au travail

>>>>>>>>>1) Télécharge et installe Malwarebyte's Anti-Malware:

http://www.malwarebytes.org/mbam/program/mbam-setup.exe

A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée. >>> clique sur OK

Lance Malwarebyte's Anti-Malware en double-cliquant sur l'icône sur ton Bureau.

Au premier lancement, une fenêtre t'annonce que la version est Free >>> clique sur OK

Laisse les Mises à jour se télécharger

*** Referme le programme ***


2)Scan avec Malwarebyte's Anti-Malware

Lance Malwarebyte's Anti-Malware
Onglet "Recherche" >>> coche Executer un examen complet >>> Rechercher sélectionne tes disques durs puis clique sur Lancer l’examen
A la fin du scan >>> clique sur Afficher les résultats puis sur Enregistrer le rapport
Suppression des éléments détectés >>>>
supprime ce qu'il a trouvé vide également les éléments de la quarantaineS'il t'es demandé de redémarrer >>> clique sur "Yes"

--> Un rapport de scan s'ouvre, enregistre sur ton Bureau et poste ce rapport en réponse.

SeiFeR_HxC · Answer

J'ai installé le logiciel mais des que lance la mise a jour j'obtient un message d'erreur ( comme pour tous les anti virus et autre antispyware que jai testé ) qui me dit que je n'ai pas de connection internet ! je précise que je n'ai aucun par feu.. 

Je ne sais plus quoi faire.. j'ai chercher a mettre a jour le logiciel manuellement mais je n'ai pas trouvé de solution.

Utilisateur anonyme · Answer

Salut , pour avancer ..

plusieures infections ..


# Télécharge ceci: (merci a S!RI pour ce petit programme). 

http://siri.urz.free.fr/Fix/SmitfraudFix.exe 

Exécute le, Double click sur Smitfraudfix.exe choisit l’option 1, 
voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php 
il va générer un rapport : copie/colle le sur le poste stp. 

Tuto:http://pagesperso-orange.fr/rginformatique/section%20virus/smitfraudfix.htm

SeiFeR_HxC · Answer

Voici le rapport du logiciel :


SmitFraudFix v2.404

Rapport fait à 14:41:13,35, 16/03/2009
Executé à partir de C:\Documents and Settings\Fabien\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est 
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Fabien\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\

C:\autorun.inf PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Fabien


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Fabien\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Fabien\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

C:\DOCUME~1\Fabien\MENUDM~1\PROGRA~1\freshplay PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Fabien\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\freshplay\ PRESENT !
C:\Program Files\Google\googletoolbar1.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="karna.dat"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\antinul.vbe"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Votre ordinateur est certainement victime d'un détournement de DNS: 85.255.x.x détecté !

Description: IEEE 802.11g Wireless Cardbus/PCI Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 85.255.112.39
DNS Server Search Order: 85.255.112.40

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


Merci pour l'aide !

Utilisateur anonyme · Answer

de rien  ,

# Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 
---------------------------------------------------------------------------- 
# Relance le programme Smitfraud : 
Cette fois choisit l’option 2, répond oui a tous ; 
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

SeiFeR_HxC · Answer

Je vais essayer, mais le mode sans echec de mon pc est mort ( redemarrage automatique une fois windows chargé ) 

Je pourrai lancer le nettoyage en mode normal? si je supprime un maximum de processus et ferme tous les programmes? sinon ça m'à l'air sans issue..

J'essaie tout de meme le mode sans echec.

Utilisateur anonyme · Answer

LANCE le en mode normal mais ne touches pas a tes processus , c est pas la peine ..

SeiFeR_HxC · Answer

Et bien finalement j'ai pu utiliser le mode sans echec ( miracle? ) 
Vocie le rapport :


SmitFraudFix v2.404

Rapport fait à 14:55:19,09, 16/03/2009
Executé à partir de C:\Documents and Settings\Fabien\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est 
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost


127.0.0.1 update.asdf.cn
127.0.0.1 msg.asdf.com

127.0.0.1 update.asdf.cn
127.0.0.1 msg.asdf.com
127.0.0.1				activate.adobe.com

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

Problème suppression C:\autorun.inf
C:\DOCUME~1\Fabien\MENUDM~1\PROGRA~1\freshplay supprimé
C:\Program Files\freshplay\ supprimé
C:\Program Files\Google\googletoolbar1.dll supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

OK relance smithfraud 

tu choisi l option 5 et tu post le rapport stp

SeiFeR_HxC · Answer

Rapport pour l'option 5 :  ( Il ma demander si je voulais reconfigurer mes adresse DHCP, j'ai choisi oui )


SmitFraudFix v2.404

Rapport fait à 15:10:03,34, 16/03/2009
Executé à partir de C:\Documents and Settings\Fabien\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est 
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

Votre ordinateur est certainement victime d'un détournement de DNS: 85.255.x.x détecté !

Description: IEEE 802.11g Wireless Cardbus/PCI Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 85.255.112.39
DNS Server Search Order: 85.255.112.40

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B5669225-DE90-4D4B-85FD-45AE7ADD1D91}: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: NameServer=85.255.112.39,85.255.112.40

»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix

Utilisateur anonyme · Answer

OK ,

Télécharge cet outil de SiRi: 

http://siri.urz.free.fr/Softs/RHosts.exe
http://siri.urz.free.fr/RHosts.php 

Double cliquer dessus pour l'exécuter 

et cliquer sur " Restore original Hosts " 

ps : c est normal que rien ne se passe 

ensuite :

élécharge Navilog1 sur ton bureau : 

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

!! Déconnecte toi,désactive tes défenses( anti-virus,anti-spyware ) et ferme bien toutes tes applications le temps de la manipe !! 

Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valide . 
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord) 

Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 

Appuie sur une touche comme demandé, le bloc-note va s'ouvrir. 
Copie-colle l'intégralité de son contenu dans ta prochaine réponse et attends la suite . 

(Le rapport est en outre sauvegardé à la racine du disque "C\:fixnavi.txt" ) 

TUTO (aide) : http://www.malekal.com/Adware.Magic_Control.php#mozTocId595901

SeiFeR_HxC · Answer

Rapport de Navilog :


Search Navipromo version 3.7.6 commencé le 16/03/2009 à 15:20:18,43

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : Fabien ( Administrator )
BOOT : Normal boot

Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Not Activated)


A:\ (USB)
C:\ (Local Disk) - NTFS - Total:127 Go (Free:2 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
G:\ (CD or DVD)
H:\ (CD or DVD)
I:\ (CD or DVD)


Recherche executé en mode normal


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Fabien\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Fabien\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Fabien\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Scan Catchme non réalisé.
Droits limités sur la session actuelle.

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Fabien\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\Lanconfig 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"gfhfyqjjkj"="c:\documents and settings\fabien\local settings\application data\gfhfyqjjkj.exe gfhfyqjjkj"


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Fabien\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 16/03/2009 à 15:20:55,65 ***

Utilisateur anonyme · Answer

!! Déconnecte toi, désactive tes défenses ( anti-virus,anti-spyware ) et ferme bien toutes tes applications le temps de la manipe !! 

--->Double-clique sur le raccourci Navilog1 

Arriver au menu principal, choisir l'option 2 et valider (nettoyage "automatique" ). 

Le fix demandera ensuite de "redémarrer le PC", fermer toutes les fenêtres ouvertes 
et appuyer sur une touche comme demandé.( important : si le PC ne redémarre pas automatiquement, le faire manuellement ) 
Au redémarrage du PC, choisir la session habituelle si nécessaire. 

Patienter jusqu'au message : "Nettoyage Terminé le ..." 

Le bureau revient, puis le bloc-note s'ouvre . 
Sauvegarder ce rapport de manière à le retrouver, puis fermer le bloc-note ... 
(Le rapport sera en outre sauvegardé à la racine du disque "C\:cleannavi.txt") 

Poste ce rapport dans ta nouvelle réponse accompagné d'un nouveau rapport hijacthis pour analyse et attends la suite ... 

(PS : Si le bureau ne réapparaît pas, faire CTRL+ALT+SUPPR pour ouvrir le gestionnaire de tâches. 
Choisir l'onglet processus. Cliquer en haut à gauche sur fichiers et choisir exécuter, 
Taper explorer et valider.)

SeiFeR_HxC · Answer

J'ai choisi l'option 2 mais j'ai obtenu un message que je te copie : 

" !! Nettoyage au redemarrage du PC non possible !!
Nettoyage en mode sans echec impératif
A effectuer dans la meme session ou l'infestion a été trouvé "

Utilisateur anonyme · Answer

ok alors recommence en mode sans echec ..

SeiFeR_HxC · Answer

Voici le rapport de Navilog :

Clean Navipromo version 3.7.6 commencé le 16/03/2009 à 15:40:06,93

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : Fabien ( Administrator )
BOOT : Fail-safe boot

Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Not Activated)


A:\ (USB)
C:\ (Local Disk) - NTFS - Total:127 Go (Free:2 Go)
D:\ (CD or DVD)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
G:\ (CD or DVD)
H:\ (CD or DVD)


Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage executé en mode sans échec

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Fabien\locals~1\applic~1" * 



*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Fabien\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Fabien\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Fabien\menudm~1\progra~1" *** 



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Fabien\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *



* Dans "C:\Documents and Settings\Fabien\locals~1\applic~1" * 



*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 16/03/2009 à 15:42:58,43 ***



Et celui de HiJackThis :



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:48:33, on 16/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\SYSTEM32\NOTEPAD.EXE
C:\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\antinul.vbe
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\MediaCenter\LaunchList.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
O4 - Startup: Y'z Toolbar.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WiFi Station.lnk = ?
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

Utilisateur anonyme · Answer

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 




:processes 
explorer.exe 

:files 
C:\WINDOWS\system32\antinul.vbe 

:commands 
[emptytemp] 
[start explorer] 



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

SeiFeR_HxC · Answer

Le rapport de OTMovedIT3 :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\WINDOWS\system32\antinul.vbe not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\etilqs_JzmJBPvEQ80ZeO6gX7Si scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF6025.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF603D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF77A4.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF77C4.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03162009_155652

Files moved on Reboot...
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\etilqs_JzmJBPvEQ80ZeO6gX7Si not found!
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF6025.tmp not found!
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF603D.tmp not found!
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF77A4.tmp not found!
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF77C4.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\XUL.mfl moved successfully.

Utilisateur anonyme · Answer

ok ,

réouvre hijackthis
fais scan only
coches ces lignes :

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\antinul.vbe 

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) 

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll/206 (file missing) 


O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab 
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab 
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx 
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab 
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab 
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 


tu les coches et tu clic sur fix checked 


ensuite :

Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries. 
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.) 
Double-clique sur le répertoire JavaRa obtenu. 
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher) 
Clique sur Search For Updates. 
Sélectionne Update Using jucheck.exe puis clique sur Search. 
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes. 
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions. 
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok. 
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse. 
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log 
(c:\JavaRa.log) 
Ferme l'application.

SeiFeR_HxC · Answer

J'ai effectué l'operation sur HiJackthis, mais impossible de telecharger le fichier "Java.."  meme en faisant clic droit "enregistrer la cible sous "

SeiFeR_HxC · Answer

Ha désolé ça marche en fait là ^^

SeiFeR_HxC · Answer

Rapport de JavaRa :


JavaRa 1.12 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Mar 16 16:24:48 2009

Found and removed: C:\Program Files\Java\jre1.6.0_03

Found and removed: Software\JavaSoft\Java2D\1.5.0

Found and removed: Software\JavaSoft\Java2D\1.5.0_03

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\JavaPlugin.160_03

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}

Found and removed: Software\Classes\JavaPlugin.160_03

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_03

Found and removed: Software\JavaSoft\Java2D\1.6.0_03

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_03\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.6.0_03\bin\

------------------------------------

Finished reporting.

Utilisateur anonyme · Answer

ok ça avance , comment va le pc ?

Télécharge ici : 

http://images.malwareremoval.com/random/RSIT.exe 

random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau. 

Double-clique sur RSIT.exe afin de lancer RSIT. 

Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions). 

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. 

Poste le contenu de log.txt

SeiFeR_HxC · Answer

Oui pour le pc ça a l'air d'allez mieux, Google ne semble plus rediriger mes pages ( meme si je n'ai toujours pas acces au site malwarebytes.org ) par contre toujours impossible de mettre a jour ce dernier ou mon antivirus ou meme d'installer Spybot !

Et pour ce qui est de mes peripherique usb je ne sais pas s'ils sont desinfecter mais bon en suivant les manupulation mmsl35_ qui ma aidé au début je pense que ça doit etre bon.

Voila le rapport RSIT :


Logfile of random's system information tool 1.05 (written by random/random)
Run by Fabien at 2009-03-16 16:37:40
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 5 GB (4%) free of 131 GB
Total RAM: 1022 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:37:45, on 16/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\vVX1000.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Fabien\Bureau\RSIT.exe
C:\HiJackThis\Fabien.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LaunchList] C:\Program Files\Pinnacle\MediaCenter\LaunchList.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
O4 - Startup: Y'z Toolbar.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WiFi Station.lnk = ?
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

Utilisateur anonyme · Answer

ok,

branches tous tes disques 

Affiche tous les fichiers et dossiers : 
Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cacher 

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK 

recherche sur tes disque ce fichier : antinul.vbe 

si il est present , tu fais un clic droit dessus et supprimer , puis vide ta corbeille
tu veras des dossiers autorun.inf , laissent les , ils te protègent

ensuite :


Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install. 
L'outil sera extrait à la racine du lecteur système (généralement le C:\).. 

Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
• Redémarre ton ordinateur 
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
• Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuie sur Y pour commencer le processus de nettoyage. 
Il est possible que l'outil demande un redémarrage en mode Sans Échec en début de routine, si une infection particulière est détectée; valide et tapote la touche F8 au redémarrage pour accéder aux options de démarrage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuie sur une touche pour redémarrer le PC. 
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
__________________ 

Si SDfix ne se lance pas (ça arrive!) 

* Démarrer->Exécuter 
* Copie/colle ceci dans la fenêtre : 

%systemroot%\system32\cmd.exe /K %systemdrive%\SDFix\apps\FixPath.exe 


* Clique sur ok, et valide. 
* Redémarre et essaye de nouveau de lancer SDfix.

SeiFeR_HxC · Answer

J'ai recherché "antinul.vbe" sur tous mes périphérique USB mais je ne l'ai trouvé sur aucun d'eux, donc j'imagine qu'ils ne sont plus infectés !

Voici le rapport de SDFix :




[b]SDFix: Version 1.240 [/b]
Run by Fabien on 16/03/2009 at 17:18

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

[b]Name [/b]: 
tdssserv

[b]Path [/b]:
\systemroot\system32\drivers\TDSSpqlt.sys 

tdssserv - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\system32\updater.exe - Deleted
C:\WINDOWS\system32\windows.exe - Deleted
C:\WINDOWS\system32\drivers\TDSSpqlt.sys - Deleted
C:\WINDOWS\system32\TDSSosvd.dat - Deleted
C:\WINDOWS\SYSTEM32\TDSSOSVD.dat - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-16 17:39:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

disk error: C:\WINDOWS\system32\config\system, 0
scanning hidden registry entries ...

disk error: C:\WINDOWS\system32\config\software, 0
disk error: C:\Documents and Settings\Fabien
tuser.dat, 0
scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\THQ\Company of Heroes\RelicCOH.exe"="C:\Program Files\THQ\Company of Heroes\RelicCOH.exe:*:Enabled:RelicCOH"
"C:\Program Files\Microsoft Games\Rise Of Legends\legends.exe"="C:\Program Files\Microsoft Games\Rise Of Legends\legends.exe:*:Enabled:Rise Of Legends"
"C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe"="C:\Program Files\Ubisoft\Heroes of Might and Magic V\bin\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"
"C:\Program Files\THQ\Titan Quest\Titan Quest.exe"="C:\Program Files\THQ\Titan Quest\Titan Quest.exe:*:Enabled:Titan Quest"
"C:\Program Files\Valve\Steam\SteamApps\morthia@hotmail.com\counter-strike source\hl2.exe"="C:\Program Files\Valve\Steam\SteamApps\morthia@hotmail.com\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Anno 1701\Anno1701.exe"="C:\Program Files\Anno 1701\Anno1701.exe:*:Enabled:Anno 1701"
"C:\Program Files\Codemasters\Race Driver 3\rd3.exe"="C:\Program Files\Codemasters\Race Driver 3\rd3.exe:*:Enabled:RaceDriver 3 Application"
"C:\Program Files\THQ\Titan Quest Immortal Throne\Tqit.exe"="C:\Program Files\THQ\Titan Quest Immortal Throne\Tqit.exe:*:Enabled:Tqit"
"C:\TYPSoft FTP Server\ftpserv.exe"="C:\TYPSoft FTP Server\ftpserv.exe:*:Enabled:TYPSoft FTP Server"
"C:\Program Files\KONAMI\Pro Evolution Soccer 6\pes6.exe"="C:\Program Files\KONAMI\Pro Evolution Soccer 6\pes6.exe:*:Enabled:pes6.exe"
"C:\Program Files\Atari\Test Drive Unlimited\TestDriveUnlimited.exe"="C:\Program Files\Atari\Test Drive Unlimited\TestDriveUnlimited.exe:*:Enabled:Test Drive Unlimited"
"C:\Games\C&C3\RetailExe\1.2\cnc3game.dat"="C:\Games\C&C3\RetailExe\1.2\cnc3game.dat:*:Enabled:Command & Conquer 3 Tiberium Wars"
"C:\Documents and Settings\Fabien\Local Settings\Temp\ElectronicArts_Patcher_000.exe"="C:\Documents and Settings\Fabien\Local Settings\Temp\ElectronicArts_Patcher_000.exe:*:Enabled:ElectronicArts_Patcher_000"
"C:\Games\C&C3\RetailExe\1.3\cnc3game.dat"="C:\Games\C&C3\RetailExe\1.3\cnc3game.dat:*:Enabled:Command & Conquer 3 Tiberium Wars"
"C:\Program Files\GOA\Gunbound\GunBound.gme"="C:\Program Files\GOA\Gunbound\GunBound.gme:*:Enabled:GunBound"
"C:\Program Files\MAIET\Gunz\GunzLauncher.exe"="C:\Program Files\MAIET\Gunz\GunzLauncher.exe:*:Enabled:GunzLauncher"
"C:\Program Files\ABC\abc.exe"="C:\Program Files\ABC\abc.exe:*:Enabled:abc"
"C:\Program Files\CAPCOM\LOST_PLANET_TRIAL_DX9\LostPlanetDX9.exe"="C:\Program Files\CAPCOM\LOST_PLANET_TRIAL_DX9\LostPlanetDX9.exe:*:Enabled:LostPlanetDX9"
"C:\Program Files\OGPlanet\BB Tanks\game.exe"="C:\Program Files\OGPlanet\BB Tanks\game.exe:*:Enabled:BBTanks Launcher"
"C:\Program Files\Valve\Steam\SteamApps\morthia@hotmail.com\counter-strike\hl.exe"="C:\Program Files\Valve\Steam\SteamApps\morthia@hotmail.com\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Codemasters\DiRT\DiRT.exe"="C:\Program Files\Codemasters\DiRT\DiRT.exe:*:Enabled:DiRT Executable"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\Codemasters\Overlord\Overlord.exe"="C:\Program Files\Codemasters\Overlord\Overlord.exe:*:Enabled:Overlord"
"C:\Program Files\GOA\Pangya_Eu\update_eu.exe"="C:\Program Files\GOA\Pangya_Eu\update_eu.exe:*:Enabled:Pangya"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\WINDOWS\system32\rtcshare.exe"="C:\WINDOWS\system32\rtcshare.exe:*:Enabled:Partage de l'application RTC"
"C:\Documents and Settings\Fabien\Bureau\FTP\FICHIER SERVEUR\SERIES\Company of Heroes Opposing Fronts - DOOM [Razor73]\RelicCOH.exe"="C:\Documents and Settings\Fabien\Bureau\FTP\FICHIER SERVEUR\SERIES\Company of Heroes Opposing Fronts - DOOM [Razor73]\RelicCOH.exe:*:Enabled:RelicCOH"
"C:\Program Files\TVAnts\Tvants.exe"="C:\Program Files\TVAnts\Tvants.exe:*:Enabled:TVAnts"
"C:\Program Files\Freeciv-2.0.9-gtk2\civserver.exe"="C:\Program Files\Freeciv-2.0.9-gtk2\civserver.exe:*:Enabled:civserver"
"C:\Program Files\Last.fm\LastFM.exe"="C:\Program Files\Last.fm\LastFM.exe:*:Enabled:Last.fm"
"C:\Program Files\Majorem\Ballerium\binaries\BalleriumClient.exe"="C:\Program Files\Majorem\Ballerium\binaries\BalleriumClient.exe:*:Enabled:BalleriumClient"
"C:\Program Files\Soulseek\slsk.exe"="C:\Program Files\Soulseek\slsk.exe:*:Enabled:SoulSeek"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows© NetMeeting©"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\Team17\Worms Armageddon\wa.exe"="C:\Team17\Worms Armageddon\wa.exe:*:Enabled:Worms Armageddon"
"C:\Program Files\TmNationsForever\TmForever.exe"="C:\Program Files\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe"="C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe"="C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater"
"C:\Program Files\Fichiers communs\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Fichiers communs\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe"="C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe:*:Enabled:MessengerDiscovery Live"
"C:\Program Files\MessengerDiscovery\Loader.exe"="C:\Program Files\MessengerDiscovery\Loader.exe:*:Enabled:Loader"
"C:\Program Files\Valve\Steam\SteamApps\morthia@hotmail.com\source sdk base\hl2.exe"="C:\Program Files\Valve\Steam\SteamApps\morthia@hotmail.com\source sdk base\hl2.exe:*:Enabled:hl2"
"C:\Program Files\OpenTTD\openttd.exe"="C:\Program Files\OpenTTD\openttd.exe:*:Enabled:OpenTTD"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\system32\drivers\svchost.exe"="C:\WINDOWS\system32\drivers\svchost.exe:*:Disabled:svchost"
"C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Sports Interactive\Football Manager 2009 Demo\fm.exe"="C:\Program Files\Sports Interactive\Football Manager 2009 Demo\fm.exe:*:Disabled:Football Manager 2009 Demo"
"C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe"="C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:*:Disabled:Football Manager 2008"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\Program Files\Microsoft LifeCam\LifeEnC2.exe"="C:\Program Files\Microsoft LifeCam\LifeEnC2.exe:*:Enabled:LifeEnC2.exe"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\Program Files\Microsoft LifeCam\LifeTray.exe"="C:\Program Files\Microsoft LifeCam\LifeTray.exe:*:Enabled:LifeTray.exe"
"C:\Program Files\Electronic Arts\BattleForgeBeta\Bootstrapper.exe"="C:\Program Files\Electronic Arts\BattleForgeBeta\Bootstrapper.exe:*:Enabled:BattleForgeT Launcher"
"C:\Program Files\Electronic Arts\BattleForgeBeta\BattleForge.exe"="C:\Program Files\Electronic Arts\BattleForgeBeta\BattleForge.exe:*:Enabled:BattleForgeT"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Fri  6 Feb 2009        65,536 ..SHR --- "C:\RECYCLER\S-1-1-77-100019109-100004722-100032440-6896.com"
Wed  3 May 2006       163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007        31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Mon 17 Mar 2008         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 26 Jun 2005       616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Tue 21 Jun 2005        45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Sat 15 Dec 2007        72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Fri 27 Oct 2006        15,872 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
Fri 27 Feb 2004       233,472 A..H. --- "C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll"
Fri 14 Mar 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue  4 Jun 2002        84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue  4 Jun 2002        44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002        73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002        65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun  9 Jun 2002        36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue  4 Jun 2002        20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002       102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002       176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002       208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002       217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun  9 Jun 2002        40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sat  3 Nov 2001       225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001       225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004       232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderaac.dll"
Sun  9 Jun 2002       525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencodernco3260.dll"
Tue 10 Dec 2002       245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencodernlt3260.dll"
Tue 10 Dec 2002        45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderv103260.dll"
Tue 10 Dec 2002        98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderv203260.dll"
Tue 10 Dec 2002        94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderv303260.dll"
Tue 10 Dec 2002        90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoderv403260.dll"
Tue 10 Dec 2002       102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun  9 Jun 2002        49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder	okr3260.dll"
Sun  1 Mar 2009         3,521 ...HR --- "C:\Documents and Settings\Fabien\Application Data\SecuROM\UserData\securom_v7_01.bak"
Thu 12 Jul 2007     1,250,257 A..H. --- "C:\Documents and Settings\Fabien\Mes documents\Mes fichiers re‡us\morthia761348535\Historique\acd76.tmp"
Fri 15 Jun 2007       311,685 A..H. --- "C:\Documents and Settings\Fabien\Mes documents\Mes fichiers re‡us\morthia761348535\Historique\ii73F.tmp"

[b]Finished![/b]

Utilisateur anonyme · Answer

OK , pour tes disques on verifiera au final,

regarde si tu peux mettre malewarebytes a jours ..

SeiFeR_HxC · Answer

Toujours impossible de mettre a jour Malwarebytes ou mon antivirus ( Avira ) ou installer spybot... il est sacrément coriace ce virus !

Utilisateur anonyme · Answer

;)

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 




-> Double clique sur combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

Avant d'utiliser ComboFix : 

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. 

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. 

-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

SeiFeR_HxC · Answer

Rapport de Combofix : ComboFix 09-03-15.01 - Fabien 2009-03-16 17:59:04.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1022.672 [GMT 1:00] Lancé depuis: c:\documents and settings\Fabien\Bureau\ComboFix.exe AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Outdated) AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Mozilla Firefox\components\iamfamous.dll c: ecycler\S-1-1-77-100019109-100004722-100032440-6896.com c:\windows\emMON.exe c:\windows\IE4 Error Log.txt c:\windows\system32\drivers\gaopdxlrqjovcx.sys c:\windows\system32\drivers pf.sys c:\windows\system32\gaopdxcounter c:\windows\system32\gaopdxxtlnmpxb.dll c:\windows\system32\packet.dll c:\windows\system32 mp.reg c:\windows\system32\wpcap.dll . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_gaopdxserv.sys -------\Legacy_TDSSSERV -------\Legacy_NPF -------\Service_NPF ((((((((((((((((((((((((((((( Fichiers créés du 2009-02-16 au 2009-03-16 )))))))))))))))))))))))))))))))))))) . 2009-03-16 17:10 . 2009-03-16 17:10 d-------- c:\windows\ERUNT 2009-03-16 17:02 . 2009-03-16 17:39 d-------- C:\SDFix 2009-03-16 16:37 . 2009-03-16 16:37 d-------- C: sit 2009-03-16 16:23 . 2009-03-16 16:23 410,984 --a------ c:\windows\system32\deploytk.dll 2009-03-16 15:56 . 2009-03-16 15:56 d-------- C:\_OTMoveIt 2009-03-16 15:18 . 2009-03-16 15:42 d-------- c:\program files\Navilog1 2009-03-14 13:30 . 2009-03-14 13:30 172 --a------ C:\curr_ver.tmp 2009-03-11 15:08 . 2009-03-12 14:18 d-------- c:\documents and settings\Fabien\.housecall6.6 2009-03-09 22:54 . 2009-03-16 16:37 d-------- C:\HiJackThis 2009-03-08 16:05 . 2009-03-08 22:52 d-------- c:\program files\Avira 2009-03-07 16:59 . 2009-03-07 17:44 d--h----- C:\$AVG8.VAULT$ 2009-03-07 16:10 . 2009-03-08 16:02 d-------- c:\documents and settings\All Users\Application Data\avg8 2009-03-02 14:37 . 2009-03-02 14:37 d-------- c:\program files\Electronic Arts 2009-03-02 14:37 . 2008-10-10 04:52 4,379,984 --a------ c:\windows\system32\D3DX9_40.dll 2009-03-02 14:37 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll 2009-03-02 14:37 . 2008-10-27 10:04 514,384 --a------ c:\windows\system32\XAudio2_3.dll 2009-03-02 14:37 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll 2009-03-02 14:37 . 2008-10-27 10:04 235,856 --a------ c:\windows\system32\xactengine3_3.dll 2009-03-02 14:37 . 2008-10-27 10:04 70,992 --a------ c:\windows\system32\XAPOFX1_2.dll 2009-03-02 14:37 . 2008-10-27 10:04 23,376 --a------ c:\windows\system32\X3DAudio1_5.dll 2009-03-01 15:58 . 2009-03-01 15:58 d-------- c:\program files\Hasbro 2009-02-28 20:56 . 2009-02-28 20:56 d-------- c:\program files\Risk 2009-02-28 17:52 . 2009-02-28 17:52 d-------- c:\program files\MagicISO 2009-02-22 19:54 . 2009-02-09 13:18 211,189 --a------ c:\windows\system32 vapps.nvb 2009-02-19 23:22 . 2009-03-16 18:06 d-------- c:\program files\Steam 2009-02-16 16:00 . 2009-02-16 16:01 d-------- C:\FBPUpdate . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-16 15:24 --------- d-----w c:\program files\Java 2009-03-16 13:55 --------- d-----w c:\program files\Google 2009-03-16 13:10 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-03-14 13:14 --------- d-----w c:\program files\PokerStars 2009-03-09 03:41 --------- d-----w c:\program files\Warcraft III 2009-03-08 15:17 --------- d-----w c:\documents and settings\All Users\Application Data\Avira 2009-03-07 16:44 --------- d-----w c:\program files\Windows XP Home-Pro-2003 SP2 Crack 2009-03-07 16:21 --------- d-----w c:\program files\Har-Bal 2.3 2009-03-06 15:14 --------- d-----w c:\program files\BitComet 2009-03-05 15:09 --------- d-----w c:\program files\Bonjour 2009-03-04 14:10 --------- d-----w c:\program files\FriendBlasterPro 2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-02-09 12:18 6,307,328 ----a-w c:\windows\system32\drivers v4_mini.sys 2009-02-07 20:36 163,840 ----a-w c:\documents and settings\Fabien\Recentapdt.dsk.exe 2009-02-07 20:36 --------- d-----w c:\documents and settings\Fabien\Application Data\AVS4YOU 2009-02-07 20:36 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU 2009-02-07 20:29 --------- d-----w c:\program files\Fichiers communs\AVSMedia 2009-02-07 20:29 --------- d-----w c:\program files\AVS4YOU 2009-02-05 15:59 --------- d-----w c:\program files\Peer2Peer-FR 2009-02-02 15:37 --------- d-----w c:\program files\VstPlugins 2009-01-22 19:57 --------- d-----w c:\program files\Crayon Physics Deluxe 2009-01-21 21:54 --------- d-----w c:\documents and settings\Fabien\Application Data\Crayon Physics Deluxe 2009-01-19 01:20 --------- d-----w c:\documents and settings\Fabien\Application Data\Azureus 2008-12-18 03:03 3,532 ----a-w C:\drmHeader.bin 2006-05-03 09:06 163,328 --sh--r c:\windows\system32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r c:\windows\system32\msfDX.dll . ------- Sigcheck ------- 2006-04-20 13:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows\$hf_mig$\KB917953\SP2QFE cpip.sys 2007-10-30 17:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE cpip.sys 2001-08-28 13:00 327168 e7774698bb0d14b0710a9a31e209f9b6 c:\windows\$NtServicePackUninstall$ cpip.sys 2004-08-04 07:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB917953$ cpip.sys 2006-04-20 12:51 359808 b4e29943b4b04bd5e7381546848e6669 c:\windows\$NtUninstallKB941644$ cpip.sys 2004-08-04 07:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\ServicePackFiles\i386 cpip.sys 2008-04-07 22:07 360064 8283a4d489b207991efdc8328733d0bc c:\windows\system32\dllcache cpip.sys 2008-04-07 22:07 360064 8283a4d489b207991efdc8328733d0bc c:\windows\system32\drivers cpip.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d}"= "c:\program files\Peer2Peer-FR bPee1.dll" [2009-02-05 1881112] [HKEY_CLASSES_ROOT\clsid\{b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d}] 2009-02-05 16:59 1881112 --a------ c:\program files\Peer2Peer-FR bPee1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d}"= "c:\program files\Peer2Peer-FR bPee1.dll" [2009-02-05 1881112] [HKEY_CLASSES_ROOT\clsid\{b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{B00F3D7D-ECAD-4A3B-BCF7-BA5FC1FD0F8D}"= "c:\program files\Peer2Peer-FR bPee1.dll" [2009-02-05 1881112] [HKEY_CLASSES_ROOT\clsid\{b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-13 68856] "LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608] "Steam"="c:\program files\Steam\Steam.exe" [2009-02-19 1410296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640] "NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592] "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-16 136600] "AdobeCS4ServiceManager"="c:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2008-08-04 160800] "VX1000"="c:\windows\vVX1000.exe" [2008-08-04 721936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088] "LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576] "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2008-03-15 233472] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "RTHDCPL"="RTHDCPL.EXE" [2006-04-17 c:\windows\RTHDCPL.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-20 c:\windows\system32\bthprops.cpl] "nwiz"="nwiz.exe" [2009-02-09 c:\windows\system32 wiz.exe] c:\documents and settings\Fabien\Menu D‚marrer\Programmes\D‚marrage\ RocketDock.lnk - c:\windows\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe [2006-05-14 344064] UberIcon.lnk - c:\windows\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe [2006-02-05 180224] Y'z Shadow.lnk - c:\windows\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe [2002-09-30 131072] Y'z Toolbar.lnk - c:\windows\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe [2002-09-29 90112] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2004-12-14 29696] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\THQ\Company of Heroes\RelicCOH.exe"= "c:\TYPSoft FTP Server\ftpserv.exe"= "c:\Program Files\GOA\Gunbound\GunBound.gme"= "c:\Program Files\MAIET\Gunz\GunzLauncher.exe"= "c:\Program Files\ABC\abc.exe"= "c:\Program Files\FlashGet\flashget.exe"= "c:\Program Files\GOA\Pangya_Eu\update_eu.exe"= "c:\Program Files\MSN Messenger\msnmsgr.exe"= "c:\Program Files\MSN Messenger\livecall.exe"= "c:\WINDOWS\system32\rtcshare.exe"= "c:\Program Files\TVAnts\Tvants.exe"= "c:\Program Files\Last.fm\LastFM.exe"= "c:\Program Files\Soulseek\slsk.exe"= "c:\Program Files\NetMeeting\conf.exe"= "c:\Program Files\BitComet\BitComet.exe"= "c:\Team17\Worms Armageddon\wa.exe"= "c:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe"= "c:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe"= "c:\Program Files\Fichiers communs\Nokia\Service Layer\A\nsl_host_process.exe"= "c:\Program Files\OpenTTD\openttd.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Program Files\iTunes\iTunes.exe"= "c:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"= "c:\Program Files\Microsoft LifeCam\LifeCam.exe"= "c:\Program Files\Microsoft LifeCam\LifeEnC2.exe"= "c:\Program Files\Microsoft LifeCam\LifeExp.exe"= "c:\Program Files\Microsoft LifeCam\LifeTray.exe"= "c:\Program Files\Electronic Arts\BattleForgeBeta\Bootstrapper.exe"= "c:\Program Files\Electronic Arts\BattleForgeBeta\BattleForge.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "27279:TCP"= 27279:TCP:BitComet 27279 TCP "27279:UDP"= 27279:UDP:BitComet 27279 UDP "17868:TCP"= 17868:TCP:BitComet 17868 TCP "17868:UDP"= 17868:UDP:BitComet 17868 UDP "5353:TCP"= 5353:TCP:Adobe CSI CS4 S3 PID_0920;Logitech QuickCam Express(PID_0920);c:\windows\system32\drivers\LV532AV.SYS [2007-06-27 163328] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91dc2237-bb2b-11dd-91f7-0018e70439e7}] \Shell\AutoRun\command - wscript.exe antinul.vbe \Shell\open\Command - wscript.exe antinul.vbe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e07e922-791e-11dd-915c-0018e70439e7}] \Shell\Auto\command - auto.exe \Shell\AutoRun\command - auto.exe . Contenu du dossier 'Tâches planifiées' 2009-03-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-PMCRemote - (no file) HKLM-Run-PinnacleDriverCheck - c:\windows\system32\PSDrvCheck.exe HKLM-Run-LaunchList - c:\program files\Pinnacle\MediaCenter\LaunchList.exe HKLM-Run-kab - Shutdown Timer - (no file) . ------- Examen supplémentaire ------- . uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm FF - ProfilePath - c:\documents and settings\Fabien\Application Data\Mozilla\Firefox\Profiles evvxtvm.default\ FF - prefs.js: browser.search.selectedEngine - GoogleCOM FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ FF - prefs.js: keyword.URL - hxxp://www.afreesearch.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - plugin: c:\program files\Mozilla Firefox\plugins p-mswmp.dll ---- PARAMETRES FIREFOX ---- FF - user.js: browser.search.selectedEngine - GoogleCOM FF - user.js: keyword.URL - hxxp://www.afreesearch.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-16 18:07:06 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-1482476501-484763869-839522115-1003\Software\G*e*n*i*e*"!\FM Genie Scout 2008] "GameDir"="c:\Documents and Settings\Fabien\Mes documents\Sports Interactive\Football Manager 2008\games" "ShortlistDir"="" "ScreenshotsDir"="c:\Documents and Settings\Fabien\Mes documents\Sports Interactive\Football Manager 2008" "SaveDir"="c:\Documents and Settings\Fabien\Mes documents\Sports Interactive\Football Manager 2008\" "HistoryDir"="c:\Documents and Settings\Fabien\Bureau\FM2008\FM-Genie-Scout-08\FM Genie Scout 2008\History Points" "LangDB"="c:\Program Files\Sports Interactive\Football Manager 2008\data\updates\update-801\db\801\lang_db.dat" "LastSaveGame"="c:\Documents and Settings\Fabien\Mes documents\Sports Interactive\Football Manager 2008\games\ARSENAL NEW.fm" "Language"="French" "LoadLangDB"=dword:00000001 "CompressHistoryPoints"=dword:00000000 "HighlightedAttributes"=dword:00000000 "MinCondition"=dword:00000050 "SkinID"=dword:00000001 "LastUpdateCheck"=dword:00000000 "HighQualityGUI"=dword:00000001 "AutomaticallyUpdateCheck"=dword:00000001 "AdvancedGeneration"=dword:00000000 "TranslateStaffSkills"=dword:00000001 "TranslatePlayerSkills"=dword:00000001 "TranslatePositions"=dword:00000001 "ShowHistory"=dword:00000001 "WindowState"=dword:00000000 "WindowHeight"=dword:0000035c "WindowWidth"=dword:00000483 "WindowLeft"=dword:00000107 "WindowTop"=dword:0000005f "UseProxy"=dword:00000000 "ProxyHost"="" "ProxyPort"="" "UseAuthentication"=dword:00000000 "UserName"="" "UserPassword"="" "Currency"=dword:0000001c [HKEY_USERS\S-1-5-21-1482476501-484763869-839522115-1003\Software\G*e*n*i*e*"!\FM Genie Scout 2008\Columns\Clubs] "Position0"=dword:00000000 "Visible0"=dword:00000001 "Width0"=dword:0000007d "Position1"=dword:00000001 "Visible1"=dword:00000001 "Width1"=dword:00000064 "Position2"=dword:00000002 "Visible2"=dword:00000001 "Width2"=dword:00000064 "Position3"=dword:00000003 "Visible3"=dword:00000001 "Width3"=dword:00000032 "Position4"=dword:00000004 "Visible4"=dword:00000001 "Width4"=dword:00000032 "Position5"=dword:00000005 "Visible5"=dword:00000001 "Width5"=dword:00000050 "Position6"=dword:00000006 "Visible6"=dword:00000001 "Width6"=dword:00000050 "Position7"=dword:00000007 "Visible7"=dword:00000001 "Width7"=dword:00000050 "Position8"=dword:00000008 "Visible8"=dword:00000000 "Width8"=dword:00000050 "Position9"=dword:00000009 "Visible9"=dword:00000000 "Width9"=dword:0000002d "Position10"=dword:0000000a "Visible10"=dword:00000000 "Width10"=dword:0000001e "Position11"=dword:0000000b "Visible11"=dword:00000000 "Width11"=dword:0000001e "Position12"=dword:0000000c "Visible12"=dword:00000000 "Width12"=dword:0000001e "Position13"=dword:0000000d "Visible13"=dword:00000001 "Width13"=dword:0000003c "Position14"=dword:0000000e "Visible14"=dword:00000000 "Width14"=dword:00000032 "Position15"=dword:0000000f "Visible15"=dword:00000000 "Width15"=dword:00000032 "Position16"=dword:00000010 "Visible16"=dword:00000000 "Width16"=dword:00000032 "Position17"=dword:00000011 "Visible17"=dword:00000001 "Width17"=dword:00000050 "Position18"=dword:00000012 "Visible18"=dword:00000001 "Width18"=dword:00000050 "Position19"=dword:00000013 "Visible19"=dword:00000000 "Width19"=dword:00000050 [HKEY_USERS\S-1-5-21-1482476501-484763869-839522115-1003\Software\G*e*n*i*e*"!\FM Genie Scout 2008\Columns\Players] "Position0"=dword:00000000 "Visible0"=dword:00000001 "Width0"=dword:000000b1 "Position1"=dword:00000001 "Visible1"=dword:00000001 "Width1"=dword:00000064 "Position2"=dword:00000002 "Visible2"=dword:00000001 "Width2"=dword:00000064 "Position3"=dword:00000003 "Visible3"=dword:00000001 "Width3"=dword:0000005c "Position4"=dword:00000008 "Visible4"=dword:00000001 "Width4"=dword:00000023 "Position5"=dword:00000009 "Visible5"=dword:00000001 "Width5"=dword:00000052 "Position6"=dword:0000000a "Visible6"=dword:00000001 "Width6"=dword:00000051 "Position7"=dword:0000000c "Visible7"=dword:00000001 "Width7"=dword:0000004b "Position8"=dword:0000000d "Visible8"=dword:00000001 "Width8"=dword:00000074 "Position9"=dword:0000000e "Visible9"=dword:00000001 "Width9"=dword:00000050 "Position10"=dword:00000010 "Visible10"=dword:00000000 "Width10"=dword:00000050 "Position11"=dword:00000011 "Visible11"=dword:00000000 "Width11"=dword:0000004b "Position12"=dword:00000012 "Visible12"=dword:00000000 "Width12"=dword:0000002d "Position13"=dword:00000013 "Visible13"=dword:00000000 "Width13"=dword:0000003c "Position14"=dword:00000014 "Visible14"=dword:00000000 "Width14"=dword:0000004b "Position15"=dword:00000015 "Visible15"=dword:00000000 "Width15"=dword:00000064 "Position16"=dword:00000016 "Visible16"=dword:00000000 "Width16"=dword:00000064 "Position17"=dword:00000017 "Visible17"=dword:00000000 "Width17"=dword:0000004b "Position18"=dword:00000018 "Visible18"=dword:00000000 "Width18"=dword:00000064 "Position19"=dword:00000019 "Visible19"=dword:00000000 "Width19"=dword:0000003c "Position20"=dword:0000001a "Visible20"=dword:00000000 "Width20"=dword:0000004b "Position21"=dword:0000001b "Visible21"=dword:00000000 "Width21"=dword:00000050 "Position22"=dword:0000001c "Visible22"=dword:00000000 "Width22"=dword:00000073 "Position23"=dword:0000001d "Visible23"=dword:00000000 "Width23"=dword:00000050 "Position24"=dword:0000001e "Visible24"=dword:00000000 "Width24"=dword:0000005a "Position25"=dword:0000001f "Visible25"=dword:00000000 "Width25"=dword:0000006e "Position26"=dword:00000020 "Visible26"=dword:00000000 "Width26"=dword:00000064 "Position27"=dword:00000021 "Visible27"=dword:00000000 "Width27"=dword:00000087 "Position28"=dword:00000022 "Visible28"=dword:00000000 "Width28"=dword:00000064 "Position29"=dword:00000023 "Visible29"=dword:00000000 "Width29"=dword:00000064 "Position30"=dword:00000024 "Visible30"=dword:00000000 "Width30"=dword:00000046 "Position31"=dword:00000025 "Visible31"=dword:00000000 "Width31"=dword:0000004b "Position32"=dword:00000026 "Visible32"=dword:00000000 "Width32"=dword:00000046 "Position33"=dword:00000027 "Visible33"=dword:00000000 "Width33"=dword:0000004b "Position34"=dword:00000028 "Visible34"=dword:00000000 "Width34"=dword:0000003c "Position35"=dword:0000002a "Visible35"=dword:00000000 "Width35"=dword:00000064 "Position36"=dword:0000002e "Visible36"=dword:00000000 "Width36"=dword:00000073 "Position37"=dword:00000030 "Visible37"=dword:00000000 "Width37"=dword:0000005f "Position38"=dword:00000033 "Visible38"=dword:00000000 "Width38"=dword:00000091 "Position39"=dword:00000035 "Visible39"=dword:00000000 "Width39"=dword:0000003c "Position40"=dword:0000002c "Visible40"=dword:00000000 "Width40"=dword:0000005a "Position41"=dword:00000036 "Visible41"=dword:00000000 "Width41"=dword:00000041 "Position42"=dword:00000029 "Visible42"=dword:00000000 "Width42"=dword:00000050 "Position43"=dword:0000002b "Visible43"=dword:00000000 "Width43"=dword:00000055 "Position44"=dword:0000002d "Visible44"=dword:00000000 "Width44"=dword:0000005f "Position45"=dword:00000037 "Visible45"=dword:00000000 "Width45"=dword:00000050 "Position46"=dword:00000038 "Visible46"=dword:00000000 "Width46"=dword:0000004b "Position47"=dword:00000039 "Visible47"=dword:00000000 "Width47"=dword:0000004b "Position48"=dword:0000003a "Visible48"=dword:00000000 "Width48"=dword:00000046 "Position49"=dword:0000003b "Visible49"=dword:00000000 "Width49"=dword:00000032 "Position50"=dword:0000003c "Visible50"=dword:00000000 "Width50"=dword:0000003c "Position51"=dword:0000003d "Visible51"=dword:00000000 "Width51"=dword:0000004b "Position52"=dword:0000003e "Visible52"=dword:00000000 "Width52"=dword:0000003c "Position53"=dword:0000003f "Visible53"=dword:00000000 "Width53"=dword:00000037 "Position54"=dword:00000040 "Visible54"=dword:00000000 "Width54"=dword:00000069 "Position55"=dword:00000041 "Visible55"=dword:00000000 "Width55"=dword:0000005a "Position56"=dword:00000044 "Visible56"=dword:00000000 "Width56"=dword:0000004b "Position57"=dword:00000045 "Visible57"=dword:00000000 "Width57"=dword:0000004b "Position58"=dword:00000046 "Visible58"=dword:00000000 "Width58"=dword:00000037 "Position59"=dword:00000047 "Visible59"=dword:00000000 "Width59"=dword:0000003c "Position60"=dword:00000048 "Visible60"=dword:00000000 "Width60"=dword:0000003c "Position61"=dword:00000049 "Visible61"=dword:00000000 "Width61"=dword:00000041 "Position62"=dword:0000004a "Visible62"=dword:00000000 "Width62"=dword:00000055 "Position63"=dword:0000004b "Visible63"=dword:00000000 "Width63"=dword:0000003c "Position64"=dword:0000004c "Visible64"=dword:00000000 "Width64"=dword:0000003c "Position65"=dword:0000004d "Visible65"=dword:00000000 "Width65"=dword:0000004b "Position66"=dword:0000004e "Visible66"=dword:00000000 "Width66"=dword:0000003c "Position67"=dword:0000004f "Visible67"=dword:00000000 "Width67"=dword:00000046 "Position68"=dword:00000050 "Visible68"=dword:00000000 "Width68"=dword:00000028 "Position69"=dword:00000051 "Visible69"=dword:00000000 "Width69"=dword:00000041 "Position70"=dword:00000052 "Visible70"=dword:00000000 "Width70"=dword:0000003c "Position71"=dword:00000053 "Visible71"=dword:00000000 "Width71"=dword:00000069 "Position72"=dword:00000054 "Visible72"=dword:00000000 "Width72"=dword:00000041 "Position73"=dword:00000055 "Visible73"=dword:00000000 "Width73"=dword:0000005f "Position74"=dword:00000056 "Visible74"=dword:00000000 "Width74"=dword:0000003c "Position75"=dword:00000057 "Visible75"=dword:00000000 "Width75"=dword:00000037 "Position76"=dword:00000058 "Visible76"=dword:00000000 "Width76"=dword:0000004b "Position77"=dword:00000059 "Visible77"=dword:00000000 "Width77"=dword:00000050 "Position78"=dword:0000005a "Visible78"=dword:00000000 "Width78"=dword:00000037 "Position79"=dword:0000005b "Visible79"=dword:00000000 "Width79"=dword:00000037 "Position80"=dword:0000005c "Visible80"=dword:00000000 "Width80"=dword:0000005a "Position81"=dword:0000005d "Visible81"=dword:00000000 "Width81"=dword:0000004b "Position82"=dword:0000005e "Visible82"=dword:00000000 "Width82"=dword:00000055 "Position83"=dword:0000005f "Visible83"=dword:00000000 "Width83"=dword:0000002d "Position84"=dword:00000060 "Visible84"=dword:00000000 "Width84"=dword:00000037 "Position85"=dword:00000061 "Visible85"=dword:00000000 "Width85"=dword:0000003c "Position86"=dword:00000062 "Visible86"=dword:00000000 "Width86"=dword:00000046 "Position87"=dword:00000063 "Visible87"=dword:00000000 "Width87"=dword:0000003c "Position88"=dword:00000064 "Visible88"=dword:00000000 "Width88"=dword:0000005a "Position89"=dword:00000065 "Visible89"=dword:00000000 "Width89"=dword:0000003c "Position90"=dword:00000066 "Visible90"=dword:00000000 "Width90"=dword:00000050 "Position91"=dword:00000067 "Visible91"=dword:00000000 "Width91"=dword:00000046 "Position92"=dword:00000068 "Visible92"=dword:00000000 "Width92"=dword:0000005a "Position93"=dword:00000069 "Visible93"=dword:00000000 "Width93"=dword:00000037 "Position94"=dword:0000006a "Visible94"=dword:00000000 "Width94"=dword:0000003c "Position95"=dword:0000006b "Visible95"=dword:00000000 "Width95"=dword:0000003c "Position96"=dword:0000006c "Visible96"=dword:00000000 "Width96"=dword:00000046 "Position97"=dword:0000006d "Visible97"=dword:00000000 "Width97"=dword:00000046 "Position98"=dword:0000006e "Visible98"=dword:00000000 "Width98"=dword:00000055 "Position99"=dword:0000006f "Visible99"=dword:00000000 "Width99"=dword:00000073 "Position100"=dword:00000042 "Visible100"=dword:00000000 "Width100"=dword:00000041 "Position101"=dword:00000070 "Visible101"=dword:00000000 "Width101"=dword:0000003c "Position102"=dword:00000071 "Visible102"=dword:00000000 "Width102"=dword:0000003c "Position103"=dword:00000072 "Visible103"=dword:00000000 "Width103"=dword:00000046 "Position104"=dword:00000073 "Visible104"=dword:00000000 "Width104"=dword:0000003c "Position105"=dword:00000074 "Visible105"=dword:00000000 "Width105"=dword:00000041 "Position106"=dword:0000000f "Visible106"=dword:00000001 "Width106"=dword:00000050 "Position107"=dword:0000000b "Visible107"=dword:00000001 "Width107"=dword:00000056 "Position108"=dword:00000043 "Visible108"=dword:00000000 "Width108"=dword:00000050 "Position109"=dword:0000002f "Visible109"=dword:00000000 "Width109"=dword:00000050 "Position110"=dword:00000031 "Visible110"=dword:00000000 "Width110"=dword:00000055 "Position111"=dword:00000032 "Visible111"=dword:00000000 "Width111"=dword:00000082 "Position112"=dword:00000034 "Visible112"=dword:00000000 "Width112"=dword:00000087 "Position113"=dword:00000075 "Visible113"=dword:00000000 "Width113"=dword:00000050 "Position114"=dword:00000076 "Visible114"=dword:00000000 "Width114"=dword:00000050 "Position115"=dword:00000077 "Visible115"=dword:00000000 "Width115"=dword:00000050 "Position116"=dword:00000078 "Visible116"=dword:00000000 "Width116"=dword:00000050 "Position117"=dword:00000079 "Visible117"=dword:00000000 "Width117"=dword:00000050 "Position118"=dword:0000007a "Visible118"=dword:00000000 "Width118"=dword:00000050 "Position119"=dword:0000007b "Visible119"=dword:00000000 "Width119"=dword:00000050 "Position120"=dword:0000007c "Visible120"=dword:00000000 "Width120"=dword:00000050 "Position121"=dword:0000007d "Visible121"=dword:00000000 "Width121"=dword:00000050 "Position122"=dword:0000007e "Visible122"=dword:00000000 "Width122"=dword:00000050 "Position123"=dword:0000007f "Visible123"=dword:00000000 "Width123"=dword:00000050 "Position124"=dword:00000080 "Visible124"=dword:00000000 "Width124"=dword:00000050 "Position125"=dword:00000081 "Visible125"=dword:00000000 "Width125"=dword:00000050 "Position126"=dword:00000082 "Visible126"=dword:00000000 "Width126"=dword:00000050 "Position127"=dword:00000083 "Visible127"=dword:00000000 "Width127"=dword:00000050 "Position128"=dword:00000084 "Visible128"=dword:00000000 "Width128"=dword:00000050 "Position129"=dword:00000085 "Visible129"=dword:00000000 "Width129"=dword:00000050 "Position130"=dword:00000086 "Visible130"=dword:00000000 "Width130"=dword:00000050 "Position131"=dword:00000087 "Visible131"=dword:00000000 "Width131"=dword:00000050 "Position132"=dword:00000088 "Visible132"=dword:00000000 "Width132"=dword:00000050 "Position133"=dword:00000089 "Visible133"=dword:00000000 "Width133"=dword:00000050 "Position134"=dword:0000008a "Visible134"=dword:00000000 "Width134"=dword:00000050 "Position135"=dword:0000008b "Visible135"=dword:00000000 "Width135"=dword:00000050 "Position136"=dword:0000008c "Visible136"=dword:00000000 "Width136"=dword:00000050 "Position137"=dword:0000008d "Visible137"=dword:00000000 "Width137"=dword:00000050 "Position138"=dword:0000008e "Visible138"=dword:00000000 "Width138"=dword:00000050 "Position139"=dword:0000008f "Visible139"=dword:00000000 "Width139"=dword:00000050 "Position140"=dword:00000090 "Visible140"=dword:00000000 "Width140"=dword:00000050 "Position141"=dword:00000091 "Visible141"=dword:00000000 "Width141"=dword:00000050 "Position142"=dword:00000092 "Visible142"=dword:00000000 "Width142"=dword:00000050 "Position143"=dword:00000093 "Visible143"=dword:00000000 "Width143"=dword:00000050 "Position144"=dword:00000094 "Visible144"=dword:00000000 "Width144"=dword:00000050 "Position145"=dword:00000095 "Visible145"=dword:00000000 "Width145"=dword:00000050 "Position146"=dword:00000004 "Visible146"=dword:00000000 "Width146"=dword:00000037 "Position147"=dword:00000005 "Visible147"=dword:00000000 "Width147"=dword:00000028 "Position148"=dword:00000006 "Visible148"=dword:00000000 "Width148"=dword:00000037 "Position149"=dword:00000007 "Visible149"=dword:00000001 "Width149"=dword:00000028 [HKEY_USERS\S-1-5-21-1482476501-484763869-839522115-1003\Software\G*e*n*i*e*"!\FM Genie Scout 2008\Columns\Staff] "Position0"=dword:00000000 "Visible0"=dword:00000001 "Width0"=dword:0000007d "Position1"=dword:00000001 "Visible1"=dword:00000001 "Width1"=dword:00000064 "Position2"=dword:00000002 "Visible2"=dword:00000001 "Width2"=dword:00000064 "Position3"=dword:00000003 "Visible3"=dword:00000001 "Width3"=dword:0000012c "Position4"=dword:00000005 "Visible4"=dword:00000001 "Width4"=dword:00000028 "Position5"=dword:00000006 "Visible5"=dword:00000001 "Width5"=dword:000000aa "Position6"=dword:00000004 "Visible6"=dword:00000001 "Width6"=dword:00000028 "Position7"=dword:00000007 "Visible7"=dword:00000001 "Width7"=dword:000000b9 "Position8"=dword:00000008 "Visible8"=dword:00000000 "Width8"=dword:00000050 "Position9"=dword:00000009 "Visible9"=dword:00000000 "Width9"=dword:0000004b "Position10"=dword:0000000a "Visible10"=dword:00000000 "Width10"=dword:0000002d "Position11"=dword:0000000b "Visible11"=dword:00000000 "Width11"=dword:0000003c "Position12"=dword:0000000c "Visible12"=dword:00000000 "Width12"=dword:0000004b "Position13"=dword:0000000d "Visible13"=dword:00000000 "Width13"=dword:00000064 "Position14"=dword:0000000e "Visible14"=dword:00000000 "Width14"=dword:00000064 "Position15"=dword:0000000f "Visible15"=dword:00000000 "Width15"=dword:0000004b "Position16"=dword:00000010 "Visible16"=dword:00000000 "Width16"=dword:00000064 "Position17"=dword:00000011 "Visible17"=dword:00000000 "Width17"=dword:0000003c "Position18"=dword:00000012 "Visible18"=dword:00000000 "Width18"=dword:0000004b "Position19"=dword:00000013 "Visible19"=dword:00000000 "Width19"=dword:00000050 "Position20"=dword:00000014 "Visible20"=dword:00000000 "Width20"=dword:00000046 "Position21"=dword:00000015 "Visible21"=dword:00000000 "Width21"=dword:0000004b "Position22"=dword:00000016 "Visible22"=dword:00000000 "Width22"=dword:00000046 "Position23"=dword:00000017 "Visible23"=dword:00000000 "Width23"=dword:00000046 "Position24"=dword:00000018 "Visible24"=dword:00000000 "Width24"=dword:0000003c "Position25"=dword:00000019 "Visible25"=dword:00000000 "Width25"=dword:00000041 "Position26"=dword:0000001a "Visible26"=dword:00000000 "Width26"=dword:0000003c "Position27"=dword:0000001b "Visible27"=dword:00000000 "Width27"=dword:00000055 "Position28"=dword:0000001c "Visible28"=dword:00000000 "Width28"=dword:00000069 "Position29"=dword:0000001d "Visible29"=dword:00000000 "Width29"=dword:0000006e "Position30"=dword:0000001e "Visible30"=dword:00000000 "Width30"=dword:00000064 "Position31"=dword:0000001f "Visible31"=dword:00000000 "Width31"=dword:00000078 "Position32"=dword:00000020 "Visible32"=dword:00000000 "Width32"=dword:00000064 "Position33"=dword:00000021 "Visible33"=dword:00000000 "Width33"=dword:00000087 "Position34"=dword:00000022 "Visible34"=dword:00000000 "Width34"=dword:00000069 "Position35"=dword:00000023 "Visible35"=dword:00000000 "Width35"=dword:0000006e "Position36"=dword:00000024 "Visible36"=dword:00000000 "Width36"=dword:00000073 "Position37"=dword:00000025 "Visible37"=dword:00000000 "Width37"=dword:0000004b "Position38"=dword:00000026 "Visible38"=dword:00000000 "Width38"=dword:0000002d "Position39"=dword:00000027 "Visible39"=dword:00000000 "Width39"=dword:00000055 "Position40"=dword:00000028 "Visible40"=dword:00000000 "Width40"=dword:00000046 "Position41"=dword:00000029 "Visible41"=dword:00000000 "Width41"=dword:0000004b "Position42"=dword:0000002a "Visible42"=dword:00000000 "Width42"=dword:0000003c "Position43"=dword:0000002b "Visible43"=dword:00000000 "Width43"=dword:00000046 "Position44"=dword:0000002c "Visible44"=dword:00000000 "Width44"=dword:00000073 "Position45"=dword:0000002d "Visible45"=dword:00000000 "Width45"=dword:0000004b "Position46"=dword:0000002e "Visible46"=dword:00000000 "Width46"=dword:00000073 "Position47"=dword:0000002f "Visible47"=dword:00000000 "Width47"=dword:0000007d "Position48"=dword:00000030 "Visible48"=dword:00000000 "Width48"=dword:0000006e "Position49"=dword:00000031 "Visible49"=dword:00000000 "Width49"=dword:00000037 "Position50"=dword:00000032 "Visible50"=dword:00000000 "Width50"=dword:00000064 "Position51"=dword:00000033 "Visible51"=dword:00000000 "Width51"=dword:00000037 "Position52"=dword:00000034 "Visible52"=dword:00000000 "Width52"=dword:0000004b "Position53"=dword:00000035 "Visible53"=dword:00000000 "Width53"=dword:00000046 "Position54"=dword:00000036 "Visible54"=dword:00000000 "Width54"=dword:00000037 "Position55"=dword:00000037 "Visible55"=dword:00000000 "Width55"=dword:0000003c "Position56"=dword:00000038 "Visible56"=dword:00000000 "Width56"=dword:00000055 "Position57"=dword:00000039 "Visible57"=dword:00000000 "Width57"=dword:0000003c "Position58"=dword:0000003a "Visible58"=dword:00000000 "Width58"=dword:0000003c "Position59"=dword:0000003b "Visible59"=dword:00000000 "Width59"=dword:00000055 "Position60"=dword:0000003c "Visible60"=dword:00000000 "Width60"=dword:00000046 "Position61"=dword:0000003d "Visible61"=dword:00000000 "Width61"=dword:0000004b "Position62"=dword:0000003e "Visible62"=dword:00000000 "Width62"=dword:00000055 "Position63"=dword:0000003f "Visible63"=dword:00000000 "Width63"=dword:0000005a "Position64"=dword:00000040 "Visible64"=dword:00000000 "Width64"=dword:0000006e "Position65"=dword:00000041 "Visible65"=dword:00000000 "Width65"=dword:00000050 "Position66"=dword:00000042 "Visible66"=dword:00000000 "Width66"=dword:00000032 "Position67"=dword:00000043 "Visible67"=dword:00000000 "Width67"=dword:00000064 "Position68"=dword:00000044 "Visible68"=dword:00000000 "Width68"=dword:0000004b "Position69"=dword:00000045 "Visible69"=dword:00000000 "Width69"=dword:0000002d "Position70"=dword:00000046 "Visible70"=dword:00000000 "Width70"=dword:0000004b "Position71"=dword:00000047 "Visible71"=dword:00000000 "Width71"=dword:0000005a "Position72"=dword:00000048 "Visible72"=dword:00000000 "Width72"=dword:0000005a "Position73"=dword:00000049 "Visible73"=dword:00000000 "Width73"=dword:00000050 "Position74"=dword:0000004a "Visible74"=dword:00000000 "Width74"=dword:0000004b "Position75"=dword:0000004b "Visible75"=dword:00000000 "Width75"=dword:00000050 "Position76"=dword:0000004c "Visible76"=dword:00000000 "Width76"=dword:0000005a "Position77"=dword:0000004d "Visible77"=dword:00000000 "Width77"=dword:00000041 "Position78"=dword:0000004e "Visible78"=dword:00000000 "Width78"=dword:00000041 "Position79"=dword:0000004f "Visible79"=dword:00000000 "Width79"=dword:00000041 "Position80"=dword:00000050 "Visible80"=dword:00000000 "Width80"=dword:00000041 "Position81"=dword:00000051 "Visible81"=dword:00000000 "Width81"=dword:00000041 "Position82"=dword:00000052 "Visible82"=dword:00000000 "Width82"=dword:00000041 "Position83"=dword:00000053 "Visible83"=dword:00000000 "Width83"=dword:00000041 "Position84"=dword:00000054 "Visible84"=dword:00000000 "Width84"=dword:00000041 "Position85"=dword:00000055 "Visible85"=dword:00000000 "Width85"=dword:00000041 "Position86"=dword:00000056 "Visible86"=dword:00000000 "Width86"=dword:00000050 [HKEY_USERS\S-1-5-21-1482476501-484763869-839522115-1003\Software\G*e*n*i*e*"!\FM Genie Scout 2008\Rating Coefficients] "GKWeightCoef"=dword:00000064 "GKCurrentAbilityCoef"=dword:00000000 "GKCornersCoef"=dword:00000000 "GKCrossingCoef"=dword:00000000 "GKDribblingCoef"=dword:00000000 "GKFinishingCoef"=dword:00000000 "GKFirstTouchCoef"=dword:00000000 "GKFreeKicksCoef"=dword:00000000 "GKHeadingCoef"=dword:00000000 "GKLongShotsCoef"=dword:00000000 "GKLongThrowsCoef"=dword:00000000 "GKMarkingCoef"=dword:00000000 "GKPassingCoef"=dword:00000000 "GKPenaltiesCoef"=dword:00000000 "GKTacklingCoef"=dword:00000005 "GKTechniqueCoef"=dword:00000000 "GKLeftFootCoef"=dword:00000000 "GKRightFootCoef"=dword:00000000 "GKAggressionCoef"=dword:0000000a "GKAnticipationCoef"=dword:00000005 "GKBraveryCoef"=dword:00000014 "GKComposureCoef"=dword:00000014 "GKConcentrationCoef"=dword:0000000a "GKConsistencyCoef"=dword:0000000a "GKCreativityCoef"=dword:00000000 "GKDecisionsCoef"=dword:00000014 "GKDeterminationCoef"=dword:0000000a "GKDirtinessCoef"=dword:fffffffb "GKFlairCoef"=dword:00000000 "GKImportantMatchesCoef"=dword:0000000a "GKInfluenceCoef"=dword:0000000a "GKOffTheBallCoef"=dword:00000000 "GKPositioningCoef"=dword:00000050 "GKTeamworkCoef"=dword:00000005 "GKWorkRateCoef"=dword:00000000 "GKAccelerationCoef"=dword:00000005 "GKAgilityCoef"=dword:0000000a "GKBalanceCoef"=dword:0000000a "GKInjuryPronenessCoef"=dword:fffffffb "GKJumpingCoef"=dword:00000050 "GKNaturalFitnessCoef"=dword:00000005 "GKPaceCoef"=dword:00000000 "GKStaminaCoef"=dword:00000000 "GKStrengthCoef"=dword:0000000a "GKVersatilityCoef"=dword:00000000 "GKAerialAbilityCoef"=dword:00000032 "GKCommandOfAreaCoef"=dword:00000014 "GKCommunicationCoef"=dword:00000032 "GKEccentricityCoef"=dword:ffffffec "GKHandlingCoef"=dword:00000064 "GKKickingCoef"=dword:0000000a "GKOneOnOnesCoef"=dword:00000032 "GKReflexesCoef"=dword:00000064 "GKRushingOutCoef"=dword:00000014 "GKTendencyToPunchCoef"=dword:fffffff6 "GKThrowingCoef"=dword:0000000a "GKAdaptabilityCoef"=dword:00000005 "GKAmbitionCoef"=dword:0000000a "GKControversyCoef"=dword:fffffffb "GKLoyalityCoef"=dword:00000005 "GKPressureCoef"=dword:00000005 "GKProfessionalismCoef"=dword:00000005 "GKSportsmanshipCoef"=dword:00000005 "GKTemperamentCoef"=dword:00000005 "SWWeightCoef"=dword:00000066 "SWCurrentAbilityCoef"=dword:00000000 "SWCornersCoef"=dword:00000000 "SWCrossingCoef"=dword:00000000 "SWDribblingCoef"=dword:00000000 "SWFinishingCoef"=dword:00000000 "SWFirstTouchCoef"=dword:00000014 "SWFreeKicksCoef"=dword:0000000a "SWHeadingCoef"=dword:00000064 "SWLongShotsCoef"=dword:0000000a "SWLongThrowsCoef"=dword:00000000 "SWMarkingCoef"=dword:00000064 "SWPassingCoef"=dword:0000000a "SWPenaltiesCoef"=dword:00000005 "SWTacklingCoef"=dword:00000064 "SWTechniqueCoef"=dword:0000000a "SWLeftFootCoef"=dword:00000005 "SWRightFootCoef"=dword:00000005 "SWAggressionCoef"=dword:00000014 "SWAnticipationCoef"=dword:00000014 "SWBraveryCoef"=dword:00000028 "SWComposureCoef"=dword:00000028 "SWConcentrationCoef"=dword:0000003c "SWConsistencyCoef"=dword:0000000a "SWCreativityCoef"=dword:0000000a "SWDecisionsCoef"=dword:00000014 "SWDeterminationCoef"=dword:0000000a "SWDirtinessCoef"=dword:ffffffe7 "SWFlairCoef"=dword:00000000 "SWImportantMatchesCoef"=dword:0000000a "SWInfluenceCoef"=dword:0000000a "SWOffTheBallCoef"=dword:0000000a "SWPositioningCoef"=dword:00000064 "SWTeamworkCoef"=dword:00000028 "SWWorkRateCoef"=dword:00000014 "SWAccelerationCoef"=dword:0000001e "SWAgilityCoef"=dword:0000000a "SWBalanceCoef"=dword:00000014 "SWInjuryPronenessCoef"=dword:fffffffb "SWJumpingCoef"=dword:00000064 "SWNaturalFitnessCoef"=dword:00000005 "SWPaceCoef"=dword:00000014 "SWStaminaCoef"=dword:0000000a "SWStrengthCoef"=dword:00000050 "SWVersatilityCoef"=dword:00000005 "SWAerialAbilityCoef"=dword:00000000 "SWCommandOfAreaCoef"=dword:00000000 "SWCommunicationCoef"=dword:00000000 "SWEccentricityCoef"=dword:00000000 "SWHandlingCoef"=dword:00000000 "SWKickingCoef"=dword:00000000 "SWOneOnOnesCoef"=dword:00000005 "SWReflexesCoef"=dword:00000005 "SWRushingOutCoef"=dword:00000000 "SWTendencyToPunchCoef"=dword:00000000 "SWThrowingCoef"=dword:00000000 "SWAdaptabilityCoef"=dword:00000005 "SWAmbitionCoef"=dword:0000000a "SWControversyCoef"=dword:fffffffb "SWLoyalityCoef"=dword:00000005 "SWPressureCoef"=dword:00000005 "SWProfessionalismCoef"=dword:00000005 "SWSportsmanshipCoef"=dword:00000005 "SWTemperamentCoef"=dword:00000005 "CBWeightCoef"=dword:00000064 "CBCurrentAbilityCoef"=dword:00000000 "CBCornersCoef"=dword:00000000 "CBCrossingCoef"=dword:00000000 "CBDribblingCoef"=dword:00000000 "CBFinishingCoef"=dword:00000000 "CBFirstTouchCoef"=dword:00000014 "CBFreeKicksCoef"=dword:0000000a "CBHeadingCoef"=dword:00000064 "CBLongShotsCoef"=dword:0000000a "CBLongThrowsCoef"=dword:00000000 "CBMarkingCoef"=dword:00000050 "CBPassingCoef"=dword:00000014 "CBPenaltiesCoef"=dword:00000005 "CBTacklingCoef"=dword:00000064 "CBTechniqueCoef"=dword:0000000a "CBLeftFootCoef"=dword:00000005 "CBRightFootCoef"=dword:00000005 "CBAggressionCoef"=dword:00000014 "CBAnticipationCoef"=dword:00000014 "CBBraveryCoef"=dword:00000028 "CBComposureCoef"=dword:00000014 "CBConcentrationCoef"=dword:00000028 "CBConsistencyCoef"=dword:0000000a "CBCreativityCoef"=dword:0000000a "CBDecisionsCoef"=dword:00000014 "CBDeterminationCoef"=dword:0000000a "CBDirtinessCoef"=dword:ffffffec "CBFlairCoef"=dword:00000000 "CBImportantMatchesCoef"=dword:0000000a "CBInfluenceCoef"=dword:0000000a "CBOffTheBallCoef"=dword:0000000a "CBPositioningCoef"=dword:00000050 "CBTeamworkCoef"=dword:00000028 "CBWorkRateCoef"=dword:00000014 "CBAccelerationCoef"=dword:00000028 "CBAgilityCoef"=dword:0000000a "CBBalanceCoef"=dword:00000014 "CBInjuryPronenessCoef"=dword:fffffffb "CBJumpingCoef"=dword:00000064 "CBNaturalFitnessCoef"=dword:00000005 "CBPaceCoef"=dword:0000001e "CBStaminaCoef"=dword:0000000a "CBStrengthCoef"=dword:0000003c "CBVersatilityCoef"=dword:00000005 "CBAerialAbilityCoef"=dword:00000000 "CBCommandOfAreaCoef"=dword:00000000 "CBCommunicationCoef"=dword:00000000 "CBEccentricityCoef"=dword:00000000 "CBHandlingCoef"=dword:00000000 "CBKickingCoef"=dword:00000000 "CBOneOnOnesCoef"=dword:00000005 "CBReflexesCoef"=dword:00000005 "CBRushingOutCoef"=dword:00000000 "CBTendencyToPunchCoef"=dword:00000000 "CBThrowingCoef"=dword:00000000 "CBAdaptabilityCoef"=dword:00000005 "CBAmbitionCoef"=dword:0000000a "CBControversyCoef"=dword:fffffffb "CBLoyalityCoef"=dword:00000005 "CBPressureCoef"=dword:00000005 "CBProfessionalismCoef"=dword:00000005 "CBSportsmanshipCoef"=dword:00000005 "CBTemperamentCoef"=dword:00000005 "FBWeightCoef"=dword:0000006c "FBCurrentAbilityCoef"=dword:00000000 "FBCornersCoef"=dword:0000000a "FBCrossingCoef"=dword:0000001e "FBDribblingCoef"=dword:00000014 "FBFinishingCoef"=dword:00000000 "FBFirstTouchCoef"=dword:00000014 "FBFreeKicksCoef"=dword:0000000a "FBHeadingCoef"=dword:0000003c "FBLongShotsCoef"=dword:0000000a "FBLongThrowsCoef"=dword:0000000a "FBMarkingCoef"=dword:0000003c "FBPassingCoef"=dword:0000001e "FBPenaltiesCoef"=dword:00000005 "FBTacklingCoef"=dword:00000064 "FBTechniqueCoef"=dword:00000014 "FBLeftFootCoef"=dword:00000005 "FBRightFootCoef"=dword:00000005 "FBAggressionCoef"=dword:0000000f &q

SeiFeR_HxC · Answer

Et la fin du rapport ^^ :




"FBAnticipationCoef"=dword:00000050
"FBBraveryCoef"=dword:00000014
"FBComposureCoef"=dword:0000000a
"FBConcentrationCoef"=dword:0000001e
"FBConsistencyCoef"=dword:0000000a
"FBCreativityCoef"=dword:0000000a
"FBDecisionsCoef"=dword:00000014
"FBDeterminationCoef"=dword:0000000a
"FBDirtinessCoef"=dword:fffffff6
"FBFlairCoef"=dword:00000005
"FBImportantMatchesCoef"=dword:0000000a
"FBInfluenceCoef"=dword:0000000a
"FBOffTheBallCoef"=dword:00000014
"FBPositioningCoef"=dword:00000064
"FBTeamworkCoef"=dword:00000014
"FBWorkRateCoef"=dword:00000014
"FBAccelerationCoef"=dword:0000003c
"FBAgilityCoef"=dword:0000000a
"FBBalanceCoef"=dword:00000014
"FBInjuryPronenessCoef"=dword:fffffffb
"FBJumpingCoef"=dword:0000003c
"FBNaturalFitnessCoef"=dword:00000005
"FBPaceCoef"=dword:00000050
"FBStaminaCoef"=dword:0000003c
"FBStrengthCoef"=dword:00000028
"FBVersatilityCoef"=dword:00000005
"FBAerialAbilityCoef"=dword:00000000
"FBCommandOfAreaCoef"=dword:00000000
"FBCommunicationCoef"=dword:00000000
"FBEccentricityCoef"=dword:00000000
"FBHandlingCoef"=dword:00000000
"FBKickingCoef"=dword:00000000
"FBOneOnOnesCoef"=dword:00000005
"FBReflexesCoef"=dword:00000005
"FBRushingOutCoef"=dword:00000000
"FBTendencyToPunchCoef"=dword:00000000
"FBThrowingCoef"=dword:00000000
"FBAdaptabilityCoef"=dword:00000005
"FBAmbitionCoef"=dword:0000000a
"FBControversyCoef"=dword:fffffffb
"FBLoyalityCoef"=dword:00000005
"FBPressureCoef"=dword:00000005
"FBProfessionalismCoef"=dword:00000005
"FBSportsmanshipCoef"=dword:00000005
"FBTemperamentCoef"=dword:00000005
"WBWeightCoef"=dword:0000006e
"WBCurrentAbilityCoef"=dword:00000000
"WBCornersCoef"=dword:0000000a
"WBCrossingCoef"=dword:0000003c
"WBDribblingCoef"=dword:00000028
"WBFinishingCoef"=dword:0000000a
"WBFirstTouchCoef"=dword:00000014
"WBFreeKicksCoef"=dword:0000000a
"WBHeadingCoef"=dword:00000028
"WBLongShotsCoef"=dword:00000014
"WBLongThrowsCoef"=dword:0000000a
"WBMarkingCoef"=dword:0000003c
"WBPassingCoef"=dword:00000028
"WBPenaltiesCoef"=dword:00000005
"WBTacklingCoef"=dword:00000064
"WBTechniqueCoef"=dword:00000028
"WBLeftFootCoef"=dword:00000005
"WBRightFootCoef"=dword:00000005
"WBAggressionCoef"=dword:0000000a
"WBAnticipationCoef"=dword:00000050
"WBBraveryCoef"=dword:0000000a
"WBComposureCoef"=dword:0000000a
"WBConcentrationCoef"=dword:00000014
"WBConsistencyCoef"=dword:0000000a
"WBCreativityCoef"=dword:00000014
"WBDecisionsCoef"=dword:00000014
"WBDeterminationCoef"=dword:0000000a
"WBDirtinessCoef"=dword:fffffff6
"WBFlairCoef"=dword:0000000a
"WBImportantMatchesCoef"=dword:0000000a
"WBInfluenceCoef"=dword:0000000a
"WBOffTheBallCoef"=dword:00000014
"WBPositioningCoef"=dword:00000064
"WBTeamworkCoef"=dword:00000014
"WBWorkRateCoef"=dword:00000028
"WBAccelerationCoef"=dword:00000050
"WBAgilityCoef"=dword:0000000a
"WBBalanceCoef"=dword:00000014
"WBInjuryPronenessCoef"=dword:fffffffb
"WBJumpingCoef"=dword:00000014
"WBNaturalFitnessCoef"=dword:00000005
"WBPaceCoef"=dword:00000064
"WBStaminaCoef"=dword:00000050
"WBStrengthCoef"=dword:00000028
"WBVersatilityCoef"=dword:00000005
"WBAerialAbilityCoef"=dword:00000000
"WBCommandOfAreaCoef"=dword:00000000
"WBCommunicationCoef"=dword:00000000
"WBEccentricityCoef"=dword:00000000
"WBHandlingCoef"=dword:00000000
"WBKickingCoef"=dword:00000000
"WBOneOnOnesCoef"=dword:00000005
"WBReflexesCoef"=dword:00000005
"WBRushingOutCoef"=dword:00000000
"WBTendencyToPunchCoef"=dword:00000000
"WBThrowingCoef"=dword:00000000
"WBAdaptabilityCoef"=dword:00000005
"WBAmbitionCoef"=dword:0000000a
"WBControversyCoef"=dword:fffffffb
"WBLoyalityCoef"=dword:00000005
"WBPressureCoef"=dword:00000005
"WBProfessionalismCoef"=dword:00000005
"WBSportsmanshipCoef"=dword:00000005
"WBTemperamentCoef"=dword:00000005
"DMWeightCoef"=dword:00000069
"DMCurrentAbilityCoef"=dword:00000000
"DMCornersCoef"=dword:0000000a
"DMCrossingCoef"=dword:0000001e
"DMDribblingCoef"=dword:00000014
"DMFinishingCoef"=dword:0000000a
"DMFirstTouchCoef"=dword:0000001e
"DMFreeKicksCoef"=dword:0000000a
"DMHeadingCoef"=dword:00000028
"DMLongShotsCoef"=dword:00000014
"DMLongThrowsCoef"=dword:00000005
"DMMarkingCoef"=dword:0000003c
"DMPassingCoef"=dword:00000028
"DMPenaltiesCoef"=dword:00000005
"DMTacklingCoef"=dword:00000064
"DMTechniqueCoef"=dword:0000001e
"DMLeftFootCoef"=dword:00000005
"DMRightFootCoef"=dword:00000005
"DMAggressionCoef"=dword:00000028
"DMAnticipationCoef"=dword:00000028
"DMBraveryCoef"=dword:00000014
"DMComposureCoef"=dword:0000000a
"DMConcentrationCoef"=dword:00000014
"DMConsistencyCoef"=dword:0000000a
"DMCreativityCoef"=dword:00000014
"DMDecisionsCoef"=dword:00000014
"DMDeterminationCoef"=dword:0000000a
"DMDirtinessCoef"=dword:fffffff6
"DMFlairCoef"=dword:0000000a
"DMImportantMatchesCoef"=dword:0000000a
"DMInfluenceCoef"=dword:0000000a
"DMOffTheBallCoef"=dword:0000001e
"DMPositioningCoef"=dword:00000050
"DMTeamworkCoef"=dword:00000028
"DMWorkRateCoef"=dword:00000050
"DMAccelerationCoef"=dword:00000028
"DMAgilityCoef"=dword:0000000a
"DMBalanceCoef"=dword:0000000a
"DMInjuryPronenessCoef"=dword:fffffffb
"DMJumpingCoef"=dword:00000028
"DMNaturalFitnessCoef"=dword:00000005
"DMPaceCoef"=dword:00000028
"DMStaminaCoef"=dword:0000003c
"DMStrengthCoef"=dword:00000028
"DMVersatilityCoef"=dword:00000005
"DMAerialAbilityCoef"=dword:00000000
"DMCommandOfAreaCoef"=dword:00000000
"DMCommunicationCoef"=dword:00000000
"DMEccentricityCoef"=dword:00000000
"DMHandlingCoef"=dword:00000000
"DMKickingCoef"=dword:00000000
"DMOneOnOnesCoef"=dword:00000005
"DMReflexesCoef"=dword:00000005
"DMRushingOutCoef"=dword:00000000
"DMTendencyToPunchCoef"=dword:00000000
"DMThrowingCoef"=dword:00000000
"DMAdaptabilityCoef"=dword:00000005
"DMAmbitionCoef"=dword:0000000a
"DMControversyCoef"=dword:fffffffb
"DMLoyalityCoef"=dword:00000005
"DMPressureCoef"=dword:00000005
"DMProfessionalismCoef"=dword:00000005
"DMSportsmanshipCoef"=dword:00000005
"DMTemperamentCoef"=dword:00000005
"MWeightCoef"=dword:0000006a
"MCurrentAbilityCoef"=dword:00000000
"MCornersCoef"=dword:0000000a
"MCrossingCoef"=dword:00000028
"MDribblingCoef"=dword:00000032
"MFinishingCoef"=dword:00000014
"MFirstTouchCoef"=dword:0000001e
"MFreeKicksCoef"=dword:0000000a
"MHeadingCoef"=dword:0000001e
"MLongShotsCoef"=dword:00000014
"MLongThrowsCoef"=dword:00000005
"MMarkingCoef"=dword:00000028
"MPassingCoef"=dword:00000046
"MPenaltiesCoef"=dword:00000005
"MTacklingCoef"=dword:0000003c
"MTechniqueCoef"=dword:00000032
"MLeftFootCoef"=dword:00000005
"MRightFootCoef"=dword:00000005
"MAggressionCoef"=dword:0000001e
"MAnticipationCoef"=dword:00000028
"MBraveryCoef"=dword:0000000a
"MComposureCoef"=dword:0000000a
"MConcentrationCoef"=dword:0000000a
"MConsistencyCoef"=dword:0000000a
"MCreativityCoef"=dword:0000003c
"MDecisionsCoef"=dword:0000001e
"MDeterminationCoef"=dword:0000000a
"MDirtinessCoef"=dword:fffffffb
"MFlairCoef"=dword:0000000a
"MImportantMatchesCoef"=dword:0000000a
"MInfluenceCoef"=dword:0000000a
"MOffTheBallCoef"=dword:00000028
"MPositioningCoef"=dword:00000028
"MTeamworkCoef"=dword:00000032
"MWorkRateCoef"=dword:00000032
"MAccelerationCoef"=dword:00000032
"MAgilityCoef"=dword:0000000a
"MBalanceCoef"=dword:0000000a
"MInjuryPronenessCoef"=dword:fffffffb
"MJumpingCoef"=dword:00000028
"MNaturalFitnessCoef"=dword:00000005
"MPaceCoef"=dword:00000028
"MStaminaCoef"=dword:0000003c
"MStrengthCoef"=dword:0000001e
"MVersatilityCoef"=dword:00000005
"MAerialAbilityCoef"=dword:00000000
"MCommandOfAreaCoef"=dword:00000000
"MCommunicationCoef"=dword:00000000
"MEccentricityCoef"=dword:00000000
"MHandlingCoef"=dword:00000000
"MKickingCoef"=dword:00000000
"MOneOnOnesCoef"=dword:00000005
"MReflexesCoef"=dword:00000005
"MRushingOutCoef"=dword:00000000
"MTendencyToPunchCoef"=dword:00000000
"MThrowingCoef"=dword:00000000
"MAdaptabilityCoef"=dword:00000005
"MAmbitionCoef"=dword:0000000a
"MControversyCoef"=dword:fffffffb
"MLoyalityCoef"=dword:00000005
"MPressureCoef"=dword:00000005
"MProfessionalismCoef"=dword:00000005
"MSportsmanshipCoef"=dword:00000005
"MTemperamentCoef"=dword:00000005
"AMWeightCoef"=dword:00000069
"AMCurrentAbilityCoef"=dword:00000000
"AMCornersCoef"=dword:0000000a
"AMCrossingCoef"=dword:0000003c
"AMDribblingCoef"=dword:00000050
"AMFinishingCoef"=dword:00000028
"AMFirstTouchCoef"=dword:0000001e
"AMFreeKicksCoef"=dword:0000000a
"AMHeadingCoef"=dword:00000014
"AMLongShotsCoef"=dword:00000014
"AMLongThrowsCoef"=dword:00000005
"AMMarkingCoef"=dword:0000000a
"AMPassingCoef"=dword:00000064
"AMPenaltiesCoef"=dword:00000005
"AMTacklingCoef"=dword:0000000a
"AMTechniqueCoef"=dword:00000050
"AMLeftFootCoef"=dword:00000005
"AMRightFootCoef"=dword:00000005
"AMAggressionCoef"=dword:0000000a
"AMAnticipationCoef"=dword:0000001e
"AMBraveryCoef"=dword:0000000a
"AMComposureCoef"=dword:0000000a
"AMConcentrationCoef"=dword:0000000a
"AMConsistencyCoef"=dword:0000000a
"AMCreativityCoef"=dword:00000064
"AMDecisionsCoef"=dword:00000028
"AMDeterminationCoef"=dword:0000000a
"AMDirtinessCoef"=dword:fffffffb
"AMFlairCoef"=dword:00000014
"AMImportantMatchesCoef"=dword:0000000a
"AMInfluenceCoef"=dword:0000000a
"AMOffTheBallCoef"=dword:0000003c
"AMPositioningCoef"=dword:00000014
"AMTeamworkCoef"=dword:0000003c
"AMWorkRateCoef"=dword:00000014
"AMAccelerationCoef"=dword:0000003c
"AMAgilityCoef"=dword:0000000a
"AMBalanceCoef"=dword:0000000a
"AMInjuryPronenessCoef"=dword:fffffffb
"AMJumpingCoef"=dword:00000014
"AMNaturalFitnessCoef"=dword:00000005
"AMPaceCoef"=dword:0000003c
"AMStaminaCoef"=dword:0000003c
"AMStrengthCoef"=dword:00000014
"AMVersatilityCoef"=dword:00000005
"AMAerialAbilityCoef"=dword:00000000
"AMCommandOfAreaCoef"=dword:00000000
"AMCommunicationCoef"=dword:00000000
"AMEccentricityCoef"=dword:00000000
"AMHandlingCoef"=dword:00000000
"AMKickingCoef"=dword:00000000
"AMOneOnOnesCoef"=dword:00000005
"AMReflexesCoef"=dword:00000005
"AMRushingOutCoef"=dword:00000000
"AMTendencyToPunchCoef"=dword:00000000
"AMThrowingCoef"=dword:00000000
"AMAdaptabilityCoef"=dword:00000005
"AMAmbitionCoef"=dword:0000000a
"AMControversyCoef"=dword:fffffffb
"AMLoyalityCoef"=dword:00000005
"AMPressureCoef"=dword:00000005
"AMProfessionalismCoef"=dword:00000005
"AMSportsmanshipCoef"=dword:00000005
"AMTemperamentCoef"=dword:00000005
"WWeightCoef"=dword:00000069
"WCurrentAbilityCoef"=dword:00000000
"WCornersCoef"=dword:0000000a
"WCrossingCoef"=dword:00000064
"WDribblingCoef"=dword:00000064
"WFinishingCoef"=dword:0000003c
"WFirstTouchCoef"=dword:0000001e
"WFreeKicksCoef"=dword:0000000a
"WHeadingCoef"=dword:00000014
"WLongShotsCoef"=dword:00000014
"WLongThrowsCoef"=dword:00000005
"WMarkingCoef"=dword:0000000a
"WPassingCoef"=dword:0000003c
"WPenaltiesCoef"=dword:00000005
"WTacklingCoef"=dword:0000000a
"WTechniqueCoef"=dword:00000050
"WLeftFootCoef"=dword:00000005
"WRightFootCoef"=dword:00000005
"WAggressionCoef"=dword:0000000a
"WAnticipationCoef"=dword:00000014
"WBraveryCoef"=dword:0000000a
"WComposureCoef"=dword:0000000a
"WConcentrationCoef"=dword:0000000a
"WConsistencyCoef"=dword:0000000a
"WCreativityCoef"=dword:0000003c
"WDecisionsCoef"=dword:00000014
"WDeterminationCoef"=dword:0000000a
"WDirtinessCoef"=dword:fffffffb
"WFlairCoef"=dword:0000000a
"WImportantMatchesCoef"=dword:00000014
"WInfluenceCoef"=dword:0000000a
"WOffTheBallCoef"=dword:0000003c
"WPositioningCoef"=dword:00000014
"WTeamworkCoef"=dword:0000001e
"WWorkRateCoef"=dword:0000001e
"WAccelerationCoef"=dword:00000050
"WAgilityCoef"=dword:00000014
"WBalanceCoef"=dword:0000000a
"WInjuryPronenessCoef"=dword:fffffffb
"WJumpingCoef"=dword:00000014
"WNaturalFitnessCoef"=dword:00000005
"WPaceCoef"=dword:00000064
"WStaminaCoef"=dword:0000003c
"WStrengthCoef"=dword:00000014
"WVersatilityCoef"=dword:00000005
"WAerialAbilityCoef"=dword:00000000
"WCommandOfAreaCoef"=dword:00000000
"WCommunicationCoef"=dword:00000000
"WEccentricityCoef"=dword:00000000
"WHandlingCoef"=dword:00000000
"WKickingCoef"=dword:00000000
"WOneOnOnesCoef"=dword:00000005
"WReflexesCoef"=dword:00000005
"WRushingOutCoef"=dword:00000000
"WTendencyToPunchCoef"=dword:00000000
"WThrowingCoef"=dword:00000000
"WAdaptabilityCoef"=dword:00000005
"WAmbitionCoef"=dword:0000000a
"WControversyCoef"=dword:fffffffb
"WLoyalityCoef"=dword:00000005
"WPressureCoef"=dword:00000005
"WProfessionalismCoef"=dword:00000005
"WSportsmanshipCoef"=dword:00000005
"WTemperamentCoef"=dword:00000005
"FSTWeightCoef"=dword:00000067
"FSTCurrentAbilityCoef"=dword:00000000
"FSTCornersCoef"=dword:0000000a
"FSTCrossingCoef"=dword:0000000a
"FSTDribblingCoef"=dword:00000050
"FSTFinishingCoef"=dword:00000064
"FSTFirstTouchCoef"=dword:00000028
"FSTFreeKicksCoef"=dword:0000000a
"FSTHeadingCoef"=dword:00000028
"FSTLongShotsCoef"=dword:00000014
"FSTLongThrowsCoef"=dword:00000000
"FSTMarkingCoef"=dword:00000000
"FSTPassingCoef"=dword:00000028
"FSTPenaltiesCoef"=dword:00000005
"FSTTacklingCoef"=dword:00000000
"FSTTechniqueCoef"=dword:00000050
"FSTLeftFootCoef"=dword:00000005
"FSTRightFootCoef"=dword:00000005
"FSTAggressionCoef"=dword:0000000a
"FSTAnticipationCoef"=dword:0000000a
"FSTBraveryCoef"=dword:0000000a
"FSTComposureCoef"=dword:0000000a
"FSTConcentrationCoef"=dword:0000000a
"FSTConsistencyCoef"=dword:0000000a
"FSTCreativityCoef"=dword:00000028
"FSTDecisionsCoef"=dword:0000000a
"FSTDeterminationCoef"=dword:0000000a
"FSTDirtinessCoef"=dword:fffffffb
"FSTFlairCoef"=dword:0000000a
"FSTImportantMatchesCoef"=dword:0000000a
"FSTInfluenceCoef"=dword:0000000a
"FSTOffTheBallCoef"=dword:00000050
"FSTPositioningCoef"=dword:0000000a
"FSTTeamworkCoef"=dword:0000000a
"FSTWorkRateCoef"=dword:0000000a
"FSTAccelerationCoef"=dword:00000064
"FSTAgilityCoef"=dword:00000028
"FSTBalanceCoef"=dword:0000000a
"FSTInjuryPronenessCoef"=dword:fffffffb
"FSTJumpingCoef"=dword:00000014
"FSTNaturalFitnessCoef"=dword:00000005
"FSTPaceCoef"=dword:00000064
"FSTStaminaCoef"=dword:00000028
"FSTStrengthCoef"=dword:00000014
"FSTVersatilityCoef"=dword:00000005
"FSTAerialAbilityCoef"=dword:00000000
"FSTCommandOfAreaCoef"=dword:00000000
"FSTCommunicationCoef"=dword:00000000
"FSTEccentricityCoef"=dword:00000000
"FSTHandlingCoef"=dword:00000000
"FSTKickingCoef"=dword:00000000
"FSTOneOnOnesCoef"=dword:00000005
"FSTReflexesCoef"=dword:00000005
"FSTRushingOutCoef"=dword:00000000
"FSTTendencyToPunchCoef"=dword:00000000
"FSTThrowingCoef"=dword:00000000
"FSTAdaptabilityCoef"=dword:00000005
"FSTAmbitionCoef"=dword:0000000a
"FSTControversyCoef"=dword:fffffffb
"FSTLoyalityCoef"=dword:00000005
"FSTPressureCoef"=dword:00000005
"FSTProfessionalismCoef"=dword:00000005
"FSTSportsmanshipCoef"=dword:00000005
"FSTTemperamentCoef"=dword:00000005
"TSTWeightCoef"=dword:00000068
"TSTCurrentAbilityCoef"=dword:00000000
"TSTCornersCoef"=dword:00000000
"TSTCrossingCoef"=dword:0000000a
"TSTDribblingCoef"=dword:0000003c
"TSTFinishingCoef"=dword:00000050
"TSTFirstTouchCoef"=dword:0000001e
"TSTFreeKicksCoef"=dword:0000000a
"TSTHeadingCoef"=dword:00000064
"TSTLongShotsCoef"=dword:00000014
"TSTLongThrowsCoef"=dword:00000000
"TSTMarkingCoef"=dword:00000000
"TSTPassingCoef"=dword:00000028
"TSTPenaltiesCoef"=dword:00000005
"TSTTacklingCoef"=dword:00000000
"TSTTechniqueCoef"=dword:00000028
"TSTLeftFootCoef"=dword:00000005
"TSTRightFootCoef"=dword:00000005
"TSTAggressionCoef"=dword:00000014
"TSTAnticipationCoef"=dword:0000000a
"TSTBraveryCoef"=dword:00000014
"TSTComposureCoef"=dword:0000000a
"TSTConcentrationCoef"=dword:0000000a
"TSTConsistencyCoef"=dword:0000000a
"TSTCreativityCoef"=dword:00000014
"TSTDecisionsCoef"=dword:0000000a
"TSTDeterminationCoef"=dword:0000000a
"TSTDirtinessCoef"=dword:fffffffb
"TSTFlairCoef"=dword:0000000a
"TSTImportantMatchesCoef"=dword:0000000a
"TSTInfluenceCoef"=dword:0000000a
"TSTOffTheBallCoef"=dword:00000050
"TSTPositioningCoef"=dword:00000014
"TSTTeamworkCoef"=dword:0000000a
"TSTWorkRateCoef"=dword:0000000a
"TSTAccelerationCoef"=dword:00000028
"TSTAgilityCoef"=dword:00000014
"TSTBalanceCoef"=dword:00000014
"TSTInjuryPronenessCoef"=dword:fffffffb
"TSTJumpingCoef"=dword:00000064
"TSTNaturalFitnessCoef"=dword:00000005
"TSTPaceCoef"=dword:00000028
"TSTStaminaCoef"=dword:00000014
"TSTStrengthCoef"=dword:00000050
"TSTVersatilityCoef"=dword:00000005
"TSTAerialAbilityCoef"=dword:00000000
"TSTCommandOfAreaCoef"=dword:00000000
"TSTCommunicationCoef"=dword:00000000
"TSTEccentricityCoef"=dword:00000000
"TSTHandlingCoef"=dword:00000000
"TSTKickingCoef"=dword:00000000
"TSTOneOnOnesCoef"=dword:00000005
"TSTReflexesCoef"=dword:00000005
"TSTRushingOutCoef"=dword:00000000
"TSTTendencyToPunchCoef"=dword:00000000
"TSTThrowingCoef"=dword:00000000
"TSTAdaptabilityCoef"=dword:00000005
"TSTAmbitionCoef"=dword:0000000a
"TSTControversyCoef"=dword:fffffffb
"TSTLoyalityCoef"=dword:00000005
"TSTPressureCoef"=dword:00000005
"TSTProfessionalismCoef"=dword:00000005
"TSTSportsmanshipCoef"=dword:00000005
"TSTTemperamentCoef"=dword:00000005

[HKEY_USERS\S-1-5-21-1482476501-484763869-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:28,b3,be,26,64,39,4b,34,8d,51,96,73,c5,fe,ed,1d,3c,3a,38,83,b0,a4,23,
   98,e2,4d,09,90,b2,96,25,c4,67,2e,67,c2,31,5f,8d,b0,ea,19,87,f7,a8,59,a8,0b,\
"??"=hex:cc,ab,78,86,ee,2f,72,45,eb,ce,16,1b,62,bc,94,08

[HKEY_USERS\S-1-5-21-1482476501-484763869-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:57,56,a1,92,18,12,a7,1b,61,aa,10,6b,14,30,80,50,af,0d,4c,f9,d6,
   5d,31,50,12,76,1f,8b,07,59,75,92,c1,0a,77,cc,bf,ce,a4,fa,b2,aa,8a,4e,9e,74,\
"rkeysecu"=hex:f1,d6,bc,b8,67,63,84,4e,19,2d,c5,f4,33,03,1d,9b

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:2e,e8,e1,00,eb,16,2b,de,0b,c6,ef,df,7e,
   63,2d,71,e2,63,26,f1,3f,c8,ff,68,04,c1,56,8b,71,6d,1b,0f,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:46,47,15,b0,92,4b,c7,ef,ed,d0,08,a7,b5,
   92,03,43,6a,9c,d6,61,af,45,84,18,eb,dd,50,36,76,a6,53,23,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,11,2a,6c,4e,7b,
   cc,95,a6,ff,7c,85,e0,43,d4,0e,fe,aa,8f,92,a0,05,0a,c7,bd,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,e0,27,9e,b5,75,
   33,9b,50,86,8c,21,01,be,91,eb,e7,37,57,17,c4,02,60,f0,c8,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,85,68,7c,18,8d,
   13,57,f1,f5,1d,4d,73,a8,13,5c,05,97,25,d0,74,d9,15,03,af,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,38,20,d9,33,bc,
   e3,ef,4f,df,20,58,62,78,6b,cf,c8,4f,a4,c6,10,6b,cc,c7,22,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,36,4c,aa,da,7f,
   01,bf,8a,fb,a7,78,e6,12,2f,9a,ea,23,e9,d5,16,93,c7,2a,09,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,86,0a,cf,e4,12,
   2e,4b,47,01,3a,48,fc,e8,04,4a,f1,c5,84,32,61,fc,82,e3,d0,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,a4,d8,fb,a2,b6,
   10,64,80,f6,0f,4e,58,98,5b,89,c9,f2,8a,f5,84,6c,3a,d0,13,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,ea,76,62,a0,7e,
   6d,7b,d3,3d,ce,ea,26,2d,45,aa,78,8c,b9,1b,bd,ad,e6,11,9f,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:f8,31,0f,a9,5f,a0,ec,fb,cf,4e,30,4d,a5,
   9e,37,fb,2a,b7,cc,b5,b9,7f,41,e7,ef,09,91,57,3d,84,1a,9d,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\WINDOWS\system32\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,2c,eb,26,09,1d,
   da,52,ed,6c,43,2d,1e,aa,22,2f,9c,b3,af,b3,a8,98,19,5c,34,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(604)
c:\program files\Fichiers communs\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ATKKBService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\system32
vsvc32.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32undll32.exe
c:\windows\system32undll32.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Heure de fin: 2009-03-16 18:12:54 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-03-16 17:12:51

Avant-CF: 4,681,326,592 octets libres
Après-CF: 4,645,060,608 octets libres

1849	--- E O F ---	2008-05-16 17:44:47

Utilisateur anonyme · Answer

ça donne quoi chez toi ?

SeiFeR_HxC · Answer

Ha !!! voila , les mise a jour remarche ! spybot s'installe, malwarebytes s'est mis a jour, niquel ! 
et curieusement j'ai gagner 2 GO sur mon DD ? 

Je pense que tout est rentré dans l'ordre, alors vraiment merci beaucoup pour ton aide et ta patience !

Une derniere question, l'antivirus AVG est vraiment efficace ?

Encore merci !!

Utilisateur anonyme · Answer

houla

attend , met malewarebyte a jours et lance un scan rapide stp et post le rapport

SeiFeR_HxC · Answer

Ok ^^ voila le rapport ;


Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1855
Windows 5.1.2600 Service Pack 2

16/03/2009 18:44:26
mbam-log-2009-03-16 (18-44-23).txt

Type de recherche: Examen rapide
Eléments examinés: 68457
Temps écoulé: 6 minute(s), 13 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Hijack.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Hijack.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Hijack.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Utilisateur anonyme · Answer

t as supprimé la selection ? 

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pc-system.fr/ 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

SeiFeR_HxC · Answer

Oui j'ai supprimé la selection

Utilisateur anonyme · Answer

ok passe toolcleaner ensuiet on fera le point ;)

SeiFeR_HxC · Answer

Rapport de ToolsCleaner :



[ Rapport ToolsCleaner version 2.3.2 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\SDFIX: trouvé !
C:\HijackThis: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Fabien\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\Navilog1.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\Navilog1.lnk: trouvé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\Rsit.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\SmitFraudfix: trouvé !
C:\HiJackThis\HijackThis.exe: trouvé !
C:\HiJackThis\hijackthis.log: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Fabien\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\Fabien\Bureau\Navilog1.exe: supprimé !
C:\Documents and Settings\Fabien\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\Navilog1.lnk: supprimé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\SmitFraudFix.exe: supprimé !
C:\HiJackThis\HijackThis.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\OTMoveIt3.exe: supprimé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\Rsit.exe: supprimé !
C:\HiJackThis\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\HijackThis: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\Fabien\Bureau\Procedure Antivirus ALL\SmitFraudfix: supprimé !
C:\Program Files\Navilog1: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !

Utilisateur anonyme · Answer

OK , pour faire le point refais ceci stp :

Télécharge ici : 

http://images.malwareremoval.com/random/RSIT.exe 

random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau. 

Double-clique sur RSIT.exe afin de lancer RSIT. 

Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions). 

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. 

Poste le contenu de log.txt

SeiFeR_HxC · Answer

Rapport RSIT :



Logfile of random's system information tool 1.05 (written by random/random)
Run by Fabien at 2009-03-16 19:02:45
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 5 GB (3%) free of 131 GB
Total RAM: 1022 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:02:54, on 16/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Fabien\Bureau\RSIT.exe
C:\Program Files	rend micro\Fabien.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Peer2Peer-FR Toolbar - {b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - C:\Program Files\Peer2Peer-FR	bPee1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
O4 - Startup: Y'z Toolbar.lnk = C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WiFi Station.lnk = ?
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe


End of file - 10619 bytes

======Scheduled tasks folder======

C:\WINDOWS	asks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll [2008-11-22 304736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper - C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll [2008-02-29 468280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-03-16 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2009-02-19 737776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d}]
Peer2Peer-FR Toolbar - C:\Program Files\Peer2Peer-FR	bPee1.dll [2009-02-05 1881112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-16 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-16 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{b00f3d7d-ecad-4a3b-bcf7-ba5fc1fd0f8d} - Peer2Peer-FR Toolbar - C:\Program Files\Peer2Peer-FR	bPee1.dll [2009-02-05 1881112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-02-09 13680640]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
"NeroFilterCheck"=C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"BluetoothAuthenticationAgent"=C:\WINDOWS\system32\bthprops.cpl [2004-08-20 110592]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2006-11-12 157592]
"LVCOMSX"=C:\WINDOWS\system32\LVCOMSX.EXE [2005-07-19 221184]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program Files\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-16 136600]
"AdobeCS4ServiceManager"=C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2008-08-04 160800]
"VX1000"=C:\WINDOWS\vVX1000.exe [2008-08-04 721936]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"nwiz"=nwiz.exe /install []
"LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe [2005-06-08 217088]
"LogitechVideoRepair"=C:\Program Files\Logitech\Video\ISStart.exe [2005-06-08 458752]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-09-10 289576]
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE [2008-03-15 233472]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-02-09 86016]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-02-11 1273488]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [2007-01-15 147456]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-03 204288]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-07-13 68856]
"LogitechSoftwareUpdate"=C:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]
"Steam"=C:\Program Files\Steam\Steam.exe [2009-02-19 1410296]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE
WiFi Station.lnk - C:\Program Files\Hercules\WiFi Station\WifiStation.exe
Wireless Configuration Utility HW.51.lnk - C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe

C:\Documents and Settings\Fabien\Menu Démarrer\Programmes\Démarrage
RocketDock.lnk - C:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
UberIcon.lnk - C:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
Y'z Toolbar.lnk - C:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoLogOff"=0
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\THQ\Company of Heroes\RelicCOH.exe"="C:\Program Files\THQ\Company of Heroes\RelicCOH.exe:*:Enabled:RelicCOH"
"C:\TYPSoft FTP Server\ftpserv.exe"="C:\TYPSoft FTP Server\ftpserv.exe:*:Enabled:TYPSoft FTP Server"
"C:\Program Files\GOA\Gunbound\GunBound.gme"="C:\Program Files\GOA\Gunbound\GunBound.gme:*:Enabled:GunBound"
"C:\Program Files\MAIET\Gunz\GunzLauncher.exe"="C:\Program Files\MAIET\Gunz\GunzLauncher.exe:*:Enabled:GunzLauncher"
"C:\Program Files\ABC\abc.exe"="C:\Program Files\ABC\abc.exe:*:Enabled:abc"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\GOA\Pangya_Eu\update_eu.exe"="C:\Program Files\GOA\Pangya_Eu\update_eu.exe:*:Enabled:Pangya"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\WINDOWS\system32tcshare.exe"="C:\WINDOWS\system32tcshare.exe:*:Enabled:Partage de l'application RTC"
"C:\Program Files\TVAnts\Tvants.exe"="C:\Program Files\TVAnts\Tvants.exe:*:Enabled:TVAnts"
"C:\Program Files\Last.fm\LastFM.exe"="C:\Program Files\Last.fm\LastFM.exe:*:Enabled:Last.fm"
"C:\Program Files\Soulseek\slsk.exe"="C:\Program Files\Soulseek\slsk.exe:*:Enabled:SoulSeek"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\Team17\Worms Armageddon\wa.exe"="C:\Team17\Worms Armageddon\wa.exe:*:Enabled:Worms Armageddon"
"C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe"="C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix"
"C:\Program Files\Nokia\Nokia Software Updater
su_ui_client.exe"="C:\Program Files\Nokia\Nokia Software Updater
su_ui_client.exe:*:Enabled:Nokia Software Updater"
"C:\Program Files\Fichiers communs\Nokia\Service Layer\A
sl_host_process.exe"="C:\Program Files\Fichiers communs\Nokia\Service Layer\A
sl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\Program Files\OpenTTD\openttd.exe"="C:\Program Files\OpenTTD\openttd.exe:*:Enabled:OpenTTD"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\Program Files\Microsoft LifeCam\LifeEnC2.exe"="C:\Program Files\Microsoft LifeCam\LifeEnC2.exe:*:Enabled:LifeEnC2.exe"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\Program Files\Microsoft LifeCam\LifeTray.exe"="C:\Program Files\Microsoft LifeCam\LifeTray.exe:*:Enabled:LifeTray.exe"
"C:\Program Files\Electronic Arts\BattleForgeBeta\Bootstrapper.exe"="C:\Program Files\Electronic Arts\BattleForgeBeta\Bootstrapper.exe:*:Enabled:BattleForge™ Launcher"
"C:\Program Files\Electronic Arts\BattleForgeBeta\BattleForge.exe"="C:\Program Files\Electronic Arts\BattleForgeBeta\BattleForge.exe:*:Enabled:BattleForge™"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91dc2237-bb2b-11dd-91f7-0018e70439e7}]
shell\AutoRun\command - wscript.exe antinul.vbe
shell\open\command - wscript.exe antinul.vbe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e07e922-791e-11dd-915c-0018e70439e7}]
shell\Auto\command - auto.exe
shell\AutoRun\command - auto.exe


======File associations======

.ini - open - C:\WINDOWS\SYSTEM32\NOTEPAD.EXE %1

======List of files/folders created in the last 1 months======

2009-03-16 19:02:46 ----D---- C:\Program Files	rend micro
2009-03-16 19:02:45 ----D---- C:sit
2009-03-16 18:58:27 ----A---- C:\TCleaner.txt
2009-03-16 18:58:12 ----SHD---- C:\RECYCLER
2009-03-16 18:29:51 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-03-16 18:29:51 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-16 17:52:41 ----A---- C:\WINDOWS\zip.exe
2009-03-16 17:52:41 ----A---- C:\WINDOWS\SWREG.exe
2009-03-16 17:52:41 ----A---- C:\WINDOWS\NIRCMD.exe
2009-03-16 17:52:41 ----A---- C:\WINDOWS\grep.exe
2009-03-16 17:52:40 ----A---- C:\WINDOWS\VFIND.exe
2009-03-16 17:52:40 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-03-16 17:52:40 ----A---- C:\WINDOWS\SWSC.exe
2009-03-16 17:52:40 ----A---- C:\WINDOWS\sed.exe
2009-03-16 17:52:40 ----A---- C:\WINDOWS\fdsv.exe
2009-03-16 17:52:39 ----D---- C:\WINDOWS\ERDNT
2009-03-16 17:34:07 ----D---- C:\Documents and Settings\Fabien\Application Data\WinRAR
2009-03-16 17:10:40 ----D---- C:\WINDOWS\ERUNT
2009-03-16 17:10:40 ----D---- C:\Backups
2009-03-16 16:23:49 ----A---- C:\WINDOWS\system32\javaws.exe
2009-03-16 16:23:49 ----A---- C:\WINDOWS\system32\javaw.exe
2009-03-16 16:23:49 ----A---- C:\WINDOWS\system32\java.exe
2009-03-16 16:23:49 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-03-16 15:43:35 ----A---- C:\cleannavi  DERNIER.txt
2009-03-16 14:58:26 ----A---- C:apport smit 2.txt
2009-03-16 14:41:17 ----A---- C:\WINDOWS\system32	mp.txt
2009-03-16 14:41:13 ----A---- C:apport.txt
2009-03-14 13:39:23 ----AD---- C:\autorun.inf
2009-03-14 13:30:40 ----A---- C:\curr_ver.tmp
2009-03-08 16:05:14 ----D---- C:\Program Files\Avira
2009-03-07 16:59:06 ----HD---- C:\$AVG8.VAULT$
2009-03-07 16:10:53 ----D---- C:\Documents and Settings\All Users\Application Data\avg8
2009-03-02 14:37:48 ----D---- C:\Program Files\Electronic Arts
2009-03-02 14:37:47 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2009-03-02 14:37:47 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2009-03-02 14:37:47 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2009-03-02 14:37:46 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2009-03-02 14:37:46 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2009-03-02 14:37:46 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2009-03-02 14:37:45 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2009-03-01 15:58:25 ----D---- C:\Program Files\Hasbro
2009-02-28 20:56:55 ----D---- C:\Program Files\Risk
2009-02-28 17:52:37 ----D---- C:\Program Files\MagicISO
2009-02-19 23:22:37 ----D---- C:\Program Files\Steam

======List of files/folders modified in the last 1 months======

2009-03-16 19:02:46 ----RD---- C:\Program Files
2009-03-16 18:43:59 ----D---- C:\WINDOWS\Temp
2009-03-16 18:14:01 ----D---- C:\Program Files\Mozilla Firefox
2009-03-16 18:13:03 ----D---- C:\WINDOWS\system32\drivers
2009-03-16 18:13:03 ----D---- C:\WINDOWS\system32
2009-03-16 18:13:01 ----D---- C:\WINDOWS
2009-03-16 18:07:09 ----A---- C:\WINDOWS\system.ini
2009-03-16 18:05:56 ----D---- C:\WINDOWS\system32\CatRoot2
2009-03-16 18:04:30 ----D---- C:\WINDOWS\system32\config
2009-03-16 18:01:29 ----D---- C:\WINDOWS\AppPatch
2009-03-16 18:01:22 ----D---- C:\Program Files\Fichiers communs
2009-03-16 17:58:34 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-03-16 17:11:05 ----A---- C:\WINDOWS
tbtlog.txt
2009-03-16 16:24:49 ----D---- C:\Program Files\Java
2009-03-16 16:24:04 ----SHD---- C:\WINDOWS\Installer
2009-03-16 16:12:41 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-03-16 16:12:32 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-03-16 15:20:53 ----D---- C:\WINDOWS\Prefetch
2009-03-16 14:55:41 ----D---- C:\Program Files\Google
2009-03-16 14:10:08 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-03-16 14:09:42 ----D---- C:\Downloads
2009-03-14 14:14:44 ----D---- C:\Program Files\PokerStars
2009-03-09 17:42:26 ----A---- C:\WINDOWS\NeroDigital.ini
2009-03-09 04:41:05 ----D---- C:\Program Files\Warcraft III
2009-03-08 16:17:29 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-03-08 16:02:13 ----SD---- C:\Documents and Settings\Fabien\Application Data\Microsoft
2009-03-07 17:44:54 ----D---- C:\Program Files\Windows XP Home-Pro-2003 SP2 Crack
2009-03-07 17:21:31 ----D---- C:\Program Files\Har-Bal 2.3
2009-03-06 16:14:33 ----D---- C:\Program Files\BitComet
2009-03-05 16:09:32 ----D---- C:\Program Files\Bonjour
2009-03-04 15:10:03 ----D---- C:\Program Files\FriendBlasterPro
2009-03-02 14:37:48 ----HD---- C:\WINDOWS\inf
2009-03-02 14:37:48 ----D---- C:\WINDOWS\system32\DirectX
2009-02-22 20:18:30 ----D---- C:\WINDOWS
view
2009-02-22 20:18:30 ----D---- C:\WINDOWS\Help
2009-02-22 19:49:58 ----D---- C:\NVIDIA

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 asuskbnt;Enhanced Display Driver Helper Service; C:\WINDOWS\system32\drivers\atkkbnt.sys [2005-10-18 11008]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-16 75072]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2008-03-14 46652]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-11-08 21248]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632]
R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [2002-07-17 16877]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2007-01-28 271360]
R2 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2007-01-28 18048]
R2 Nsynas32;Nsynas32; C:\WINDOWS\system32\drivers\Nsynas32.sys [2001-04-09 17784]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-17 4262912]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS
v4_mini.sys [2009-02-09 6307328]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 W8335XP;IEEE 802.11g Wireless Cardbus/PCI Adapter HW51; C:\WINDOWS\System32\DRIVERS\Mrv8000c.sys [2004-12-24 253440]
S3 amr1nga1;amr1nga1; C:\WINDOWS\system32\drivers\amr1nga1.sys []
S3 BthEnum;Pilote de bloc de demande Bluetooth; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-04 17024]
S3 BthPan;Périphérique Bluetooth (réseau personnel); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-04 100992]
S3 BTHPORT;Pilote de port Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2004-08-19 274944]
S3 BTHUSB;Pilote USB radio Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-04 18944]
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 DSDrv4;DSDrv4; \??\C:\PROGRA~1\K!TV\Plugins\S_Bt8x8\DSDrv4.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-06-29 25280]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-05-27 22016]
S3 MPE;Filtre BDA MPE; C:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-04 15360]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-05-07 17536]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-05-07 20864]
S3 PID_0920;Logitech QuickCam Express(PID_0920); C:\WINDOWS\system32\DRIVERS\LV532AV.SYS [2005-01-31 163328]
S3 RFCOMM;Périphérique Bluetooth (TDI protocole RFCOMM); C:\WINDOWS\system32\DRIVERSfcomm.sys [2004-08-04 59648]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2005-08-30 58320]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2005-08-30 8336]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2005-08-30 94000]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-06-06 8064]
S3 USB28xxBGA;PCTV 70e Device; C:\WINDOWS\system32\DRIVERS\emBDA.sys [2007-01-29 361728]
S3 USB28xxOEM;USB 28xx OEM Filter; C:\WINDOWS\system32\DRIVERS\emOEM.sys [2007-01-29 39680]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-09-10 32000]
S3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2004-08-04 25600]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-05-07 8064]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 VX1000;VX-1000; C:\WINDOWS\system32\DRIVERS\VX1000.sys [2008-08-04 1964432]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\WINDOWS\system32\DRIVERS\xusb21.sys [2007-02-17 52352]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-28 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Planificateur Avira AntiVir Personal - Free Antivirus; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-15 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-15 151297]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-10 116040]
R2 ATKKeyboardService;ATK Keyboard Service; C:\WINDOWS\ATKKBService.exe [2005-10-18 241152]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2004-08-20 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-16 152984]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2008-08-04 164896]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32
vsvc32.exe [2009-02-09 163908]
R2 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2008-09-10 536872]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe [2007-01-15 266240]
R3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-10-27 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-07-11 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-20 14336]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-20 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

Utilisateur anonyme · Answer

il reste des details :

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 


* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)

Tuto : https://sites.google.com/site/toolbarsd/aideenimages
info : https://forum.malekal.com/viewtopic.php?f=45&t=6173

SeiFeR_HxC · Answer

rapport tollbarsd :




   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
   BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
   USER : Fabien ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:127 Go (Free:4 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   G:\ (CD or DVD)
   H:\ (CD or DVD)
   I:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 16/03/2009|19:09 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\windows\system32\blank.htm"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Search Page"="https://www.google.com/?gws_rd=ssl"
   "First Home Page"="http://www.microsoft.com/isapi/redir.dll?Prd=ie&Pver=5.0&Ar=ie5update&O1=b1"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\windows\system32\blank.htm"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Fabien\.housecall6.6\Quarantine\FL 6 + crack.zip.bac_a00604
   C:\DOCUME~1\Fabien\Bureau\Image Line Fruity Loops Studio Producer Edition XXL v6.04\FL 6 + crack.zip
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\01 Oblivion.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\02 Divinations.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\03 Quintessence.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\04 The Czar.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\05 Ghost Of Karelia.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\06 Crack The Skye.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\cover.jpg
   C:\DOCUME~1\Fabien\Bureau\ZIK\VA Upcoming release\Postmortem Promises - A Crack in the Spine of the Gallant.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Foldersottedchrist@hotmail.fr\Image Line Fruity Loops Studio Producer Edition XXL v6.04\FL 6 + crack.zip
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\01 Oblivion.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\02 Divinations.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\03 Quintessence.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\04 The Czar.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\05 Ghost Of Karelia.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\06 Crack The Skye.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\cover.jpg
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\Thumbs.db
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\SharingMetadataottedchrist@hotmail.fr\DFSR\ConflictDelete\FL 6 + crack-{9E33CED3-3D42-4484-94ED-77FBFE6DC744}-v7554.zip
   C:\DOCUME~1\Fabien\Mes documents\Ableton\Presets\Audio Effects\Vinyl Distortion\Crack.adv
   C:\DOCUME~1\ALLUSE~1\Menu Démarrer\Programmes\Windows XP Home-Pro-2003 SP2 Crack
   C:\DOCUME~1\ALLUSE~1\Menu Démarrer\Programmes\Windows XP Home-Pro-2003 SP2 Crack\Donate To DemonSpeed.lnk
   C:\DOCUME~1\ALLUSE~1\Menu Démarrer\Programmes\Windows XP Home-Pro-2003 SP2 Crack\KeyGen.exe.lnk



   1 - "C:\ToolBar SD\TB_1.txt" - 16/03/2009|19:10 - Option : [1]

   -----------\  Fin du rapport a 19:10:10,15

Utilisateur anonyme · Answer

télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 

* Double-clique dessus pour lancer l'installation 
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau 
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche) 
* Patiente jusqu'à la fin du scan 
* Poste le rapport généré (C:\lopR.txt) 


Tutorial ( aide ) : http://bibou0007.com/outils-specifiques-f78/tuto-lop-sd-t956.htm

SeiFeR_HxC · Answer

Rapport Lopsd :



   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
   BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
   USER : Fabien ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:127 Go (Free:4 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
   G:\ (CD or DVD)
   H:\ (CD or DVD)
   I:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 16/03/2009|19:16 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [27/09/2008|02:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [01/12/2007|16:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ACD Systems
   [28/10/2008|01:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [04/09/2007|19:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [28/01/2007|03:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [08/03/2009|16:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
   [08/03/2009|16:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [07/02/2009|21:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [04/01/2009|03:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [27/10/2008|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
   [11/07/2007|14:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [02/11/2008|15:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
   [30/01/2008|21:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [28/11/2007|16:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Last.fm
   [20/10/2008|01:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [07/02/2008|00:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [15/01/2009|00:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [28/01/2007|13:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [11/07/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nokia
   [07/02/2007|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
   [21/01/2007|06:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [04/09/2007|19:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle
   [19/11/2008|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sports Interactive
   [16/03/2009|18:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [19/10/2008|23:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [01/04/2007|15:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Test Drive Unlimited
   [02/02/2007|14:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
   [20/01/2007|20:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

   [16/12/2007|20:48] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [07/05/2007|17:16] C:\DOCUME~1\Fabien\APPLIC~1\.ABC
   [01/12/2007|17:12] C:\DOCUME~1\Fabien\APPLIC~1\Ableton
   [01/12/2007|16:53] C:\DOCUME~1\Fabien\APPLIC~1\ACD Systems
   [28/10/2008|11:58] C:\DOCUME~1\Fabien\APPLIC~1\Adobe
   [19/03/2007|13:11] C:\DOCUME~1\Fabien\APPLIC~1\AdobeUM
   [28/01/2007|13:14] C:\DOCUME~1\Fabien\APPLIC~1\Ahead
   [15/12/2007|16:13] C:\DOCUME~1\Fabien\APPLIC~1\Apple Computer
   [07/02/2009|21:36] C:\DOCUME~1\Fabien\APPLIC~1\AVS4YOU
   [19/01/2009|02:20] C:\DOCUME~1\Fabien\APPLIC~1\Azureus
   [12/04/2007|19:03] C:\DOCUME~1\Fabien\APPLIC~1\Command & Conquer 3 Tiberium Wars
   [07/03/2007|19:01] C:\DOCUME~1\Fabien\APPLIC~1\Command & Conquer 3 Tiberium Wars Demo
   [21/01/2009|22:54] C:\DOCUME~1\Fabien\APPLIC~1\Crayon Physics Deluxe
   [28/01/2007|12:13] C:\DOCUME~1\Fabien\APPLIC~1\DeepBurner
   [08/12/2008|05:43] C:\DOCUME~1\Fabien\APPLIC~1\dvdcss
   [15/09/2007|14:49] C:\DOCUME~1\Fabien\APPLIC~1\fretsonfire
   [05/12/2007|21:23] C:\DOCUME~1\Fabien\APPLIC~1\Google
   [30/06/2008|12:40] C:\DOCUME~1\Fabien\APPLIC~1\Hamachi
   [19/07/2008|13:48] C:\DOCUME~1\Fabien\APPLIC~1\Help
   [20/01/2007|19:37] C:\DOCUME~1\Fabien\APPLIC~1\Identities
   [13/10/2007|19:16] C:\DOCUME~1\Fabien\APPLIC~1\InstallShield
   [04/09/2007|15:10] C:\DOCUME~1\Fabien\APPLIC~1\InstallShield Installation Information
   [28/01/2007|12:05] C:\DOCUME~1\Fabien\APPLIC~1\Macromedia
   [20/10/2008|01:43] C:\DOCUME~1\Fabien\APPLIC~1\Malwarebytes
   [26/11/2008|03:46] C:\DOCUME~1\Fabien\APPLIC~1\Media Player Classic
   [08/03/2009|16:02] C:\DOCUME~1\Fabien\APPLIC~1\Microsoft
   [02/06/2008|18:31] C:\DOCUME~1\Fabien\APPLIC~1\Microsoft Web Folders
   [14/07/2008|11:58] C:\DOCUME~1\Fabien\APPLIC~1\Mozilla
   [19/03/2007|21:34] C:\DOCUME~1\Fabien\APPLIC~1\My Games
   [11/09/2007|21:41] C:\DOCUME~1\Fabien\APPLIC~1\Publish Providers
   [22/11/2008|16:02] C:\DOCUME~1\Fabien\APPLIC~1\Real
   [11/12/2007|20:08] C:\DOCUME~1\Fabien\APPLIC~1\Samsung
   [01/04/2007|15:44] C:\DOCUME~1\Fabien\APPLIC~1\SecuROM
   [11/09/2007|21:38] C:\DOCUME~1\Fabien\APPLIC~1\Sony
   [20/11/2008|00:48] C:\DOCUME~1\Fabien\APPLIC~1\Sports Interactive
   [17/05/2007|13:16] C:\DOCUME~1\Fabien\APPLIC~1\Steinberg
   [02/12/2007|15:25] C:\DOCUME~1\Fabien\APPLIC~1\Sun
   [14/03/2007|18:28] C:\DOCUME~1\Fabien\APPLIC~1\vlc
   [16/03/2009|17:34] C:\DOCUME~1\Fabien\APPLIC~1\WinRAR

   [29/03/2008|02:09] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
   [29/03/2008|02:10] C:\DOCUME~1\LOCALS~1\APPLIC~1\AdobeUM
   [08/03/2009|16:02] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [08/03/2009|16:02] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [06/03/2009 22:58][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [16/03/2009 18:05][--ah-----] C:\WINDOWS	asks\SA.DAT
   [28/08/2001 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [17/10/2007|20:13] C:\Program Files\21cn
   [20/01/2007|19:41] C:\Program Files\802.11 Wireless LAN
   [07/05/2007|14:12] C:\Program Files\ABC
   [01/12/2007|16:32] C:\Program Files\ACD Systems
   [27/10/2008|20:37] C:\Program Files\Adobe
   [27/10/2008|20:34] C:\Program Files\Adobe Media Player
   [15/06/2007|20:39] C:\Program Files\AGEIA Technologies
   [06/06/2007|12:19] C:\Program Files\Album Cover Finder
   [18/06/2008|11:08] C:\Program Files\AntiVir PersonalEdition Classic
   [27/09/2008|12:30] C:\Program Files\Apple Software Update
   [17/05/2007|21:14] C:\Program Files\ASIO4ALL v2
   [28/01/2007|12:15] C:\Program Files\Astonsoft
   [21/01/2007|05:59] C:\Program Files\ASUSTeK
   [06/02/2007|22:53] C:\Program Files\Audacity
   [08/03/2009|22:52] C:\Program Files\Avira
   [04/02/2008|23:44] C:\Program Files\AviSynth 2.5
   [07/02/2009|21:29] C:\Program Files\AVS4YOU
   [10/08/2008|14:01] C:\Program Files\BestGameEver
   [06/03/2009|16:14] C:\Program Files\BitComet
   [05/03/2009|16:09] C:\Program Files\Bonjour
   [08/04/2008|15:40] C:\Program Files\Canal
   [01/07/2008|22:23] C:\Program Files\CHRYOPROD
   [26/11/2008|03:44] C:\Program Files\Combined Community Codec Pack
   [21/01/2008|14:42] C:\Program Files\Common Files
   [20/01/2007|19:24] C:\Program Files\ComPlus Applications
   [04/12/2008|21:09] C:\Program Files\Conduit
   [22/01/2009|20:57] C:\Program Files\Crayon Physics Deluxe
   [18/05/2008|14:54] C:\Program Files\CyberIPod.com
   [21/01/2007|22:53] C:\Program Files\DAEMON Tools
   [30/09/2007|22:03] C:\Program Files\DivX
   [01/12/2007|16:17] C:\Program Files\Drums Overkill
   [02/03/2009|14:37] C:\Program Files\Electronic Arts
   [20/10/2008|00:06] C:\Program Files\Enigma Software Group
   [15/12/2007|16:05] C:\Program Files\eRightSoft
   [16/03/2009|18:01] C:\Program Files\Fichiers communs
   [28/01/2007|03:48] C:\Program Files\FileZilla
   [28/08/2008|22:58] C:\Program Files\FlashGet
   [12/01/2008|02:47] C:\Program Files\FM Modifier 2.2
   [17/03/2008|12:57] C:\Program Files\Free Audio Pack
   [04/12/2008|21:18] C:\Program Files\Free Create-Burn ISO Image
   [29/09/2008|01:44] C:\Program Files\Free friend adder
   [01/12/2007|16:12] C:\Program Files\Freeciv-2.0.9-gtk2
   [15/09/2007|14:47] C:\Program Files\Frets on Fire
   [04/03/2009|15:10] C:\Program Files\FriendBlasterPro
   [24/08/2008|21:33] C:\Program Files\Full Tilt Poker
   [15/11/2008|15:40] C:\Program Files\GOA
   [16/03/2009|14:55] C:\Program Files\Google
   [26/05/2008|18:32] C:\Program Files\Guitar Pro 5
   [31/01/2008|21:32] C:\Program Files\GXTranscoder.net AWE
   [29/06/2008|11:37] C:\Program Files\Hamachi
   [07/03/2009|17:21] C:\Program Files\Har-Bal 2.3
   [01/03/2009|15:58] C:\Program Files\Hasbro
   [01/06/2008|19:01] C:\Program Files\IK Multimedia
   [01/06/2008|18:40] C:\Program Files\Image-Line
   [07/09/2008|14:10] C:\Program Files\InstallShield Installation Information
   [12/04/2008|02:03] C:\Program Files\Internet Explorer
   [27/09/2008|02:28] C:\Program Files\iPod
   [27/09/2008|02:29] C:\Program Files\iTunes
   [28/02/2008|00:43] C:\Program Files\iZotope
   [16/03/2009|16:24] C:\Program Files\Java
   [05/09/2007|17:25] C:\Program Files\K!TV
   [01/08/2007|01:05] C:\Program Files\kab - Shutdown Timer
   [26/08/2008|13:31] C:\Program Files\Last.fm
   [27/06/2007|19:25] C:\Program Files\Logitech
   [28/02/2009|17:52] C:\Program Files\MagicISO
   [07/05/2007|12:43] C:\Program Files\MAIET
   [17/12/2007|14:49] C:\Program Files\Majorem
   [16/03/2009|14:10] C:\Program Files\Malwarebytes' Anti-Malware
   [22/01/2007|19:21] C:\Program Files\Messenger
   [05/06/2007|17:39] C:\Program Files\Messenger Plus! Live
   [21/07/2008|01:27] C:\Program Files\MessengerDiscovery
   [04/09/2007|15:28] C:\Program Files\MeuhMeuhTV
   [02/06/2008|18:31] C:\Program Files\microsoft frontpage
   [13/10/2007|19:12] C:\Program Files\Microsoft Games
   [15/01/2009|00:38] C:\Program Files\Microsoft LifeCam
   [02/06/2008|18:31] C:\Program Files\Microsoft Office
   [09/05/2007|13:57] C:\Program Files\Movie Maker
   [16/03/2009|18:14] C:\Program Files\Mozilla Firefox
   [15/01/2009|00:14] C:\Program Files\MSBuild
   [20/01/2007|19:24] C:\Program Files\MSN
   [20/01/2007|19:24] C:\Program Files\MSN Gaming Zone
   [22/07/2008|16:47] C:\Program Files\MSN Messenger
   [09/07/2008|12:52] C:\Program Files\MSN Spy 2004
   [22/01/2007|19:20] C:\Program Files\MSXML 4.0
   [08/04/2008|15:37] C:\Program Files\MSXML 6.0
   [20/12/2008|14:33] C:\Program Files\Native Instruments
   [28/01/2007|13:07] C:\Program Files\Nero
   [22/02/2008|00:26] C:\Program Files\NetMeeting
   [02/11/2008|15:49] C:\Program Files\Nokia
   [02/10/2007|22:48] C:\Program Files\OGPlanet
   [13/03/2008|02:18] C:\Program Files\OpenTTD
   [13/06/2007|18:27] C:\Program Files\Outlook Express
   [01/06/2008|18:39] C:\Program Files\Outsim
   [02/10/2007|23:17] C:\Program Files\PacificPoker
   [18/06/2008|00:01] C:\Program Files\Panda Security
   [05/02/2009|16:59] C:\Program Files\Peer2Peer-FR
   [04/09/2007|18:55] C:\Program Files\Pinnacle
   [04/02/2007|02:16] C:\Program Files\Playlogic
   [14/03/2009|14:14] C:\Program Files\PokerStars
   [26/05/2008|18:29] C:\Program Files\PowerISO
   [27/09/2008|02:25] C:\Program Files\QuickTime
   [22/11/2008|15:59] C:\Program Files\Real
   [21/01/2007|21:26] C:\Program Files\Realtek
   [04/02/2008|23:44] C:\Program Files\Red Kawa
   [15/01/2009|00:11] C:\Program Files\Reference Assemblies
   [28/02/2009|20:56] C:\Program Files\Risk
   [11/12/2007|19:28] C:\Program Files\Samsung
   [30/03/2008|01:03] C:\Program Files\Sega
   [20/01/2007|19:24] C:\Program Files\Services en ligne
   [29/01/2007|20:03] C:\Program Files\Sierra
   [03/02/2007|16:53] C:\Program Files\Smart Projects
   [11/09/2007|21:18] C:\Program Files\Sony
   [11/09/2007|21:16] C:\Program Files\Sony Setup
   [04/12/2008|16:52] C:\Program Files\Soulseek
   [23/04/2007|00:36] C:\Program Files\SpeedSim
   [18/12/2008|14:55] C:\Program Files\Sports Interactive
   [16/03/2009|18:30] C:\Program Files\Spybot - Search & Destroy
   [19/10/2008|23:49] C:\Program Files\Spyware Doctor
   [16/03/2009|18:07] C:\Program Files\Steam
   [20/12/2008|15:58] C:\Program Files\Steinberg
   [01/12/2007|16:13] C:\Program Files\StepMania
   [02/10/2008|18:00] C:\Program Files\StuffPlug3
   [20/12/2008|15:58] C:\Program Files\Syncrosoft
   [21/12/2008|20:41] C:\Program Files\THQ
   [22/01/2007|02:36] C:\Program Files\Thrustmaster
   [16/05/2007|23:20] C:\Program Files\Toontrack
   [16/03/2009|19:02] C:\Program Files	rend micro
   [17/10/2007|20:34] C:\Program Files\TVAnts
   [25/12/2007|01:01] C:\Program Files\UDPixel
   [20/01/2007|19:37] C:\Program Files\Uninstall Information
   [21/01/2007|14:05] C:\Program Files\VIA
   [14/03/2007|18:15] C:\Program Files\VideoLAN
   [02/02/2009|16:37] C:\Program Files\VstPlugins
   [04/01/2009|03:30] C:\Program Files\Vuze
   [09/03/2009|04:41] C:\Program Files\Warcraft III
   [13/08/2008|13:22] C:\Program Files\WinamaxPoker
   [03/12/2008|00:20] C:\Program Files\Windows Journal Viewer
   [05/06/2007|17:39] C:\Program Files\Windows Live
   [14/03/2008|15:30] C:\Program Files\Windows Media Connect 2
   [14/03/2008|15:30] C:\Program Files\Windows Media Player
   [21/01/2007|21:08] C:\Program Files\Windows NT
   [07/03/2009|17:44] C:\Program Files\Windows XP Home-Pro-2003 SP2 Crack
   [20/01/2007|20:34] C:\Program Files\WindowsUpdate
   [19/07/2008|13:48] C:\Program Files\WinRAR
   [20/01/2007|19:27] C:\Program Files\xerox
   [21/10/2007|11:30] C:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [01/12/2007|16:32] C:\Program Files\Fichiers communs\ACD Systems
   [27/10/2008|20:35] C:\Program Files\Fichiers communs\Adobe
   [20/09/2008|04:05] C:\Program Files\Fichiers communs\Adobe AIR
   [28/01/2007|13:09] C:\Program Files\Fichiers communs\Ahead
   [27/09/2008|02:25] C:\Program Files\Fichiers communs\Apple
   [07/02/2009|21:29] C:\Program Files\Fichiers communs\AVSMedia
   [02/06/2008|18:32] C:\Program Files\Fichiers communs\Designer
   [16/05/2007|23:35] C:\Program Files\Fichiers communs\DigiDesign
   [11/07/2007|15:47] C:\Program Files\Fichiers communs\DirectX
   [30/01/2008|21:12] C:\Program Files\Fichiers communs\InstallShield
   [16/01/2008|14:19] C:\Program Files\Fichiers communs\iZotope
   [02/12/2007|15:24] C:\Program Files\Fichiers communs\Java
   [27/06/2007|19:25] C:\Program Files\Fichiers communs\Logitech
   [27/10/2008|20:25] C:\Program Files\Fichiers communs\Macrovision Shared
   [03/12/2008|00:20] C:\Program Files\Fichiers communs\Microsoft Shared
   [20/01/2007|19:25] C:\Program Files\Fichiers communs\MSSoap
   [20/12/2008|14:32] C:\Program Files\Fichiers communs\Native Instruments
   [02/11/2008|15:49] C:\Program Files\Fichiers communs\Nokia
   [20/01/2007|19:17] C:\Program Files\Fichiers communs\ODBC
   [22/11/2008|15:59] C:\Program Files\Fichiers communs\Real
   [20/01/2007|19:25] C:\Program Files\Fichiers communs\Services
   [20/01/2007|19:17] C:\Program Files\Fichiers communs\SpeechEngines
   [13/06/2007|18:27] C:\Program Files\Fichiers communs\System
   [15/06/2007|20:39] C:\Program Files\Fichiers communs\Wise Installation Wizard
   [22/11/2008|15:59] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 46 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-03-16 19:17:22
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 1656
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Fabien\.housecall6.6\Quarantine\FL 6 + crack.zip.bac_a00604
   C:\DOCUME~1\Fabien\Bureau\Image Line Fruity Loops Studio Producer Edition XXL v6.04\FL 6 + crack.zip
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\01 Oblivion.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\02 Divinations.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\03 Quintessence.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\04 The Czar.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\05 Ghost Of Karelia.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\06 Crack The Skye.mp3
   C:\DOCUME~1\Fabien\Bureau\ZIK\Mastodon - Crack The Skye [2009] by xcharlsx\cover.jpg
   C:\DOCUME~1\Fabien\Bureau\ZIK\VA Upcoming release\Postmortem Promises - A Crack in the Spine of the Gallant.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Foldersottedchrist@hotmail.fr\Image Line Fruity Loops Studio Producer Edition XXL v6.04\FL 6 + crack.zip
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\01 Oblivion.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\02 Divinations.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\03 Quintessence.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\04 The Czar.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\05 Ghost Of Karelia.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\06 Crack The Skye.mp3
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\cover.jpg
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\Sharing Folders	rasherxxl@hotmail.fr\Mastodon - Crack The Skye [2009] by xcharlsx\Thumbs.db
   C:\DOCUME~1\Fabien\Local Settings\Application Data\Microsoft\Messenger\morthia@hotmail.com\SharingMetadataottedchrist@hotmail.fr\DFSR\ConflictDelete\FL 6 + crack-{9E33CED3-3D42-4484-94ED-77FBFE6DC744}-v7554.zip
   C:\DOCUME~1\Fabien\Mes documents\Ableton\Presets\Audio Effects\Vinyl Distortion\Crack.adv
   C:\DOCUME~1\ALLUSE~1\Menu Démarrer\Programmes\Windows XP Home-Pro-2003 SP2 Crack
   C:\DOCUME~1\ALLUSE~1\Menu Démarrer\Programmes\Windows XP Home-Pro-2003 SP2 Crack\Donate To DemonSpeed.lnk
   C:\DOCUME~1\ALLUSE~1\Menu Démarrer\Programmes\Windows XP Home-Pro-2003 SP2 Crack\KeyGen.exe.lnk


   [F:10][D:3]-> C:\DOCUME~1\Fabien\LOCALS~1\Temp
   [F:4][D:0]-> C:\DOCUME~1\Fabien\Cookies
   [F:7][D:4]-> C:\DOCUME~1\Fabien\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 16/03/2009|19:19 - Option : [1]

   --------------------\  Fin du rapport a 19:19:16

Utilisateur anonyme · Answer

bah c est ok et tant mieux , on termine donc :

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes 
explorer.exe 


:files 
C:\WINDOWS\zip.exe 
C:\WINDOWS\SWREG.exe 
C:\WINDOWS\NIRCMD.exe 
C:\WINDOWS\grep.exe 
C:\WINDOWS\VFIND.exe 
C:\WINDOWS\SWXCACLS.exe 
C:\WINDOWS\SWSC.exe 
C:\WINDOWS\sed.exe 
C:\WINDOWS\fdsv.exe 
C:\WINDOWS\ERUNT 
C:\Backups 
C:\cleannavi DERNIER.txt 
C:apport smit 2.txt 
C:\WINDOWS\system32	mp.txt 
C:apport.txt 
C:\$AVG8.VAULT$ 
C:\Documents and Settings\All Users\Application Data\avg8 
C:\DOCUME~1\Fabien\Bureau\Image Line Fruity Loops Studio Producer Edition XXL v6.04\FL 6 + crack.zip 

:reg 
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91dc2237-bb2b-11dd-91f7-0018e70439e7}] 


:commands 
[emptytemp] 
[start explorer] 
[reboot] 


---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

ensuite repasse toolcleaner :

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pc-system.fr/ 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

et fais ceci :


Purge de la restauration système 
*Désactive ta restauration : 
Clique droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK 
---> Redémarre ton PC ... 

*Réactive ta restauration : 
Clique droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK 
--->Redémarre ton PC ... 

( Note : tu peux aussi y accéder via panneau de configuration->" système "->" restauration système " ). 



Tuto xp : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

SeiFeR_HxC · Answer

Rapport de OTmoveIT :


========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\WINDOWS\zip.exe moved successfully.
C:\WINDOWS\SWREG.exe moved successfully.
C:\WINDOWS\NIRCMD.exe moved successfully.
C:\WINDOWS\grep.exe moved successfully.
C:\WINDOWS\VFIND.exe moved successfully.
C:\WINDOWS\SWXCACLS.exe moved successfully.
C:\WINDOWS\SWSC.exe moved successfully.
C:\WINDOWS\sed.exe moved successfully.
C:\WINDOWS\fdsv.exe moved successfully.
C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002 moved successfully.
C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001 moved successfully.
C:\WINDOWS\ERUNT\SDFIX_First_Run\Users moved successfully.
C:\WINDOWS\ERUNT\SDFIX_First_Run moved successfully.
C:\WINDOWS\ERUNT\SDFIX\Users\00000002 moved successfully.
C:\WINDOWS\ERUNT\SDFIX\Users\00000001 moved successfully.
C:\WINDOWS\ERUNT\SDFIX\Users moved successfully.
C:\WINDOWS\ERUNT\SDFIX moved successfully.
C:\WINDOWS\ERUNT moved successfully.
C:\Backups moved successfully.
File/Folder C:\cleannavi DERNIER.txt not found.
C:apport smit 2.txt moved successfully.
C:\WINDOWS\system32	mp.txt moved successfully.
C:apport.txt moved successfully.
C:\$AVG8.VAULT$ moved successfully.
C:\Documents and Settings\All Users\Application Data\avg8\dumps moved successfully.
C:\Documents and Settings\All Users\Application Data\avg8 moved successfully.
C:\DOCUME~1\Fabien\Bureau\Image Line Fruity Loops Studio Producer Edition XXL v6.04\FL 6 + crack.zip moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91dc2237-bb2b-11dd-91f7-0018e70439e7}\ deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\etilqs_ZVJ8k7tocR7oD1jmi13H scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF1FB7.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF1FCC.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF2D83.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF2DD0.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_620.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03162009_193029

Files moved on Reboot...
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\etilqs_ZVJ8k7tocR7oD1jmi13H not found!
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF1FB7.tmp not found!
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF1FCC.tmp not found!
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF2D83.tmp not found!
File C:\DOCUME~1\Fabien\LOCALS~1\Temp\~DF2DD0.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS	emp\Perflib_Perfdata_620.dat not found!
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Fabien\Local Settings\Application Data\Mozilla\Firefox\Profiles
evvxtvm.default\XUL.mfl moved successfully.





Rapport TCleaner : 


[ Rapport ToolsCleaner version 2.3.2 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\lopR.txt: trouvé !
C:\TB.txt: trouvé !
C:\Lop SD: trouvé !
C:\_OtMoveIt: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Fabien\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\ToolBarSD.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\Fabien\Bureau\Rsit.exe: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !
C:\_OTMoveIt\MovedFiles\03162009_193029\WINDOWS\ERUNT\SDFIX: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\Fabien\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\Fabien\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Fabien\Bureau\ToolBarSD.exe: supprimé !
C:\Program Files	rend micro\HijackThis.exe: supprimé !
C:\lopR.txt: supprimé !
C:\TB.txt: supprimé !
C:\Documents and Settings\Fabien\Bureau\OTMoveIt3.exe: supprimé !
C:\Documents and Settings\Fabien\Bureau\Rsit.exe: supprimé !
C:\Program Files	rend micro\hijackthis.log: supprimé !
C:\Lop SD: supprimé !
C:\_OtMoveIt: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !

Utilisateur anonyme · Answer

si tu n as pas d autres soucis change le statut du sujet en resolu stp

http://www.commentcamarche.net/faq/sujet 11365 marquer un fil de discussion comme etant resolu

SeiFeR_HxC · Answer

Ok ! tout a l'air nikel, merci beaucoup pour ton aide tres efficace !

Par contre je ne trouve pas la case a cocher "résolu" j'avais créé se topic sans etre inscrit, ya pas un autre moyen?

SeiFeR_HxC · Answer

Donc si un modérateur ou quelqu'un d'autre peu changer le statut du topic en "résolu" ça serait cool ! =)

Merci !

Utilisateur anonyme · Answer

ok et de rien 

je m occupe de mettre résolu , bonne semaine

VIRUS USB + MAJ impossible Antivirus

59 réponses

Newsletters