probleme de virus

Question

Bonjour,
j'ai telechargé un film sous limewire dès qu'il etait terminé en chargement sans que je le visionne dans mon dossier musique il m'a ralenti mon pc et je n'arrive pas a supprimer ce fichier de maniere classique pouvez vos m'indiquer la procedure comme anti virus j'ai antivir
merci

pimprenelle27 · Answer

Bonjour,
Tu n'as pas peur de te faire prendre en téléchargeant illégalement avec la nouvelle lois?


Pour commencer :  faire un petit nettoyage de l'ordi et du registre avec Ccleaner, regarde bien le Tuto CCleaner

Ensuite :

Télécharge le fichier d'installation d'HijackThis.

Enregistre HJTInstall.exe sur ton bureau.

Renomme Hijackthis en Tutu

Double-clique sur HJTInstall.exe (tutu)  pour lancer le programme

Par défaut, il s'installera là :
C:\Program Files\Trend Micro\HijackThis

Accepte la licence en cliquant sur le bouton "I Accept"

Choisis l'option "Do a system scan and save a log file"

Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note

Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

Colle le rapport que tu viens de copier sur ce forum

Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement

Tutoriaux (ne fixe rien pour le moment !!)

Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

secro · Answer

voici le bloc note
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41:56, on 14/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
C:\Windows\System32undll32.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: e-Carte Bleue Banque Populaire.lnk = C:\Program Files\e-Carte Bleue Banque Populaire\ecbl-nxbp.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

pimprenelle27 · Answer

Fait ceci et poste moi le rapport à la suite de la question êtes vous aider par quelqu'un, répondre oui. Merci.

Télécharge GenProc sur ton bureau (Attention le fichier est un fichier zip)
Dézippe le dossier, double-clique sur GenProc.bat
En final, poste le contenu du rapport qui s'affiche.
Comment utiliser GenProc

Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

IMPORTANT : poste le rapport et ne fais rien d'autre pour l'instant ( souvent il faut ajouter des consignes à la manipe indiquée pour que cela fonctionne parfaitement )

secro · Answer

voila si tu t en sort


Rapport GenProc 2.431 [1] - 14/03/2009 à 20:23:21 - Windows Vista 
 
GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante : 

 
Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :  
- C:\Program Files\EsetOnlineScanner\log.txt

---------------------------------------------------------------------- 
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com 
----------------------------------------------------------------------

pimprenelle27 · Answer

ok rien détecté, maintenant fait ceci : 

Telecharge malwarebytes

NB : S'il te manque COMCTL32.OCX alors télécharge le ici

Tu l´instale; le programme va se mettre automatiquement a jour.

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

Puis click sur "rechercher".

Laisse le scanner le pc...

Si des elements on ete trouvés > click sur supprimer la selection.

si il t´es demandé de redemarrer > click sur "yes".

A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.
Copie et colle le rapport stp.

PS : les rapport sont aussi rangé dans l onglet rapport/log


Tutoriaux

secro · Answer

voila
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1848
Windows 6.0.6001 Service Pack 1

14/03/2009 21:27:47
mbam-log-2009-03-14 (21-27-47).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 169785
Temps écoulé: 55 minute(s), 11 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 5
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c80b7ff6-ce60-4079-935e-520c045c30a6} (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Foxicle (Adware.Foxicle) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z (Adware.PlayMP3Z) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\Schneider\AppData\Local\Temp\GenProc\GenProc\outil\curl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
merci

secro · Answer

le fichier defectueux se trouve dans le dossier incomplete et je n'arrive pas a le supprimer de maniere classique comment je peut faire  merci

pimprenelle27 · Answer

ok maintenant fais ceci : 

Pour commencer :  faire un petit nettoyage de l'ordi et du registre avec Ccleaner, regarde bien le Tuto CCleaner


Télécharge Superantispyware (SAS)



Choisis "enregistrer" et enregistre-le sur ton bureau.

Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.

Créé une icône sur le bureau.

Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.

- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
- Sous Configuration and Preferences, clique sur le bouton "Preferences"
- Clique sur l'onglet "Scanning Control "
- Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :

Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
- Laisse les autres lignes décochées.

- Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.

- Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".

Dans la colonne de gauche, coche C:\Fixed Drive.

Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"

Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.

A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.

Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".

Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.

Pour recopier les informations sur le forum, fais ceci :

- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.

- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.

- Copie son contenu dans ta réponse.


Regarde bien le tuto SUPERAntiSpyware il est très bien expliqué.

secro · Answer

cel fait 8 heures que le scan tourne et ce n est pas encore fini es ce normal ?et comment faire pour oter le fichier de 660 Mdans le dossier incomplete

secro · Answer

le superantispyware tourne depuis 8 heures es ce normal?
merci

secro · Answer

qq'un peut il m aider

pimprenelle27 · Answer

oui c'est normale ça dépend des fichiers que tu as sur ton pc.

secro · Answer

je n ai quasiment aucun fichier sur ce pc et cela fait 12 heures

secro · Answer

Le files items ne bouge plus depuis 3 heures mais le scanning  tourne tourne toujours

secro · Answer

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 03/15/2009 at 12:18 PM

Application Version : 4.25.1014

Core Rules Database Version : 3795
Trace Rules Database Version: 1751

Scan type       : Complete Scan
Total Scan Time : 12:38:00

Memory items scanned      : 672
Memory threats detected   : 0
Registry items scanned    : 7122
Registry threats detected : 0
File items scanned        : 1937742
File threats detected     : 367

Adware.Tracking Cookie
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@ad.yieldmanager[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@adserver.qplaygames[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@adtech[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@advertising[2].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@atdmt[2].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@bluestreak[2].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@doubleclick[2].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@fastclick[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@fl01.ct2.comclick[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@guigoz.solution.weborama[2].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@imrworldwide[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@mediaplex[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@server.cpmstar[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@smartadserver[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@statsweb.bnpparibas[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@tradedoubler[2].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@weborama[1].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@xiti[2].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies
atividade@atdmt[2].txt
	C:\Documents and Settings\Natividade\AppData\Roaming\Microsoft\Windows\Cookies
atividade@bluestreak[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@ad.yieldmanager[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@adserver.qplaygames[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@adtech[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@advertising[2].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@atdmt[2].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@bluestreak[2].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@doubleclick[2].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@fastclick[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@fl01.ct2.comclick[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@guigoz.solution.weborama[2].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@imrworldwide[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@mediaplex[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@server.cpmstar[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@smartadserver[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@statsweb.bnpparibas[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@tradedoubler[2].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@weborama[1].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@xiti[2].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies
atividade@atdmt[2].txt
	C:\Documents and Settings\Natividade\Application Data\Microsoft\Windows\Cookies
atividade@bluestreak[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@ad.yieldmanager[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@adserver.qplaygames[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@adtech[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@advertising[2].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@atdmt[2].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@bluestreak[2].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@doubleclick[2].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@fastclick[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@fl01.ct2.comclick[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@guigoz.solution.weborama[2].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@imrworldwide[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@mediaplex[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@server.cpmstar[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@smartadserver[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@statsweb.bnpparibas[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@tradedoubler[2].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@weborama[1].txt
	C:\Documents and Settings\Natividade\Cookies\Low
atividade@xiti[2].txt
	C:\Documents and Settings\Natividade\Cookies
atividade@atdmt[2].txt
	C:\Documents and Settings\Natividade\Cookies
atividade@bluestreak[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@ad.yieldmanager[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@adrevolver[2].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@ads.gamesbannernet[2].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@adtech[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@adv.ertisement[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@atdmt[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@bs.serving-sys[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@casalemedia[2].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@doubleclick[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@fl01.ct2.comclick[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@media.adrevolver[2].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@media.adrevolver[3].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@server.cpmstar[2].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@serving-sys[2].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@sexetc[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@tribalfusion[2].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[1].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[3].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[4].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[5].txt
	C:\Documents and Settings\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@xiti[1].txt
	.tradedoubler.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.tradedoubler.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.tradedoubler.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.doubleclick.net [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.msnportal.112.2o7.net [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.atdmt.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.hotbar.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	www.googleadservices.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	server.cpmstar.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	server.cpmstar.com [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.opodo.122.2o7.net [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.hotelopia.112.2o7.net [ C:\Documents and Settings\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@ad.yieldmanager[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@adrevolver[2].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@ads.gamesbannernet[2].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@adtech[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@adv.ertisement[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@atdmt[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@bs.serving-sys[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@casalemedia[2].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@doubleclick[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@fl01.ct2.comclick[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@media.adrevolver[2].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@media.adrevolver[3].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@server.cpmstar[2].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@serving-sys[2].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@sexetc[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@tribalfusion[2].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[1].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[3].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[4].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[5].txt
	C:\Documents and Settings\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@xiti[1].txt
	.tradedoubler.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.tradedoubler.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.tradedoubler.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.doubleclick.net [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.msnportal.112.2o7.net [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.atdmt.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.hotbar.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	www.googleadservices.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	server.cpmstar.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	server.cpmstar.com [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.opodo.122.2o7.net [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.hotelopia.112.2o7.net [ C:\Documents and Settings\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@ad.yieldmanager[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@adrevolver[2].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@ads.gamesbannernet[2].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@adtech[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@adv.ertisement[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@atdmt[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@bs.serving-sys[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@casalemedia[2].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@doubleclick[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@fl01.ct2.comclick[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@media.adrevolver[2].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@media.adrevolver[3].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@server.cpmstar[2].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@serving-sys[2].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@sexetc[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@tribalfusion[2].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@www.googleadservices[1].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@www.googleadservices[3].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@www.googleadservices[4].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@www.googleadservices[5].txt
	C:\Documents and Settings\Yoann\Cookies\Low\yoann@xiti[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@2o7[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@adtech[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@doubleclick[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@fl01.ct2.comclick[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@gamenextfr.oberon-media[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@oberon-media[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@statse.webtrendslive[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@2o7[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@adtech[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@doubleclick[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@fl01.ct2.comclick[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@gamenextfr.oberon-media[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@oberon-media[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@statse.webtrendslive[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Application Data\Microsoft\Windows\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@2o7[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@adtech[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@doubleclick[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@fl01.ct2.comclick[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@gamenextfr.oberon-media[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@oberon-media[1].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@statse.webtrendslive[2].txt
	C:\Documents and Settings\yoann.PC-de-Schneider.000\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@ad.yieldmanager[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@adserver.qplaygames[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@adtech[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@advertising[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@atdmt[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@bluestreak[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@doubleclick[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@fastclick[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@fl01.ct2.comclick[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@guigoz.solution.weborama[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@imrworldwide[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@mediaplex[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@msnportal.112.2o7[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@server.cpmstar[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@smartadserver[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@statsweb.bnpparibas[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@tradedoubler[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@weborama[1].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies\Low
atividade@xiti[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies
atividade@atdmt[2].txt
	C:\Users\Natividade\AppData\Roaming\Microsoft\Windows\Cookies
atividade@bluestreak[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@ad.yieldmanager[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@adserver.qplaygames[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@adtech[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@advertising[2].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@atdmt[2].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@bluestreak[2].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@doubleclick[2].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@fastclick[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@fl01.ct2.comclick[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@guigoz.solution.weborama[2].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@imrworldwide[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@mediaplex[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@msnportal.112.2o7[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@server.cpmstar[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@smartadserver[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@statsweb.bnpparibas[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@tradedoubler[2].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@weborama[1].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies\Low
atividade@xiti[2].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies
atividade@atdmt[2].txt
	C:\Users\Natividade\Application Data\Microsoft\Windows\Cookies
atividade@bluestreak[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@ad.yieldmanager[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@adserver.qplaygames[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@adtech[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@advertising[2].txt
	C:\Users\Natividade\Cookies\Low
atividade@atdmt[2].txt
	C:\Users\Natividade\Cookies\Low
atividade@bluestreak[2].txt
	C:\Users\Natividade\Cookies\Low
atividade@doubleclick[2].txt
	C:\Users\Natividade\Cookies\Low
atividade@fastclick[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@fl01.ct2.comclick[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@guigoz.solution.weborama[2].txt
	C:\Users\Natividade\Cookies\Low
atividade@imrworldwide[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@mediaplex[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@msnportal.112.2o7[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@server.cpmstar[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@smartadserver[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@statsweb.bnpparibas[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@tradedoubler[2].txt
	C:\Users\Natividade\Cookies\Low
atividade@weborama[1].txt
	C:\Users\Natividade\Cookies\Low
atividade@xiti[2].txt
	C:\Users\Natividade\Cookies
atividade@atdmt[2].txt
	C:\Users\Natividade\Cookies
atividade@bluestreak[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@ad.yieldmanager[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@adrevolver[2].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@ads.gamesbannernet[2].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@adtech[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@adv.ertisement[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@atdmt[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@bs.serving-sys[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@casalemedia[2].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@doubleclick[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@fl01.ct2.comclick[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@media.adrevolver[2].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@media.adrevolver[3].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@server.cpmstar[2].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@serving-sys[2].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@sexetc[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@tribalfusion[2].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[1].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[3].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[4].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[5].txt
	C:\Users\Yoann\AppData\Roaming\Microsoft\Windows\Cookies\Low\yoann@xiti[1].txt
	.tradedoubler.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.tradedoubler.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.tradedoubler.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.doubleclick.net [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.msnportal.112.2o7.net [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.atdmt.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.hotbar.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	www.googleadservices.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	server.cpmstar.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	server.cpmstar.com [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.opodo.122.2o7.net [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.hotelopia.112.2o7.net [ C:\Users\Yoann\AppData\Roaming\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@ad.yieldmanager[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@adrevolver[2].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@ads.gamesbannernet[2].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@adtech[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@adv.ertisement[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@atdmt[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@bs.serving-sys[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@casalemedia[2].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@doubleclick[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@fl01.ct2.comclick[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@media.adrevolver[2].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@media.adrevolver[3].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@server.cpmstar[2].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@serving-sys[2].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@sexetc[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@tribalfusion[2].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[1].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[3].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[4].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@www.googleadservices[5].txt
	C:\Users\Yoann\Application Data\Microsoft\Windows\Cookies\Low\yoann@xiti[1].txt
	.tradedoubler.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.tradedoubler.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.tradedoubler.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.doubleclick.net [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	fl01.ct2.comclick.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.msnportal.112.2o7.net [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.atdmt.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.hotbar.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	ad.yieldmanager.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	www.googleadservices.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	server.cpmstar.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	server.cpmstar.com [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.opodo.122.2o7.net [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	.hotelopia.112.2o7.net [ C:\Users\Yoann\Application Data\Mozilla\Firefox\Profiles\9g82s2b9.default\cookies.txt ]
	C:\Users\Yoann\Cookies\Low\yoann@ad.yieldmanager[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@adrevolver[2].txt
	C:\Users\Yoann\Cookies\Low\yoann@ads.gamesbannernet[2].txt
	C:\Users\Yoann\Cookies\Low\yoann@adtech[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@adv.ertisement[1].txt
voici le resultat	

C:\Users\Yoann\Cookies\Low\yoann@atdmt[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@bs.serving-sys[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@casalemedia[2].txt
	C:\Users\Yoann\Cookies\Low\yoann@doubleclick[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@fl01.ct2.comclick[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@media.adrevolver[2].txt
	C:\Users\Yoann\Cookies\Low\yoann@media.adrevolver[3].txt
	C:\Users\Yoann\Cookies\Low\yoann@msnportal.112.2o7[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@server.cpmstar[2].txt
	C:\Users\Yoann\Cookies\Low\yoann@serving-sys[2].txt
	C:\Users\Yoann\Cookies\Low\yoann@sexetc[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@tradedoubler[2].txt
	C:\Users\Yoann\Cookies\Low\yoann@tribalfusion[2].txt
	C:\Users\Yoann\Cookies\Low\yoann@www.googleadservices[1].txt
	C:\Users\Yoann\Cookies\Low\yoann@www.googleadservices[3].txt
	C:\Users\Yoann\Cookies\Low\yoann@www.googleadservices[4].txt
	C:\Users\Yoann\Cookies\Low\yoann@www.googleadservices[5].txt
	C:\Users\Yoann\Cookies\Low\yoann@xiti[1].txt

pimprenelle27 · Answer

il était bien fini? tu peux supprimer tout ce qu'il à trouvé, ensuite me faire ceci : 

Télécharger RemoveIT Pro

Fais un scan et poste moi le full rapport log.

secro · Answer

il m'a touvé trois virus dont deux dangeureux win 32.unknown random x et sys 32 regxpcom et je n'arrive pas a t envoyer le fichier le logiciel m'a demander un second scan et il m'a trouvé le troisieme virus et maintenant quand je redait le scan il ne trouve plus rien comment faire pour  t envoyer le fichier

secro · Answer

voici le fichier
RemoveIT Pro v4 - SE (Build date: 6.6.2008) full information log file.
Generated at: 15/03/2009 on 13:15:30
Microsoft Windows Vista Home Edition Service Pack 1 (Build 6001)
Author: Damjan Irgolic
https://www.incodesolutions.com/
support@incodesolutions.com


Running processes: (24)
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\InCode Solutions\RemoveIT Pro v4 - SEemoveit.exe

Startup files:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Sidebar
[C:\Program Files\Windows Sidebar\sidebar.exe]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SmpcSys
[C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ISUSPM
["C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ehTray.exe
[C:\Windows\ehome\ehTray.exe]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\swg
[C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SUPERAntiSpyware
[C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender
[%ProgramFiles%\Windows Defender\MSASCui.exe -hide]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SynTPEnh
[C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\CardReaderMonitor
[C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\
[]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\RoxWatchTray
["C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Google Desktop Search
["C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSPService
[C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Picasa Media Detector
[C:\Program Files\Picasa2\PicasaMediaDetector.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	oolbar_eula_launcher
[C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched
["C:\Program Files\Java\jre6\bin\jusched.exe"]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvSvc
[RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon
[RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter
[RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher
["C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\avast!
[C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe]

Detail report: (86)
Clsid c:\progra~1\google\google~3\goec62~1.dll[2b55a02ab2bf30636ffc7aad9f9d95c5][113664]
Clsid c:\program files\superantispyware\saswinlo.dll[972edede23ac8d59aac0c09799c6f18a][356352]
Clsid C:\Windows\system32\iconcodecservice.dll[08578f3ca5365f896d90ce2bf97fd000][9728]
Proc C:\Program Files\Alwil Software\Avast4\ashDisp.exe[fc242dbd786557ac641726dc5c13f060][81000]
Proc C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe[23518aa08d8b22cd27aa54fc21d0ac87][205480]
Proc C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe[2d4040f03702e79f6fa98d2e76ba831f][17656]
Proc C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe[bf38c273c3ec524880af0aeb2e7ce160][232184]
Proc C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe[e26642c193b81f2aa06d6013d4e07d03][102400]
Proc C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe[6542dc2e93bce4d4289fa70a4d367dc2][29744]
Proc C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[5d61be7db55b026a5d61a3eed09d0ead][39408]
Proc C:\Program Files\InCode Solutions\RemoveIT Pro v4 - SEemoveit.exe[1ec5a876a537b62f07c92e5bc8103149][550912]
Proc C:\Program Files\Java\jre6\bin\jusched.exe[b98ffa8288efaabc436c30d198608345][136600]
Proc C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe[b1d8669cd13163585ca133332edd60e3][1120568]
Proc C:\Program Files\Picasa2\PicasaMediaDetector.exe[0a44c06a0bb2ebc8b08df7039a2248d1][366400]
Proc C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe[ff32c2770bd4ad29178b00e77f92197c][643072]
Proc C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[11afbca9eac51cf988918bffe935e6ee][1830128]
Proc C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[e4e99677636ef949b546a1751c9b3a35][845360]
Proc C:\Program Files\Windows Defender\MSASCui.exe[0d392ede3b97e0b3131b2f63ef1db94e][1008184]
Proc C:\Program Files\Windows Sidebar\sidebar.exe[fd278e51a7d6f52d22fce6c67e037ad6][1233920]
Proc C:\Windows\ehome\ehmsas.exe[0f4195b9b348de5cf9b822f81704b20e][37376]
Proc C:\Windows\ehome\ehtray.exe[bf08674925f151bd4537b89a493e3e0c][125952]
Proc C:\Windows\Explorer.EXE[4f554999d7d5f05daaebba7b5ba1089d][2927104]
Proc C:\Windows\system32\Dwm.exe[59903071d7ace6a02093c47e9e38af97][81920]
Proc C:\Windows\System32undll32.exe[4b555106290bd117334e9a08761c035a][44544]
Proc C:\Windows\system32	askeng.exe[5f109032ce46b7184ed9e50f9fe8489e][169472]
RegRun c:\progra~1\alwils~1\avast4\ashdisp.exe[fc242dbd786557ac641726dc5c13f060][81000]
RegRun c:\program files\adobeeader 9.0eadereader_sl.exe[452fa961163ef4aee4815796a13ab2cf][35696]
RegRun c:\program files\common files\installshield\updateservice\isuspm.exe [23518aa08d8b22cd27aa54fc21d0ac87][205480]
RegRun c:\program files\common filesoxio shared\9.0\sharedcomoxwatchtray9.exe[bf38c273c3ec524880af0aeb2e7ce160][232184]
RegRun c:\program files\cyberlink\magicsports\kernel\magicsports\mspmirage.exe[e26642c193b81f2aa06d6013d4e07d03][102400]
RegRun c:\program files\google\google desktop search\googledesktop.exe [6542dc2e93bce4d4289fa70a4d367dc2][29744]
RegRun c:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe[5d61be7db55b026a5d61a3eed09d0ead][39408]
RegRun c:\program files\java\jre6\bin\jusched.exe[b98ffa8288efaabc436c30d198608345][136600]
RegRun c:\program files\packard bell\google_eula\eulalauncher.exe[a7a7ad08ba72ac90dcd5511ed895369b][28672]
RegRun c:\program files\packard bell\setupmypc\smpsys.exe[b1d8669cd13163585ca133332edd60e3][1120568]
RegRun c:\program files\picasa2\picasamediadetector.exe[0a44c06a0bb2ebc8b08df7039a2248d1][366400]
RegRun c:\program filesealtek semiconductor corp.ealtek card reader monitor\cardreadermonitor.exe[ff32c2770bd4ad29178b00e77f92197c][643072]
RegRun c:\program files\superantispyware\superantispyware.exe[11afbca9eac51cf988918bffe935e6ee][1830128]
RegRun c:\program files\synaptics\syntp\syntpenh.exe[e4e99677636ef949b546a1751c9b3a35][845360]
RegRun c:\program files\windows sidebar\sidebar.exe[fd278e51a7d6f52d22fce6c67e037ad6][1233920]
RegRun c:\windows\ehome\ehtray.exe[bf08674925f151bd4537b89a493e3e0c][125952]
RegRun c:\windows\system32
vcpl.dll[217e2b91eaaeafdaff1db718b062c7a0][8497696]
RegRun c:\windows\system32
vmctray.dll[7f493300e035fec8dbe031969b291766][81920]
RegRun c:\windows\system32
vsvc.dll[48769100e4a0c3335f8c775be8bf9e34][86016]
Service c:\program files\alwil software\avast4\ashmaisv.exe [f09461c8eccace33c271cc229f11e281][254040]
Service c:\program files\alwil software\avast4\ashserv.exe[62889d40a3fb1a9012428e16fe0dc67a][138680]
Service c:\program files\alwil software\avast4\ashwebsv.exe [23ca3e54474ae5ffdbc0f97b9e1815db][352920]
Service c:\program files\alwil software\avast4\aswupdsv.exe[b4253776ee034f6770fcee32c28490b0][18752]
Service c:\program files\common files\installshield\driver\11\intel 32\idrivert.exe[1cf03c69b49acb70c722df92755c0c8c][69632]
Service c:\program files\common files\microsoft shared\office12\odserv.exe[e54aa592a65f317390eee386a8821692][443776]
Service c:\program files\common files\microsoft shared\source engine\ose.exe[5a432a042dae460abe7199b758e8606c][145184]
Service c:\program files\common files
ero
ero backitup 4
bservice.exe[b90e093e7a7250906f1054418b5339c0][935208]
Service c:\program files\common filesoxio shared\9.0\sharedcomoxmediadb9.exe[9638e5820858593a12005c753b03ceae][887544]
Service c:\program files\common filesoxio shared\9.0\sharedcomoxwatch9.exe[910fba95ee4f56449aa81315884c8efd][166648]
Service c:\program files\common files\surething shared\stllssvr.exe[51778fd315c9882f1cbd932743e62a72][73728]
Service c:\program files\cyberlink\shared filesichvideo.exe[c3162ac1b592ceb43abe2f972a7222d3][266343]
Service c:\program files\google\common\google updater\googleupdaterservice.exe[1bf044e23206fddc16891a32922d571b][137200]
Service c:\program files\google\google desktop search\googledesktop.exe[6542dc2e93bce4d4289fa70a4d367dc2][29744]
Service c:\program files\windows live\installer\wlsetupsvc.exe[94a85e956a065e23e0010a6a7826243b][266240]
Service c:\program files\windows live\messenger\usnsvc.exe[9d19b042a4fd5c02195071ea2fe0c821][98328]
Service c:\program files\windows media player\wmpnetwk.exe[3978704576a121a9204f8cc49a301a9b][896512]
Service c:\windows\ehome\ehrecvr.exe[9be3744d295a7701eb425332014f0797][292352]
Service c:\windows\ehome\ehsched.exe[ad1870c8e5d6dd340c829e6074bf3c3f][131072]
Service c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe[a4af4201bd519971f8f34724f3ca9dbb][70144]
Service c:\windows\microsoft.net\framework\v3.0\windows communication foundation\infocard.exe[e7cc3aeaed9893a88876744cd439f76c][864256]
Service c:\windows\microsoft.net\framework\v3.0\windows communication foundation\smsvchost.exe[f9102685f97f9ba85f4a70afcf722cfe][122880]
Service c:\windows\microsoft.net\framework\v3.0\wpf\presentationfontcache.exe[993883524aa9cf1c90e1545411a9ac9c][36864]
Service c:\windows\servicing	rustedinstaller.exe[16613a1bad034d4ecf957af18b7c2ff5][39424]
Service c:\windows\system32\alg.exe[a1545b731579895d8cc44fc0481c1192][59392]
Service c:\windows\system32\dfsr.exe[fa3463f25f9cc9c3bcf1e7912feff099][2091520]
Service c:\windows\system32\dllhost.exe [be01e566d1f569aab32d0335613e1eea][7168]
Service c:\windows\system32\locator.exe[5123f83cbc4349d065534eeb6bbdc42b][7680]
Service c:\windows\system32\lsass.exe[dcf733788c7d088d814e5f80eb4b3e0f][9728]
Service c:\windows\system32\msdtc.exe[fd7520cc3a80c5fc8c48852bb24c6ded][105984]
Service c:\windows\system32\searchindexer.exe [7778bdfa3f6f6fba0e75b9594098f737][439808]
Service c:\windows\system32\slsvc.exe[0ba91e1358ad25236863039bb2609a2e][2623488]
Service c:\windows\system32\snmptrap.exe[2a146a055b4401c16ee62d18b8e2a032][12800]
Service c:\windows\system32\spoolsv.exe[846cdf9a3cf4da9b306adfb7d55ee4c2][125952]
Service c:\windows\system32\svchost.exe [3794b461c45882e06856f282eef025af][21504]
Service c:\windows\system32\ui0detect.exe[ecef404f62863755951e09c802c94ad5][35840]
Service c:\windows\system32\vds.exe[b13bc395b9d6116628f5af47e0802ac4][382976]
Service c:\windows\system32\vssvc.exe[d5fb73d19c46ade183f968e13f186b23][1054720]
Service c:\windows\system32\wbem\wmiapsrv.exe[aba4cf9f856d9a3a25f4ddd7690a6e9d][137728]
Startup c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini[7f1698bab066b764a314a589d338daae][174]
Startup c:\users\schneider\appdataoaming\microsoft\windows\start menu\programs\startup\desktop.ini[7f1698bab066b764a314a589d338daae][174]
System.ini c:\windows\system32\svchost.exe [3794b461c45882e06856f282eef025af][21504]

Startup folder: (2)
Startup name: desktop.ini
Command: C:\Users\Schneider\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Startup name: desktop.ini
Command: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

Win.ini Startup: (1)
Path: No additional driver found!

Win.ini Startup: (1)
Path: No additional driver found!

Keyboard drivers: (1)
Name: No Keyboard Filter driver found!

Services: (141)
Service Name: Accès du périphérique d'interface utilisateur [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Acquisition d'image Windows (WIA) [Running], 
Path: C:\Windows\system32\svchost.exe -k imgsvc
Service Name: Agent de protection d’accès réseau [Stopped], 
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Agent de stratégie IPsec [Running], 
Path: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
Service Name: Appel de procédure distante (RPC) [Running], 
Path: C:\Windows\system32\svchost.exe -k rpcss
Service Name: Application système COM+ [Stopped], 
Path: C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
Service Name: Assistance IP [Running], 
Path: C:\Windows\System32\svchost.exe -k NetSvcs
Service Name: Assistance NetBIOS sur TCP/IP [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Audio Windows [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: avast! Antivirus [Running], 
Path: "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
Service Name: avast! iAVS4 Control Service [Running], 
Path: "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
Service Name: avast! Mail Scanner [Running], 
Path: "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
Service Name: avast! Web Scanner [Running], 
Path: "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
Service Name: Cache de police de Windows Presentation Foundation 3.0.0.0 [Stopped], 
Path: C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
Service Name: Carte à puce [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Carte de performance WMI [Stopped], 
Path: C:\Windows\system32\wbem\WmiApSrv.exe
Service Name: Centre de sécurité [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Cliché instantané de volume [Stopped], 
Path: C:\Windows\system32\vssvc.exe
Service Name: Client de stratégie de groupe [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Client de suivi de lien distribué [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Client DHCP [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Client DNS [Running], 
Path: C:\Windows\system32\svchost.exe -k NetworkService
Service Name: Collecteur d'événements de Windows [Stopped], 
Path: C:\Windows\system32\svchost.exe -k NetworkService
Service Name: Configuration automatique de réseau câblé [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Configuration des services Terminal Server [Stopped], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Connaissance des emplacements réseau [Running], 
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Connexions réseau [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Contrôle parental [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Coordinateur de transactions distribuées [Stopped], 
Path: C:\Windows\System32\msdtc.exe
Service Name: Cyberlink RichVideo Service(CRVS) [Running], 
Path: "C:\Program Files\CyberLink\Shared Files\RichVideo.exe"
Service Name: Découverte SSDP [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Détection de services interactifs [Stopped], 
Path: C:\Windows\system32\UI0Detect.exe
Service Name: Détection matériel noyau [Running], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Disque virtuel [Stopped], 
Path: C:\Windows\System32\vds.exe
Service Name: Emplacement protégé [Stopped], 
Path: C:\Windows\system32\lsass.exe
Service Name: Énumérateur de bus IP PnP-X [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Expérience audio-vidéo haute qualité Windows [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Expérience d’application [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Explorateur d'ordinateurs [Running], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Fournisseur de cliché instantané de logiciel Microsoft [Stopped], 
Path: C:\Windows\System32\svchost.exe -k swprv
Service Name: Générateur de points de terminaison du service Audio Windows [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Gestion à distance de Windows (Gestion WSM) [Stopped], 
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Gestion des clés et des certificats d'intégrité [Stopped], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Gestionnaire de comptes de sécurité [Running], 
Path: C:\Windows\system32\lsass.exe
Service Name: Gestionnaire de connexion automatique d'accès distant [Stopped], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Gestionnaire de connexions d'accès distant [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Gestionnaire de sessions du Gestionnaire de fenêtrage [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Gestionnaire d'identité réseau homologue [Stopped], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Google Desktop Manager 5.7.806.10245 [Stopped], 
Path: "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"
Service Name: Google Updater Service [Stopped], 
Path: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
Service Name: Groupement de mise en réseau de pairs [Stopped], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Horloge Windows [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Hôte de périphérique UPnP [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Hôte du fournisseur de découverte de fonctions [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Hôte système de diagnostics [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Informations d'application [Stopped], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Infrastructure de gestion Windows [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: InstallDriver Table Manager [Stopped], 
Path: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
Service Name: Interruption SNMP [Stopped], 
Path: C:\Windows\System32\snmptrap.exe
Service Name: Isolation de clé CNG [Running], 
Path: C:\Windows\system32\lsass.exe
Service Name: Journal d’événements Windows [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Journaux & alertes de performance [Stopped], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
Service Name: Lanceur de processus serveur DCOM [Running], 
Path: C:\Windows\system32\svchost.exe -k DcomLaunch
Service Name: Lanceur des services Windows Media Center [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Service Name: Licence du logiciel [Running], 
Path: C:\Windows\system32\SLsvc.exe
Service Name: Localisateur d'appels de procédure distante (RPC) [Stopped], 
Path: C:\Windows\system32\locator.exe
Service Name: Mappage de découverte de topologie de la couche de liaison [Stopped], 
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: Microsoft .NET Framework NGEN v2.0.50727_X86 [Stopped], 
Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
Service Name: Microsoft Office Diagnostics Service [Stopped], 
Path: "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
Service Name: Modules de génération de clés IKE et AuthIP [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Moteur de filtrage de base [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Service Name: Nero BackItUp Scheduler 4.0 [Running], 
Path: C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
Service Name: Netlogon [Stopped], 
Path: C:\Windows\system32\lsass.exe
Service Name: Office Source Engine [Stopped], 
Path: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
Service Name: Ouverture de session secondaire [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Pare-feu Windows [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Service Name: Partage de connexion Internet (ICS) [Stopped], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Planificateur de classes multimédias [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Planificateur de tâches [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Plug-and-Play [Running], 
Path: C:\Windows\system32\svchost.exe -k DcomLaunch
Service Name: Prise en charge de l’application Rapports et solutions aux problèmes du Panneau de configuration [Stopped], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Programme d’installation de modules Windows [Stopped], 
Path: C:\Windows\servicing\TrustedInstaller.exe
Service Name: Propagation du certificat [Stopped], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Protocole de résolution de noms d'homologues [Stopped], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Protocole EAP (Extensible Authentication Protocol) [Running], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Publication des ressources de découverte de fonctions [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Registre à distance [Stopped], 
Path: C:\Windows\system32\svchost.exe -k regsvc
Service Name: Réplication DFS [Stopped], 
Path: C:\Windows\system32\DFSR.exe
Service Name: Routage et accès distant [Stopped], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Roxio Hard Drive Watcher 9 [Running], 
Path: "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe"
Service Name: RoxMediaDB9 [Running], 
Path: "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe"
Service Name: Sauvegarde Windows [Stopped], 
Path: C:\Windows\system32\svchost.exe -k SDRSVC
Service Name: Serveur [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Serveur de priorités des threads [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service de configuration automatique WLAN [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service de découverte automatique de Proxy Web pour les services HTTP Windows [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service de l’Assistant Compatibilité des programmes [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service de la passerelle de la couche Application [Stopped], 
Path: C:\Windows\System32\alg.exe
Service Name: Service de notification d’événements système [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Service de notification de l’interface utilisateur SL [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service de partage de ports Net.Tcp [Stopped], 
Path: "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"
Service Name: Service de planification Windows Media Center [Stopped], 
Path: C:\Windows\ehome\ehsched.exe
Service Name: Service de profil utilisateur [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Service de publication des noms d’ordinateurs PNRP [Stopped], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Service Name: Service de rapport d'erreurs Windows [Running], 
Path: C:\Windows\System32\svchost.exe -k WerSvcGroup
Service Name: Service de réception Windows Media Center [Stopped], 
Path: C:\Windows\ehome\ehRecvr.exe
Service Name: Service de stratégie de diagnostic [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
Service Name: Service de transfert intelligent en arrière-plan [Running], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: Service Énumérateur d’appareil mobile [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service hôte WDIServiceHost [Stopped], 
Path: C:\Windows\System32\svchost.exe -k wdisvc
Service Name: Service Initiateur iSCSI de Microsoft [Stopped], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Service Interface du magasin réseau [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service KtmRm pour Distributed Transaction Coordinator [Running], 
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Service Liste des réseaux [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: Service Messenger Sharing Folders USN Journal Reader [Stopped], 
Path: "C:\Program Files\Windows Live\Messenger\usnsvc.exe"
Service Name: Service Panneau de saisie Tablet PC [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service Partage réseau du Lecteur Windows Media [Stopped], 
Path: "C:\Program Files\Windows Media Player\wmpnetwk.exe"
Service Name: Service ReadyBoost [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Service Windows Media Center Extender [Stopped], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Service SSTP (Secure Socket Tunneling Protocol) [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Services de base de module de plateforme sécurisée [Stopped], 
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: Services de chiffrement [Running], 
Path: C:\Windows\system32\svchost.exe -k NetworkService
Service Name: Services Terminal Server [Running], 
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Spouleur d'impression [Running], 
Path: C:\Windows\System32\spoolsv.exe
Service Name: Station de travail [Running], 
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: stllssvr [Stopped], 
Path: "C:\Program Files\Common Files\SureThing Shared\stllssvr.exe"
Service Name: Stratégie de retrait de la carte à puce [Stopped], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Service Name: Superfetch [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Système de couleurs Windows [Stopped], 
Path: C:\Windows\system32\svchost.exe -k wcssvc
Service Name: Système d'événement COM+ [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Téléphonie [Running], 
Path: C:\Windows\System32\svchost.exe -k NetworkService
Service Name: Thèmes [Running], 
Path: C:\Windows\System32\svchost.exe -k netsvcs
Service Name: WebClient [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalService
Service Name: Windows CardSpace [Stopped], 
Path: "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
Service Name: Windows Connect Now - Registre de configuration [Stopped], 
Path: C:\Windows\System32\svchost.exe -k LocalService
Service Name: Windows Defender [Running], 
Path: C:\Windows\System32\svchost.exe -k secsvcs
Service Name: Windows Driver Foundation - Infrastructure de pilote mode-utilisateur [Running], 
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Service Name: Windows Installer [Stopped], 
Path: C:\Windows\system32\msiexec /V
Service Name: Windows Live Setup Service [Stopped], 
Path: "C:\Program Files\Windows Live\installer\WLSetupSvc.exe"
Service Name: Windows Search [Running], 
Path: C:\Windows\system32\SearchIndexer.exe /Embedding
Service Name: Windows Update [Running], 
Path: C:\Windows\system32\svchost.exe -k netsvcs
Finished...

pimprenelle27 · Answer

Je pense qu'il a du les supprimer mais regarde s'il ne sont pas en quarantaine. ensuite, tu va me faire un nouvel hijackthis et ceci pour m'assurer qu'il n'y a vraiment plus de virus : 

Fais un scan en ligne avec Internet explorer
Rend toi sur ce site : https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan

Voici un tutoriel

secro · Answer

voici le listing
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:05:53, on 15/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\system32\conime.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\RunOnce: [CleanSetup] cmd /C rmdir /S /Q "C:\Users\Schneider\AppData\Local\Temp
ro.tmp\"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

secro · Answer

voila le texte
;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-03-15 16:18:26
PROTECTIONS: 2
MALWARE: 1
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Windows Defender                             1.1.1505.0                    No        Yes
SUPERAntiSpyware                             4, 25, 0, 1014                No        Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00040722  adware/navipromo                   Adware              No        1         Yes            No           hkey_current_user\software\mc
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              x&#65533;/&#65533;&#65533;{39
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                x&#65533;/&#65533;&#65533;{39
;===================================================================================================================================================================================
;===================================================================================================================================================================================

pimprenelle27 · Answer

* éléchargez et enregistrez Navilog1 sur le bureau.
    * Sous XP : double-cliquez dessus pour l'installer et le lancer.
    * Sous vista : faites un clic droit sur Navilog1 présent sur le bureau et choisissez "exécuter en tant qu'administrateur".
    * Quand il sera installé, appuyez sur F pour Français.
    * Appuyez sur une touche jusqu'à ce que vous arriviez au menu des options.
    * Tapez 1 pour exécuter une recherche.
    * Laissez le programme travailler, il pourrait durer une dizaine de minutes.
    * Un rapport va être généré dans le bloc note à la fin de l'analyse
    * Il sera aussi enregistré automatiquement sur votre disque C ( C:\fixnavi.txt )
    * Voici un tutoriel qui vous explique le fonctionnement de Navilog1 :


http://il.mafioso.pagesperso-orange.fr/Navifix/presentation.htm

Pour ceux qui ont vista, ne pas oublier de désactiver Le contrôle des comptes utilisateurs

secro · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:32:37, on 15/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\RunOnce: [CleanSetup] cmd /C rmdir /S /Q "C:\Users\Schneider\AppData\Local\Temp
ro.tmp\"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

secro · Answer

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual-Core Processor TK-57 )
BIOS : Version 1.0
USER : Schneider ( Not Administrator ! )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:141 Go (Free:99 Go)
D:\ (CD or DVD)


Recherche executé en mode normal


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\schnei~1\appdataoaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\Schneider\AppData\Local\virtualstore\Program Files" ***


*** Recherche dossiers dans "C:\Users\Yoann\AppData\Local\virtualstore\Program Files" ***



*** Recherche dossiers dans "C:\Users\Schneider\AppData\Local" ***



*** Recherche dossiers dans "C:\Users\Yoann\AppData\Local" *** 




*** Recherche dossiers dans "C:\Users\Schneider\AppData\Roaming" ***


*** Recherche dossiers dans "C:\Users\NATIVI~1\appdataoaming" ***


*** Recherche dossiers dans "C:\Users\Yoann\appdataoaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\Schneider\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\Schneider\AppData\Local\virtualstore\windows\system32" *

* Recherche dans "C:\Users\Schneider\AppData\Local" *

* Recherche dans "C:\Users\Yoann\AppData\Local" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\mc 

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\Schneider\AppData\Local\Microsoft" :


* Dans "C:\Users\Schneider\AppData\Local\virtualstore\windows\system32" :


* Dans "C:\Users\Schneider\AppData\Local" :


* Dans "C:\Users\Yoann\AppData\Local" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 15/03/2009 à 17:44:01,49 ***

a titre d info gnc exe m a indiqué qu il a cessé de foctionnér  a la fin de l recherche

pimprenelle27 · Answer

désinfection automatique

    * Relancez Navilog1 comme expliqué lors de la recherche.
    * Cette fois-ci tapez 2 pour exécuter une désinfection automatique. (le bureau disparaît, c'est normal)
    * Le PC va redémarrer.
    * Après redémarrage, un rapport va être généré dans le bloc note.
    * Vérifiez que tout a bien été supprimé car il se pourrait que certains fichiers ne soient pas supprimés lors de la désinfection automatique...


ensuite un nouvel hijackthhis.

secro · Answer

voila

Clean Navipromo version 3.7.6 commencé le 15/03/2009 à 17:51:49,89

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual-Core Processor TK-57 )
BIOS : Version 1.0
USER : Schneider ( Not Administrator ! )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:141 Go (Free:99 Go)
D:\ (CD or DVD)


Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *


* Suppression dans "C:\Users\Schneider\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\Schneider\AppData\Local\virtualstore\windows\system32" *


* Suppression dans "C:\Users\Schneider\AppData\Local" *


* Suppression dans "C:\Users\Yoann\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\schnei~1\appdataoaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\Yoann\appdataoaming\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "C:\Users\Schneider\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\Yoann\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\Schneider\AppData\Local" ***


*** Suppression dossiers dans "C:\Users\Yoann\AppData\Local" *** 


*** Suppression dossiers dans "C:\Users\Schneider\AppData\Roaming" ***


*** Suppression dossiers dans "C:\Users\NATIVI~1\appdataoaming" *** 


*** Suppression dossiers dans "C:\Users\Yoann\appdataoaming" *** 



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\SCHNEI~1\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\Schneider\AppData\Local\Microsoft" *


* Dans "C:\Users\Schneider\AppData\Local\virtualstore\windows\system32" *


* Dans "C:\Users\Schneider\AppData\Local" *


* Dans "C:\Users\Yoann\AppData\Local" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !


*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 15/03/2009 à 18:03:47,73 ***

secro · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:07:47, on 15/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

pimprenelle27 · Answer

Tu relance hijackthis, mais là tu clique juste sur faire un scan, ensuite tu sélectionne les lignes puis,

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

Tu cliques en bas sur le bouton FIX CHECKED et valides .



2- Redémarres l'ordi .
( important pour que certaines modifs faites avec hijakthis soient prises en compte )


Ensuite ceci : 

Télécharge Toolscleaner sur ton Bureau :

* Double-clique sur ToolsCleaner2.exe et laisse le travailler
* Clique sur Recherche et laisse le scan se terminer.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options facultatives.
* Clique sur Quitter, pour que le rapport puisse se créer.
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse


Puis ceci afin de voir si ton pc est à jour : 

pour voir si ton pc est à jour :

http://www.filehippo.com/updatechecker/UpdateChecker.exe (attention certain logiciels mis en lien pour les mises à jour peuvent être en anglais, rechercher à ce moment là celui en français)

secro · Answer

voila es ce bon?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:12:45, on 15/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

secro · Answer

voila j'ai fait ce que tu m'a dit j'ai coché les fichiers et redemarer et maintenant svp merci

secro · Answer

ne tiens pas compte du 30 erreur de manip désolé

pimprenelle27 · Answer

tu as fait le reste aussi?

secro · Answer

[ Rapport ToolsCleaner version 2.3.2 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: trouvé !
C:\Users\Public\Desktop\Navilog1.lnk: trouvé !
C:\Users\Schneider\Desktop\HijackThis.lnk: trouvé !
C:\Users\Schneider\Downloads\Navilog1.exe: trouvé !
C:\Users\Schneider\Downloads\HJTInstall.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1\Navilog1.lnk: supprimé !
C:\Users\Public\Desktop\Navilog1.lnk: supprimé !
C:\Users\Schneider\Desktop\HijackThis.lnk: supprimé !
C:\Users\Schneider\Downloads\Navilog1.exe: supprimé !
C:\Users\Schneider\Downloads\HJTInstall.exe: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: supprimé !

je n' avais pas cette partie desolé

secro · Answer

voila j'ai tout fait 
en 34 tu verras le texte toolcleaner 
merci

pimprenelle27 · Answer

il n'y aura que c'est 2 là à supprimer manuellement, et pour la mise à jour de ton pc?

C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: ERREUR DE SUPPRESSION !!

secro · Answer

je ne sait pas cmment oter ces dex fichiers un peu d aide serrait la bien venue merci

pimprenelle27 · Answer

tu vas dans C:\ProgramData\Microsoft\Windows\Start Menu\Programmes

secro · Answer

Je ne les trouve pas dans c:programdata
que doit je faire

pimprenelle27 · Answer

et dans la suite non plus Microsoft\Windows\Start Menu\Programmes

pimprenelle27 · Answer

fait une recherche sur hijackthis et navilog.

pimprenelle27 · Answer

je me suis mal exprimer en disant recherche, je voulais une recherche sur ton pc afin de retrouver les fichiers restant à supprimer.

secro · Answer

salut 
c esd deux programmmes ne sont plus la en faisant une recherche dans le c

pimprenelle27 · Answer

bon ba il on du être supprimé alors. comment vas ton pc?

Probleme de virus

43 réponses

Votre réponse

Discussions similaires

Newsletters