virus

Question

Bonjour,
mon ordi est infecté. le gestionnaire des taches est toujours verouillé c'est a dire je ne peux pas y cliquer. l'ordi est trop lent. 
le pire c ke l'antivirus ne fonctionne pas aussi.je sais plus koi faire. g utilisé plusieurs antivirus mais en vain.
et si j'essaye le formatage, je vais perdre beaucoup de fichiers dans l'ordi. et si je les garde dans d'autres mémoires le probleme est que je sais pas s'ils sont infectés ou non (les fichiers).
kelle est la soluton?
merci d'avance.

Destrio5 · Answer

Salut,

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

biba31 · Answer

info.txt



info.txt logfile of random's system information tool 1.05 2009-03-18 13:10:38

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Apple Software Update-->MsiExec.exe /I{74EC78BC-B379-4E29-9006-8F161DCAABA6}
Art-lantis 4.5-->C:\WINDOWS\unvise32.exe C:\Program Files\Art-lantis 4.5\Art.uninstal.log
Athan Basic 3.0 -->C:\WINDOWS\iun6002.exe "C:\Program Files\Athan\irunin.ini"
AutoCAD 2004-->MsiExec.exe /I{5783F2D7-0201-0409-0002-0060B0CE6BBA}
Autodesk Express Viewer-->C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove
Avira AntiVir Premium-->C:\Program Files\Avira\AntiVir PersonalEdition Premium\setup.exe /REMOVE
Barre d'outils Outlook de Windows Live (Windows Live Toolbar)-->MsiExec.exe /X{4002F73D-EBB3-4EA1-A2FF-DBCB4529759E}
Bloqueur de fenêtres pop-up (Windows Live Toolbar)-->MsiExec.exe /X{51F366F4-C2E4-429A-866A-59C885ED42FD}
BlueSoleil-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B9F499B8-D1F0-42FC-84BE-CC552123CCCB}\Setup.exe" -l0x40c 
CA VMN Anti-Spyware (remove only)-->"C:\Program Files\CA VMN Anti-Spyware\uninstall.exe"
CA Yahoo! Anti-Spy (remove only)-->"C:\Program Files\CA Yahoo! Anti-Spy\uninstall.exe"
Canon PhotoRecord-->MsiExec.exe /X{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}
Canon PIXMA iP1000-->C:\WINDOWS\system32\CNMCP6e.exe "-PRINTERNAMECanon PIXMA iP1000" "-HELPERDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP1000 Installer\Inst2\cnmis.dll" "-RCDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP1000 Installer\Inst2\cnmi0409.dll"
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe C:\Program Files\Canon\Easy-PhotoPrint\uninst.ini
Canon Utilities Easy-PrintToolBox-->C:\WINDOWS\BJPSUNST.EXE
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Codec Pack - All In 1 6.0.3.0-->C:\WINDOWS\iun6002.exe "C:\Program Files\Codec Pack - All In 1\irunin.ini"
Collection Microsoft Encarta 2006-->MsiExec.exe /I{06180000-3E21-46D6-9A91-D927BA08F41D}
Crawler Toolbar with Web Security Guard-->C:\PROGRA~1\Crawler\CToolbar.exe uninst
Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{175B7C4A-CAF8-437A-B597-73E0D2D970FE}
Direct Show Ogg Vorbis Filter (remove only)-->"C:\WINDOWS\system32\OggDSuninst.exe"
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Driver Detective-->C:\Program Files\InstallShield Installation Information\{621C02EA-AAFF-4026-A903-165D59529A16}\setup.exe -runfromtemp -l0x0409
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{D518AD32-C710-4616-BA0D-D4B1FA5F82E8}
Gif Movie Gear 4-->"C:\Program Files\Visicom Media\GMG 4\uninst-gmg.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP PrecisionScan LT Software-->C:\SCANJET\PrecisionScanLT\uninstal.exe C:\SCANJET\PrecisionScanLT\uninstal.cfg
HSP56 Modem Drivers-->ptuninst.exe
IKEA HomePlanner Bedroom-->MsiExec.exe /I{36E7C1C1-E5F7-4E22-8B40-7B333FC616E3}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Kaspersky Anti-Virus 2009-->MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
Kaspersky Anti-Virus 2009-->MsiExec.exe /I{6580C5A3-2336-4EC5-85F1-3448C5F6208A}
L&H TTS3000 Français-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSFRF.inf, Uninstall
LiveUpdate (Symantec Corporation)-->MsiExec.exe /x {E80F62FF-5D3C-4A19-8409-9721F2928206} /l*v "C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate"
Macromedia Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Matroska (remove only)-->"C:\Program Files\Matroska\uninstall.exe"
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{3585ED1C-74C5-43B0-A232-831B96A12A2B}
Messenger Plus! Live & Sponsor (CiD)-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office FrontPage 2003-->MsiExec.exe /I{9017040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft Office XP Web Components-->MsiExec.exe /I{9026040C-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MixVibes PRO 4 uninstall-->C:\Program Files\MixVibesPro4\uninstall.exe
Mozilla Firefox (3.0.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{E74559C2-BB47-45AD-83DD-0D66B67E7811}
Nero 7 Premium-->MsiExec.exe /I{70AB1576-7883-2313-C650-7A71270B1036}
OneCare Advisor (Windows Live Toolbar)-->MsiExec.exe /X{F242B06B-517F-4D62-B654-16B11564A912}
Pack Vista Inspirat 2 1.0-->C:\WINDOWS\BricoPacks\Vista Inspirat 2\Remove.exe
PhotoFiltre Studio-->"C:\Program Files\PhotoFiltre Studio\Uninst.exe"
QuickTime-->MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c  -removeonly
Registry Mechanic 7.0-->"C:\Program Files\Registry Mechanic\unins000.exe"
SafeCast Shared Components-->C:\Program Files\Fichiers communs\Macrovision Shared\SafeCast\Install\CDAC13BA.EXE /uninstall
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype(TM) 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sonic Foundry Sound Forge 6.0a-->MsiExec.exe /I{6CDC68BB-C997-4ADC-9BA0-6293FB88521E}
Spyware Doctor 5.1-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
StairDesigner 6.03a-->C:\Program Files\Boole & Partners\StairDesigner 6\Uninstall.exe
Unlocker 1.8.7-->C:\Program Files\Unlocker\uninst.exe
VIA Platform Device Manager-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} 
VIA Rhine-Family Fast Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VIA/S3G Display Driver-->C:\PROGRA~1\VIA\UChromeP\s3minset.exe /u C:\PROGRA~1\VIA\UChromeP\UChromeP.uns
VMN Toolbar-->C:\Program Files\vmntoolbar\uninstall.exe
Winamp (remove only)-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{DCE65B11-710D-4C54-9DE5-1A6A0BD2186B}
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Sign-in Assistant-->MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {05AE605F-3146-46ED-BC52-0A14EBF57962}
Windows Live Toolbar-->MsiExec.exe /X{05AE605F-3146-46ED-BC52-0A14EBF57962}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Yahoo! Extras-->C:\PROGRA~1\Yahoo!\Common\unyext.exe
Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
Yahoo! Internet Mail-->C:\WINDOWS\system32\regsvr32 /u /s C:\PROGRA~1\Yahoo!\Common\ymmapi.dll
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Security center information======

AV: Avira AntiVir PersonalEdition (disabled) (outdated)
AV: Kaspersky Anti-Virus (outdated)

System event log

Computer Name: ES-1D0DC7C34A5A
Event Code: 17
Message: AVGNTFLT successfully loaded

Record Number: 5
Source Name: avgntflt
Time Written: 20090219193204.000000+060
Event Type: information
User: 

Computer Name: ES-1D0DC7C34A5A
Event Code: 4201
Message: Le système a détecté que la carte réseau Miniport...- Miniport d'ordonnancement de paquets était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 4
Source Name: Tcpip
Time Written: 20090219193204.000000+060
Event Type: information
User: 

Computer Name: ES-1D0DC7C34A5A
Event Code: 10
Message: Ce lecteur ne semble pas prendre en charge la lecture audio numérique.

Record Number: 3
Source Name: redbook
Time Written: 20090219193204.000000+060
Event Type: information
User: 

Computer Name: ES-1D0DC7C34A5A
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20090219193141.000000+060
Event Type: information
User: 

Computer Name: ES-1D0DC7C34A5A
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090219193141.000000+060
Event Type: information
User: 

Application event log

Computer Name: ES-1D0DC7C34A5A
Event Code: 103
Message: msnmsgr (1140) \.\C:\Documents and Settings\poi\Local Settings\Application Data\Microsoft\Messenger\(adresse mail supprimée)\SharingMetadata\Working\database_1870_6B4E_706B_31A4\dfsr.db: Le moteur de base de données a arrêté une instance (0).

Record Number: 75
Source Name: ESENT
Time Written: 20081229002839.000000+060
Event Type: information
User: 

Computer Name: ES-1D0DC7C34A5A
Event Code: 704
Message: msnmsgr (1140) La défragmentation en ligne de la base de données '\.\C:\Documents and Settings\poi\Local Settings\Application Data\Microsoft\Messenger\(adresse mail supprimée)\SharingMetadata\Working\database_1870_6B4E_706B_31A4\dfsr.db' a été interrompue et arrêtée. La prochaine fois qu'une défragmentation en ligne sera effectuée dans cette base de données, elle reprendra à l'endroit où elle a été interrompue.

Record Number: 74
Source Name: ESENT
Time Written: 20081229002837.000000+060
Event Type: information
User: 

Computer Name: ES-1D0DC7C34A5A
Event Code: 701
Message: msnmsgr (1140) La défragmentation en ligne a terminé un passage complet dans la base de données '\.\C:\Documents and Settings\poi\Local Settings\Application Data\Microsoft\Messenger\(adresse mail supprimée)\SharingMetadata\Working\database_1870_6B4E_706B_31A4\dfsr.db'.

Record Number: 73
Source Name: ESENT
Time Written: 20081229000008.000000+060
Event Type: information
User: 

Computer Name: ES-1D0DC7C34A5A
Event Code: 700
Message: msnmsgr (1140) La défragmentation en ligne commence un passage complet dans la base de données '\.\C:\Documents and Settings\poi\Local Settings\Application Data\Microsoft\Messenger\(adresse mail supprimée)\SharingMetadata\Working\database_1870_6B4E_706B_31A4\dfsr.db'.

Record Number: 72
Source Name: ESENT
Time Written: 20081229000007.000000+060
Event Type: information
User: 

Computer Name: ES-1D0DC7C34A5A
Event Code: 4096
Message: The AntiVir service has been started successfully!

Record Number: 71
Source Name: Avira AntiVir
Time Written: 20081228230157.000000+060
Event Type: information
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Fichiers communs\Autodesk Shared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

biba31 · Answer

log.txt : 




Logfile of random's system information tool 1.05 (written by random/random)
Run by poi at 2009-03-18 13:07:46
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 16 GB (41%) free of 40 GB
Total RAM: 223 MB (13% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:10:30, on 18/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\TEMP\winpkil.exe
C:\WINDOWS\TEMP\eslda.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Documents and Settings\poi\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files	rend micro\poi.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.imesh.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60429
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60429
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - (no file)
O2 - BHO: VMN Toolbar - {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {147D6308-0614-4112-89B1-31402F9B82C4} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: VMN Toolbar - {A057A204-BACC-4D26-8287-79A187E26987} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?4da68c61d46244d8959fccf8ff8804ea
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?4da68c61d46244d8959fccf8ff8804ea
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd.dll
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: Kaspersky Anti-Virus (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

Destrio5 · Answer

Tu es infecté.

Tu as deux antivirus, il faut en retirer un.

--> Télécharge Lop S&D (par Eric_71 & Angeldark) sur ton Bureau. 

--> Double-clique dessus pour lancer l'installation. 

--> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau. 
(Sous Vista, il faut cliquer droit sur le raccourci de Lop S&D et choisir Exécuter en tant qu'administrateur) 

--> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche). 

--> Patiente jusqu'à la fin du scan. 

--> Poste le rapport généré (C:\lopR.txt).

biba31 · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.66GHz )
   BIOS : Default System BIOS
   USER : poi ( Administrator )
   BOOT : Normal boot
   Antivirus : Kaspersky Anti-Virus 8.0.0.357 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:39 Go (Free:15 Go)
   D:\ (Local Disk) - NTFS - Total:37 Go (Free:26 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 18/03/2009|13:52 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [16/02/2007|20:56] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
   [20/06/2007|08:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
   [13/06/2007|13:40] C:\DOCUME~1\ADMINI~1\APPLIC~1\Ahead
   [14/07/2007|17:43] C:\DOCUME~1\ADMINI~1\APPLIC~1\DivX
   [14/10/2007|22:17] C:\DOCUME~1\ADMINI~1\APPLIC~1\Google
   [19/01/2007|11:56] C:\DOCUME~1\ADMINI~1\APPLIC~1\Help
   [30/08/2006|14:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [30/08/2006|17:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [26/08/2007|20:16] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [17/10/2007|20:10] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla
   [02/11/2007|21:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real
   [27/11/2007|01:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Skype

   [17/12/2007|12:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Abvent
   [29/09/2008|23:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [18/12/2007|08:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [18/12/2007|08:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [27/08/2008|14:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Audio 4 part browse
   [16/01/2008|08:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
   [28/12/2008|23:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [17/11/2007|19:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
   [04/01/2008|12:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Boole & Partners
   [13/12/2008|19:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EmailNotifier
   [22/11/2008|22:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
   [14/10/2007|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [07/03/2009|23:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
   [28/05/2008|21:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
   [16/01/2008|08:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
   [08/06/2008|23:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [14/12/2007|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [19/02/2009|07:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSScanAppDataDir
   [11/01/2009|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Drivers HeadQuarters
   [29/11/2008|21:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [20/02/2009|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanAppDataDir
   [08/03/2009|19:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [23/05/2008|20:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [14/12/2007|18:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [27/11/2007|01:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [11/04/2008|16:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [11/04/2008|14:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

   [04/09/2008|15:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [30/08/2006|12:06] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [15/03/2008|20:20] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft

   [04/09/2008|15:43] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [21/12/2007|10:07] C:\DOCUME~1\poi\APPLIC~1\Abvent
   [07/09/2008|15:05] C:\DOCUME~1\poi\APPLIC~1\Adobe
   [04/12/2007|00:36] C:\DOCUME~1\poi\APPLIC~1\AdobeUM
   [12/03/2009|21:04] C:\DOCUME~1\poi\APPLIC~1\Ahead
   [18/12/2007|08:48] C:\DOCUME~1\poi\APPLIC~1\Apple Computer
   [17/12/2007|09:20] C:\DOCUME~1\poi\APPLIC~1\Autodesk
   [29/12/2008|19:31] C:\DOCUME~1\poi\APPLIC~1\Avira
   [07/03/2009|19:54] C:\DOCUME~1\poi\APPLIC~1\CoSoSys
   [12/03/2009|21:08] C:\DOCUME~1\poi\APPLIC~1\Desktopicon
   [04/12/2007|00:37] C:\DOCUME~1\poi\APPLIC~1\DivX
   [13/12/2008|19:25] C:\DOCUME~1\poi\APPLIC~1\EmailNotifier
   [06/02/2009|22:44] C:\DOCUME~1\poi\APPLIC~1\Google
   [17/12/2007|09:18] C:\DOCUME~1\poi\APPLIC~1\Help
   [17/02/2008|16:55] C:\DOCUME~1\poi\APPLIC~1\Identities
   [13/02/2009|23:24] C:\DOCUME~1\poi\APPLIC~1\LimeWire
   [06/12/2007|20:50] C:\DOCUME~1\poi\APPLIC~1\Macromedia
   [12/03/2009|23:20] C:\DOCUME~1\poi\APPLIC~1\Microsoft
   [12/09/2008|02:15] C:\DOCUME~1\poi\APPLIC~1\Mozilla
   [20/02/2008|23:07] C:\DOCUME~1\poi\APPLIC~1\Real
   [18/03/2009|13:26] C:\DOCUME~1\poi\APPLIC~1\Skype
   [18/03/2009|12:10] C:\DOCUME~1\poi\APPLIC~1\skypePM
   [27/08/2008|14:39] C:\DOCUME~1\poi\APPLIC~1\SOFTACEMEDIA
   [26/11/2008|19:29] C:\DOCUME~1\poi\APPLIC~1\Sonic Foundry
   [06/04/2008|21:42] C:\DOCUME~1\poi\APPLIC~1\Sun
   [13/03/2009|23:52] C:\DOCUME~1\poi\APPLIC~1\vmntoolbar
   [11/04/2008|14:40] C:\DOCUME~1\poi\APPLIC~1\Yahoo!
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [18/03/2009 10:14][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [18/03/2009 13:50][--a------] C:\WINDOWS	asks\V‚rifier les mises … jour de Windows Live Toolbar.job
   [18/03/2009 13:28][--ah-----] C:\WINDOWS	asks\SA.DAT
   [28/09/2001 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini
   [18/03/2009 13:00][--ah-----] C:\WINDOWS	asks\A9BD6FBF918AE70B.job

   ( A9BD6FBF918AE70B.job )=( c:\docume~1\poi\applic~1\softac~1\AXISVIEWPILE.exe )

   --------------------\  Listing des dossiers dans C:\Program Files

   [29/09/2008|23:10] C:\Program Files\Adobe
   [16/01/2008|08:42] C:\Program Files\AnswerWorks 4.0
   [07/06/2007|16:58] C:\Program Files\aod
   [18/12/2007|08:35] C:\Program Files\Apple Software Update
   [19/01/2008|18:37] C:\Program Files\art-lantis 4.5
   [30/08/2006|17:15] C:\Program Files\Athan
   [16/01/2008|08:45] C:\Program Files\AutoCAD 2004
   [17/12/2007|09:18] C:\Program Files\Autodesk
   [28/12/2008|22:59] C:\Program Files\Avira
   [04/01/2008|12:23] C:\Program Files\Boole & Partners
   [13/12/2008|19:25] C:\Program Files\CA VMN Anti-Spyware
   [02/03/2009|22:07] C:\Program Files\CA Yahoo! Anti-Spy
   [15/09/2006|20:19] C:\Program Files\Canon
   [02/05/2008|15:42] C:\Program Files\CCleaner
   [17/10/2008|13:37] C:\Program Files\Circle Developement
   [30/07/2007|12:36] C:\Program Files\Codec Pack - All In 1
   [30/08/2006|12:03] C:\Program Files\ComPlus Applications
   [02/03/2009|22:07] C:\Program Files\Crawler
   [20/03/2008|19:56] C:\Program Files\Davilex Games
   [20/06/2007|10:50] C:\Program Files\DivX
   [20/05/2008|18:20] C:\Program Files\e-anim
   [28/12/2008|20:35] C:\Program Files\Fichiers communs
   [06/02/2009|22:41] C:\Program Files\Google
   [15/02/2008|13:51] C:\Program Files\Horloge
   [04/01/2008|12:28] C:\Program Files\IKEA HomePlanner
   [20/03/2008|19:55] C:\Program Files\InstallShield Installation Information
   [15/06/2008|17:33] C:\Program Files\Intel
   [29/12/2008|18:27] C:\Program Files\Internet Explorer
   [17/11/2007|19:02] C:\Program Files\IVT Corporation
   [06/04/2008|17:14] C:\Program Files\Java
   [07/03/2009|23:41] C:\Program Files\Kaspersky Lab
   [21/05/2007|09:22] C:\Program Files\Matroska
   [04/09/2008|15:57] C:\Program Files\Messenger
   [13/02/2009|13:35] C:\Program Files\Messenger Plus! Live
   [04/09/2008|15:54] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [30/08/2006|17:03] C:\Program Files\Microsoft Encarta
   [30/08/2006|12:07] C:\Program Files\microsoft frontpage
   [16/01/2008|08:42] C:\Program Files\Microsoft Office
   [30/08/2006|17:11] C:\Program Files\Microsoft Visual Studio
   [28/12/2008|18:56] C:\Program Files\Microsoft Works
   [30/08/2006|17:10] C:\Program Files\Microsoft.NET
   [08/05/2008|19:50] C:\Program Files\MixVibesPro4
   [04/12/2007|21:16] C:\Program Files\Movie Maker
   [18/03/2009|13:48] C:\Program Files\Mozilla Firefox
   [26/05/2007|09:30] C:\Program Files\MSN
   [30/08/2006|12:03] C:\Program Files\MSN Gaming Zone
   [08/06/2008|23:05] C:\Program Files\MSN Messenger
   [01/09/2007|09:17] C:\Program Files\MSXML 4.0
   [30/08/2006|17:22] C:\Program Files\Nero
   [30/08/2006|12:04] C:\Program Files\NetMeeting
   [08/03/2009|19:38] C:\Program Files\Norton AntiVirus
   [30/08/2006|12:03] C:\Program Files\Online Services
   [29/12/2008|17:25] C:\Program Files\Outlook Express
   [11/01/2009|18:14] C:\Program Files\PC Drivers HeadQuarters
   [18/04/2007|21:14] C:\Program Files\PhotoFiltre Studio
   [18/12/2007|08:37] C:\Program Files\QuickTime
   [22/10/2008|18:17] C:\Program Files\Real
   [21/12/2006|18:43] C:\Program Files\Realtek AC97
   [26/11/2007|23:09] C:\Program Files\Registry Mechanic
   [30/08/2006|12:05] C:\Program Files\Services en ligne
   [26/03/2008|17:53] C:\Program Files\Sierra On-Line
   [29/11/2008|21:46] C:\Program Files\Skype
   [27/11/2005|16:56] C:\Program Files\SOFTACEMEDIA
   [21/11/2008|00:17] C:\Program Files\Sonic Foundry
   [21/11/2008|00:15] C:\Program Files\Sonic Foundry Setup
   [28/11/2005|17:43] C:\Program Files\Symantec AntiVirus
   [18/03/2009|13:10] C:\Program Files	rend micro
   [30/08/2006|14:23] C:\Program Files\Uninstall Information
   [07/03/2009|23:22] C:\Program Files\Unlocker
   [30/08/2006|16:40] C:\Program Files\VIA
   [13/12/2008|19:24] C:\Program Files\Visicom Media
   [13/12/2008|19:25] C:\Program Files\vmntoolbar
   [02/05/2008|18:44] C:\Program Files\Winamp
   [08/06/2008|23:05] C:\Program Files\Windows Live
   [14/12/2007|19:05] C:\Program Files\Windows Live Favorites
   [03/05/2008|17:02] C:\Program Files\Windows Live Toolbar
   [29/12/2008|17:29] C:\Program Files\Windows Media Player
   [22/11/2005|00:24] C:\Program Files\Windows NT
   [08/03/2009|19:38] C:\Program Files\Windows Sidebar
   [30/08/2006|12:05] C:\Program Files\WindowsUpdate
   [02/05/2008|21:43] C:\Program Files\WinRAR
   [30/08/2006|12:07] C:\Program Files\xerox
   [11/04/2008|16:42] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [29/09/2008|23:09] C:\Program Files\Fichiers communs\Adobe
   [30/08/2006|17:25] C:\Program Files\Fichiers communs\Ahead
   [16/01/2008|08:42] C:\Program Files\Fichiers communs\Autodesk Shared
   [16/01/2008|08:42] C:\Program Files\Fichiers communs\DESIGNER
   [17/11/2007|19:02] C:\Program Files\Fichiers communs\InstallShield
   [06/04/2008|16:51] C:\Program Files\Fichiers communs\Java
   [16/01/2008|08:44] C:\Program Files\Fichiers communs\Macrovision Shared
   [28/12/2008|18:55] C:\Program Files\Fichiers communs\Microsoft Shared
   [30/08/2006|12:04] C:\Program Files\Fichiers communs\MSSoap
   [30/08/2006|13:52] C:\Program Files\Fichiers communs\ODBC
   [22/10/2008|18:18] C:\Program Files\Fichiers communs\Real
   [07/10/2008|20:01] C:\Program Files\Fichiers communs\Scanner
   [30/08/2006|12:04] C:\Program Files\Fichiers communs\Services
   [29/11/2008|21:45] C:\Program Files\Fichiers communs\Skype
   [30/08/2006|13:52] C:\Program Files\Fichiers communs\SpeechEngines
   [08/03/2009|20:02] C:\Program Files\Fichiers communs\Symantec Shared
   [29/12/2008|17:25] C:\Program Files\Fichiers communs\System
   [27/11/2007|01:07] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [04/01/2008|12:27] C:\Program Files\Fichiers communs\Wise Installation Wizard
   [22/10/2008|18:18] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 29 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Audio 4 part browse
   C:\DOCUME~1\poi\APPLIC~1\softac~1
   C:\Program Files\softac~1
   C:\Program Files\Circle Developement
   C:\WINDOWS\Tasks\A9BD6FBF918AE70B.job
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-03-18 13:54:33
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 18
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\poi\Mes documents\programmes telecharg‚s+setup\Sound Forge 6\KeyGen
   C:\DOCUME~1\poi\Mes documents\programmes telecharg‚s+setup\Sound Forge 6\KeyGen\KEYGEN.EXE
   C:\DOCUME~1\poi\Mes documents\programmes telecharg‚s+setup\Sound Forge 6\KeyGen\KG.NFO
   C:\DOCUME~1\poi\Mes documents\programmes telecharg‚s+setup\Sound Forge 6\KeyGen\RENEGADE.NFO


   [F:1260][D:146]-> C:\DOCUME~1\poi\LOCALS~1\Temp
   [F:1][D:0]-> C:\DOCUME~1\poi\Cookies
   [F:94][D:4]-> C:\DOCUME~1\poi\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 18/03/2009|13:56 - Option : [1]

   --------------------\  Fin du rapport a 13:56:12

Destrio5 · Answer

--> Double-clique sur le raccourci de Lop S&D pour le lancer. 
(Sous Vista, il faut cliquer droit sur le raccourci de Lop S&D et choisir Exécuter en tant qu'administrateur) 

--> Choisis cette fois-ci l'option 2 (Suppression). 

--> Ne ferme pas la fenêtre lors de la suppression ! 

--> Poste le rapport généré (C:\lopR.txt). 

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

biba31 · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.66GHz )
   BIOS : Default System BIOS
   USER : poi ( Administrator )
   BOOT : Normal boot
   Antivirus : Kaspersky Anti-Virus 8.0.0.357 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:39 Go (Free:15 Go)
   D:\ (Local Disk) - NTFS - Total:37 Go (Free:26 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 18/03/2009|14:22 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\WINDOWS\Tasks\A9BD6FBF918AE70B.job 
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Audio 4 part browse
   Supprime! - C:\DOCUME~1\poi\APPLIC~1\softac~1
   Supprime! - C:\Program Files\softac~1
   Supprime! - C:\Program Files\Circle Developement
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [16/02/2007|20:56] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
   [20/06/2007|08:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
   [13/06/2007|13:40] C:\DOCUME~1\ADMINI~1\APPLIC~1\Ahead
   [14/07/2007|17:43] C:\DOCUME~1\ADMINI~1\APPLIC~1\DivX
   [14/10/2007|22:17] C:\DOCUME~1\ADMINI~1\APPLIC~1\Google
   [19/01/2007|11:56] C:\DOCUME~1\ADMINI~1\APPLIC~1\Help
   [30/08/2006|14:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [30/08/2006|17:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [26/08/2007|20:16] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [17/10/2007|20:10] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla
   [02/11/2007|21:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real
   [27/11/2007|01:47] C:\DOCUME~1\ADMINI~1\APPLIC~1\Skype

   [17/12/2007|12:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Abvent
   [29/09/2008|23:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [18/12/2007|08:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [18/12/2007|08:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [16/01/2008|08:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
   [28/12/2008|23:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [17/11/2007|19:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
   [04/01/2008|12:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Boole & Partners
   [13/12/2008|19:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\EmailNotifier
   [22/11/2008|22:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
   [14/10/2007|21:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [07/03/2009|23:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
   [28/05/2008|21:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
   [16/01/2008|08:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macrovision
   [08/06/2008|23:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [14/12/2007|19:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [19/02/2009|07:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSScanAppDataDir
   [11/01/2009|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Drivers HeadQuarters
   [29/11/2008|21:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [20/02/2009|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanAppDataDir
   [08/03/2009|19:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [23/05/2008|20:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [14/12/2007|18:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [27/11/2007|01:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [11/04/2008|16:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [11/04/2008|14:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

   [04/09/2008|15:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [30/08/2006|12:06] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [15/03/2008|20:20] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft

   [04/09/2008|15:43] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [21/12/2007|10:07] C:\DOCUME~1\poi\APPLIC~1\Abvent
   [07/09/2008|15:05] C:\DOCUME~1\poi\APPLIC~1\Adobe
   [04/12/2007|00:36] C:\DOCUME~1\poi\APPLIC~1\AdobeUM
   [12/03/2009|21:04] C:\DOCUME~1\poi\APPLIC~1\Ahead
   [18/12/2007|08:48] C:\DOCUME~1\poi\APPLIC~1\Apple Computer
   [17/12/2007|09:20] C:\DOCUME~1\poi\APPLIC~1\Autodesk
   [29/12/2008|19:31] C:\DOCUME~1\poi\APPLIC~1\Avira
   [07/03/2009|19:54] C:\DOCUME~1\poi\APPLIC~1\CoSoSys
   [12/03/2009|21:08] C:\DOCUME~1\poi\APPLIC~1\Desktopicon
   [04/12/2007|00:37] C:\DOCUME~1\poi\APPLIC~1\DivX
   [13/12/2008|19:25] C:\DOCUME~1\poi\APPLIC~1\EmailNotifier
   [06/02/2009|22:44] C:\DOCUME~1\poi\APPLIC~1\Google
   [17/12/2007|09:18] C:\DOCUME~1\poi\APPLIC~1\Help
   [17/02/2008|16:55] C:\DOCUME~1\poi\APPLIC~1\Identities
   [13/02/2009|23:24] C:\DOCUME~1\poi\APPLIC~1\LimeWire
   [06/12/2007|20:50] C:\DOCUME~1\poi\APPLIC~1\Macromedia
   [12/03/2009|23:20] C:\DOCUME~1\poi\APPLIC~1\Microsoft
   [12/09/2008|02:15] C:\DOCUME~1\poi\APPLIC~1\Mozilla
   [20/02/2008|23:07] C:\DOCUME~1\poi\APPLIC~1\Real
   [18/03/2009|13:26] C:\DOCUME~1\poi\APPLIC~1\Skype
   [18/03/2009|12:10] C:\DOCUME~1\poi\APPLIC~1\skypePM
   [26/11/2008|19:29] C:\DOCUME~1\poi\APPLIC~1\Sonic Foundry
   [06/04/2008|21:42] C:\DOCUME~1\poi\APPLIC~1\Sun
   [13/03/2009|23:52] C:\DOCUME~1\poi\APPLIC~1\vmntoolbar
   [11/04/2008|14:40] C:\DOCUME~1\poi\APPLIC~1\Yahoo!
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [18/03/2009 10:14][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [18/03/2009 13:50][--a------] C:\WINDOWS	asks\V‚rifier les mises … jour de Windows Live Toolbar.job
   [18/03/2009 13:28][--ah-----] C:\WINDOWS	asks\SA.DAT
   [28/09/2001 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [29/09/2008|23:10] C:\Program Files\Adobe
   [16/01/2008|08:42] C:\Program Files\AnswerWorks 4.0
   [07/06/2007|16:58] C:\Program Files\aod
   [18/12/2007|08:35] C:\Program Files\Apple Software Update
   [19/01/2008|18:37] C:\Program Files\art-lantis 4.5
   [30/08/2006|17:15] C:\Program Files\Athan
   [16/01/2008|08:45] C:\Program Files\AutoCAD 2004
   [17/12/2007|09:18] C:\Program Files\Autodesk
   [28/12/2008|22:59] C:\Program Files\Avira
   [04/01/2008|12:23] C:\Program Files\Boole & Partners
   [13/12/2008|19:25] C:\Program Files\CA VMN Anti-Spyware
   [02/03/2009|22:07] C:\Program Files\CA Yahoo! Anti-Spy
   [15/09/2006|20:19] C:\Program Files\Canon
   [02/05/2008|15:42] C:\Program Files\CCleaner
   [30/07/2007|12:36] C:\Program Files\Codec Pack - All In 1
   [30/08/2006|12:03] C:\Program Files\ComPlus Applications
   [02/03/2009|22:07] C:\Program Files\Crawler
   [20/03/2008|19:56] C:\Program Files\Davilex Games
   [20/06/2007|10:50] C:\Program Files\DivX
   [20/05/2008|18:20] C:\Program Files\e-anim
   [28/12/2008|20:35] C:\Program Files\Fichiers communs
   [06/02/2009|22:41] C:\Program Files\Google
   [15/02/2008|13:51] C:\Program Files\Horloge
   [04/01/2008|12:28] C:\Program Files\IKEA HomePlanner
   [20/03/2008|19:55] C:\Program Files\InstallShield Installation Information
   [15/06/2008|17:33] C:\Program Files\Intel
   [29/12/2008|18:27] C:\Program Files\Internet Explorer
   [17/11/2007|19:02] C:\Program Files\IVT Corporation
   [06/04/2008|17:14] C:\Program Files\Java
   [07/03/2009|23:41] C:\Program Files\Kaspersky Lab
   [21/05/2007|09:22] C:\Program Files\Matroska
   [04/09/2008|15:57] C:\Program Files\Messenger
   [13/02/2009|13:35] C:\Program Files\Messenger Plus! Live
   [04/09/2008|15:54] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [30/08/2006|17:03] C:\Program Files\Microsoft Encarta
   [30/08/2006|12:07] C:\Program Files\microsoft frontpage
   [16/01/2008|08:42] C:\Program Files\Microsoft Office
   [30/08/2006|17:11] C:\Program Files\Microsoft Visual Studio
   [28/12/2008|18:56] C:\Program Files\Microsoft Works
   [30/08/2006|17:10] C:\Program Files\Microsoft.NET
   [08/05/2008|19:50] C:\Program Files\MixVibesPro4
   [04/12/2007|21:16] C:\Program Files\Movie Maker
   [18/03/2009|13:48] C:\Program Files\Mozilla Firefox
   [26/05/2007|09:30] C:\Program Files\MSN
   [30/08/2006|12:03] C:\Program Files\MSN Gaming Zone
   [08/06/2008|23:05] C:\Program Files\MSN Messenger
   [01/09/2007|09:17] C:\Program Files\MSXML 4.0
   [30/08/2006|17:22] C:\Program Files\Nero
   [30/08/2006|12:04] C:\Program Files\NetMeeting
   [08/03/2009|19:38] C:\Program Files\Norton AntiVirus
   [30/08/2006|12:03] C:\Program Files\Online Services
   [29/12/2008|17:25] C:\Program Files\Outlook Express
   [11/01/2009|18:14] C:\Program Files\PC Drivers HeadQuarters
   [18/04/2007|21:14] C:\Program Files\PhotoFiltre Studio
   [18/12/2007|08:37] C:\Program Files\QuickTime
   [22/10/2008|18:17] C:\Program Files\Real
   [21/12/2006|18:43] C:\Program Files\Realtek AC97
   [26/11/2007|23:09] C:\Program Files\Registry Mechanic
   [30/08/2006|12:05] C:\Program Files\Services en ligne
   [26/03/2008|17:53] C:\Program Files\Sierra On-Line
   [29/11/2008|21:46] C:\Program Files\Skype
   [21/11/2008|00:17] C:\Program Files\Sonic Foundry
   [21/11/2008|00:15] C:\Program Files\Sonic Foundry Setup
   [28/11/2005|17:43] C:\Program Files\Symantec AntiVirus
   [18/03/2009|13:10] C:\Program Files	rend micro
   [30/08/2006|14:23] C:\Program Files\Uninstall Information
   [07/03/2009|23:22] C:\Program Files\Unlocker
   [30/08/2006|16:40] C:\Program Files\VIA
   [13/12/2008|19:24] C:\Program Files\Visicom Media
   [13/12/2008|19:25] C:\Program Files\vmntoolbar
   [02/05/2008|18:44] C:\Program Files\Winamp
   [08/06/2008|23:05] C:\Program Files\Windows Live
   [14/12/2007|19:05] C:\Program Files\Windows Live Favorites
   [03/05/2008|17:02] C:\Program Files\Windows Live Toolbar
   [29/12/2008|17:29] C:\Program Files\Windows Media Player
   [22/11/2005|00:24] C:\Program Files\Windows NT
   [08/03/2009|19:38] C:\Program Files\Windows Sidebar
   [30/08/2006|12:05] C:\Program Files\WindowsUpdate
   [02/05/2008|21:43] C:\Program Files\WinRAR
   [30/08/2006|12:07] C:\Program Files\xerox
   [11/04/2008|16:42] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [29/09/2008|23:09] C:\Program Files\Fichiers communs\Adobe
   [30/08/2006|17:25] C:\Program Files\Fichiers communs\Ahead
   [16/01/2008|08:42] C:\Program Files\Fichiers communs\Autodesk Shared
   [16/01/2008|08:42] C:\Program Files\Fichiers communs\DESIGNER
   [17/11/2007|19:02] C:\Program Files\Fichiers communs\InstallShield
   [06/04/2008|16:51] C:\Program Files\Fichiers communs\Java
   [16/01/2008|08:44] C:\Program Files\Fichiers communs\Macrovision Shared
   [28/12/2008|18:55] C:\Program Files\Fichiers communs\Microsoft Shared
   [30/08/2006|12:04] C:\Program Files\Fichiers communs\MSSoap
   [30/08/2006|13:52] C:\Program Files\Fichiers communs\ODBC
   [22/10/2008|18:18] C:\Program Files\Fichiers communs\Real
   [07/10/2008|20:01] C:\Program Files\Fichiers communs\Scanner
   [30/08/2006|12:04] C:\Program Files\Fichiers communs\Services
   [29/11/2008|21:45] C:\Program Files\Fichiers communs\Skype
   [30/08/2006|13:52] C:\Program Files\Fichiers communs\SpeechEngines
   [08/03/2009|20:02] C:\Program Files\Fichiers communs\Symantec Shared
   [29/12/2008|17:25] C:\Program Files\Fichiers communs\System
   [27/11/2007|01:07] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [04/01/2008|12:27] C:\Program Files\Fichiers communs\Wise Installation Wizard
   [22/10/2008|18:18] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 29 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-03-18 14:24:28
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 18
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\poi\Mes documents\programmes telecharg‚s+setup\Sound Forge 6\KeyGen
   C:\DOCUME~1\poi\Mes documents\programmes telecharg‚s+setup\Sound Forge 6\KeyGen\KEYGEN.EXE
   C:\DOCUME~1\poi\Mes documents\programmes telecharg‚s+setup\Sound Forge 6\KeyGen\KG.NFO
   C:\DOCUME~1\poi\Mes documents\programmes telecharg‚s+setup\Sound Forge 6\KeyGen\RENEGADE.NFO


   [F:1260][D:146]-> C:\DOCUME~1\poi\LOCALS~1\Temp
   [F:1][D:0]-> C:\DOCUME~1\poi\Cookies
   [F:94][D:4]-> C:\DOCUME~1\poi\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 18/03/2009|13:56 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 18/03/2009|14:25 - Option : [2]

   --------------------\  Fin du rapport a 14:25:53

Destrio5 · Answer

L'auteur d'UsbFix ayant retiré son programme (UsbFix), je prends la responsabilité de te le faire utiliser. Merci aux autres de ne pas utiliser le lien de téléchargement donné.

--> Télécharge UsbFix sur ton Bureau.

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix sur ton Bureau.

--> Choisis l'option 1 (Nettoyage).

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)

biba31 · Answer

j'ai bien suivi ce que vous m'avez dit mais quand le pc a redemarré, un message s'affiche :
windows pas de disque

exception processing message c000.....
 alors j'ai fait annuler

Destrio5 · Answer

Il faut faire Continuer autant de fois qu'il le demande.

biba31 · Answer

-------------- UsbFix V2.414.3 ---------------

* User : poi - ES-1D0DC7C34A5A
* Outils mis a jours le 18/01/2009 par Chiquitine29 et Chimay8
* Recherche effectuée à 16:00:06 le 18/03/2009
* Windows Xp - Internet Explorer 6.0.2900.2180

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\netsh.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

D: - Lecteur fixe

F: - Lecteur amovible

+- Contenu de l'autorun : C:\autorun.inf

+- Contenu de l'autorun : D:\autorun.inf

+- Contenu de l'autorun : F:\autorun.inf

[AutoRun]
;easiM mYSU
sHell\open\DeFault=1
;
open= waklko.pif
;GctkouhcOuqKJrmVs pGKo
ShElL\OpEN\cOMmANd = waklko.pif

;isjKq sxfqWExBsbOPiL woQmsJiDnXiOBjLXLUSTBym
shElL\exPlOre\CoMMand =waklko.pif
;tIjvUtvUwbuq
sHell\AutopLAy\CoMManD =waklko.pif
;jeiWFewLQ ekoBQ aEbmhVqtBfKHCEuX

--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe

+- Listing des fichiers présents :

[30/08/2006 12:07][--a------] C:\AUTOEXEC.BAT
[03/08/2004 22:38][-rahs----] C:\NTDETECT.COM
[07/03/2009 23:28][---hs----] C:\boot.ini
[27/11/2005 20:30][d--------] C:\autorun.inf
[18/03/2009 14:25][--a------] C:\lopR.txt
[18/03/2009 14:25][--a------] C:\UsbFix.txt
[30/08/2006 12:07][--a------] C:\CONFIG.SYS
[30/08/2006 12:07][--a------] C:\hiberfil.sys
[30/08/2006 12:07][--a------] C:\IO.SYS
[30/08/2006 12:07][--a------] C:\MSDOS.SYS
[30/08/2006 12:07][--a------] C:\pagefile.sys

--------------- [ Lecteur D ] ----------------

D: - Lecteur fixe

+- Listing des fichiers présents :

[27/11/2005 20:32][d--------] D:\autorun.inf

--------------- [ Lecteur F ] ----------------

F: - Lecteur amovible

+- Listing des fichiers présents :

[24/02/2009 08:32][-r-hs----] F:\waklko.pif
[31/10/2004 14:27][-rahs----] F:\pslqcm.exe
[31/10/2004 14:27][-rahs----] F:\rger.exe
[31/10/2004 13:00][---------] F:\autorun.inf

--------------- [ Registre / Startup ] ----------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
AVP="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

--------------- [ Registre / Mountpoint2 ] ----------------

-> Recherche négative.

--------------- [ Nettoyage des disques ] ----------------

F:\autorun.inf ~> fichier appelé : "F:\ waklko.pif" ( absent ! )
Echec de la supression !! - [27/11/2005 20:30] C:\autorun.inf
Supprimé ! - [27/11/2005 20:30][d--------] C:\autorun.inf
Echec de la supression !! - [27/11/2005 20:32] D:\autorun.inf
Supprimé ! - [27/11/2005 20:32][d--------] D:\autorun.inf
Echec de la supression !! - [31/10/2004 13:00] F:\autorun.inf
Echec de la supression !! - [31/10/2004 13:00] F:\autorun.inf

--------------- [ Resumé ] ----------------

-> /!\ Le resultat doit etre interprété par un spécialiste /!\

[30/08/2006 12:07][--a------] C:\AUTOEXEC.BAT
[03/08/2004 22:38][-rahs----] C:\NTDETECT.COM
[07/03/2009 23:28][---hs----] C:\boot.ini
[24/02/2009 08:32][-r-hs----] F:\waklko.pif
[31/10/2004 14:27][-rahs----] F:\pslqcm.exe
[31/10/2004 14:27][-rahs----] F:\rger.exe
[31/10/2004 13:00][---------] F:\autorun.inf

--------------- [ Vaccination ] ----------------

C:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
D:\autorun.inf -> Dossier autorun.inf crée par UsbFix !

--------------- ! Fin du rapport ! ----------------

Destrio5 · Answer

Sur ton disque F, il y a ces fichiers :
- F:\waklko.pif
- F:\pslqcm.exe
- F:\rger.exe 

Tu les connais ?

biba31 · Answer

non

biba31 · Answer

ce que je connais que le disque F: qui est mon flash disk est celui qui a infecté l'ordi. c sur car je l'ai branché à unh autre ordi. et je ne peux pas le formater maintenant

biba31 · Answer

le gestionnaire des taches n'est plus verrouillé maintenant

biba31 · Answer

je connais  exactement ce que j'ai mis dans le disque F: , qlq simples traitements et photos, non plus . ces 3 fichiers sont sans doute virus .

Destrio5 · Answer

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Branche ta clé USB.
--> Télécharge ComboFix (de sUBs) sur ton Bureau.
--> Double-clique sur ComboFix.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Il va te demander d'installer la console de récupération : accepte.
--> Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

biba31 · Answer

pour désactiver les protections résidentes suffit-il d'aller au  centre de sécurité et désactiver 'protection antivirus ' et pare feu ? car l'antivirus n'apparait pas dans la barre des taches.

Destrio5 · Answer

Lance ComboFix ;)

biba31 · Answer

oui je vais le lancer mais il est recommandé avant de le lancer de désactiver les protections. ça suffit ou non?

biba31 · Answer

je l'ai lancé mais il m'a dit qu'il a détecté un scanner en temps réel: kaspersky anti-virus. mais je l'ai desinstallé completement!!!!!!!!!!!!!!!!!!!!!!!!!!
j'ai cliqué sur OK alrs un 'warning' apparait et me dit que kaspersky reste actif
et dit : kindly note that this is at your own risk
koi faire??

Destrio5 · Answer

Accepte.

biba31 · Answer

g accepté .. il arrive aux étapes.A la 50eme etape, l'ordi redemarre directement.
le gestionnaire des taches est maintenant désactivé.
il n'y a aucun nouvel affichage
koi faire?

Destrio5 · Answer

Regarde si tu as un fichier texte ComboFix dans C:\

biba31 · Answer

g trouvé mais pas dans C:
je l'ai trouvé dans C:/ComboFix/
il dit a la fin:

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

Destrio5 · Answer

Refais la manipulation avec UsbFix.

biba31 · Answer

voilà  ce qu'il y a dans ce fichier: 



ComboFix 09-03-15.01 - poi 2009-03-18 21:35:56.1 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1256.216.1036.18.223.52 [GMT 1:00]
Running from: C:\Documents and Settings\poi\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated)
AV: Kaspersky Anti-Virus *On-access scanning enabled* (Outdated)
 * Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

biba31 · Answer

g trouvé un fichier stub.log dans C:
as-t-il relation?

Destrio5 · Answer

http://www.commentcamarche.net/forum/affich 11588021 virus?page=2#27

biba31 · Answer

c'est fait. le rapport : -------------- UsbFix V2.414.3 --------------- * User : poi - ES-1D0DC7C34A5A * Outils mis a jours le 18/01/2009 par Chiquitine29 et Chimay8 * Recherche effectuée à 22:29:04 le 2009-03-18 * Windows Xp - Internet Explorer 6.0.2900.2180 --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\cisvc.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\Explorer.EXE --------------- [ Informations lecteurs ] ---------------- C: - Lecteur fixe D: - Lecteur fixe F: - Lecteur amovible +- Contenu de l'autorun : C:\autorun.inf +- Contenu de l'autorun : D:\autorun.inf +- Contenu de l'autorun : F:\autorun.inf [AutoRun] ;easiM mYSU sHell\open\DeFault=1 ; open= waklko.pif ;GctkouhcOuqKJrmVs pGKo ShElL\OpEN\cOMmANd = waklko.pif ;isjKq sxfqWExBsbOPiL woQmsJiDnXiOBjLXLUSTBym shElL\exPlOre\CoMMand =waklko.pif ;tIjvUtvUwbuq sHell\AutopLAy\CoMManD =waklko.pif ;jeiWFewLQ ekoBQ aEbmhVqtBfKHCEuX --------------- [ Lecteur C ] ---------------- C: - Lecteur fixe +- Listing des fichiers présents : [2006-08-30 12:07][--a------] C:\AUTOEXEC.BAT [2004-08-03 22:38][-rahs----] C:\NTDETECT.COM [2009-03-07 23:28][---hs----] C:\boot.ini [2009-03-18 16:03][d--h-----] C:\autorun.inf [2009-03-18 14:25][--a------] C:\lopR.txt [2009-03-18 14:25][--a------] C:\UsbFix.txt [2006-08-30 12:07][--a------] C:\CONFIG.SYS [2006-08-30 12:07][--a------] C:\hiberfil.sys [2006-08-30 12:07][--a------] C:\IO.SYS [2006-08-30 12:07][--a------] C:\MSDOS.SYS [2006-08-30 12:07][--a------] C:\pagefile.sys --------------- [ Lecteur D ] ---------------- D: - Lecteur fixe +- Listing des fichiers présents : [2009-03-18 16:03][d--h-----] D:\autorun.inf --------------- [ Lecteur F ] ---------------- F: - Lecteur amovible +- Listing des fichiers présents : [2009-03-18 21:48][--a------] F:\waklko.pif [2004-10-31 14:27][-rahs----] F:\pslqcm.exe [2004-10-31 14:27][-rahs----] F: ger.exe [2004-10-31 13:00][---------] F:\autorun.inf --------------- [ Registre / Startup ] ---------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\WINDOWS\system32\userinit.exe," [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot KernelFaultCheck=%systemroot%\system32\dumprep 0 -k HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= Installed=1 NoChange=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = --------------- [ Registre / Mountpoint2 ] ---------------- -> Recherche négative. --------------- [ Nettoyage des disques ] ---------------- F:\autorun.inf ~> fichier appelé : "F:\ waklko.pif" ( absent ! ) Echec de la supression !! - [2009-03-18 22:29] C:\autorun.inf Supprimé ! - [2009-03-18 22:29][d--------] C:\autorun.inf Echec de la supression !! - [2009-03-18 22:29] D:\autorun.inf Supprimé ! - [2009-03-18 22:29][d--------] D:\autorun.inf Echec de la supression !! - [2004-10-31 13:00] F:\autorun.inf Echec de la supression !! - [2004-10-31 13:00] F:\autorun.inf --------------- [ Resumé ] ---------------- -> /!\ Le resultat doit etre interprété par un spécialiste /!\ [2006-08-30 12:07][--a------] C:\AUTOEXEC.BAT [2004-08-03 22:38][-rahs----] C:\NTDETECT.COM [2009-03-07 23:28][---hs----] C:\boot.ini [2009-03-18 21:48][--a------] F:\waklko.pif [2004-10-31 14:27][-rahs----] F:\pslqcm.exe [2004-10-31 14:27][-rahs----] F: ger.exe [2004-10-31 13:00][---------] F:\autorun.inf --------------- [ Vaccination ] ---------------- C:\autorun.inf -> Dossier autorun.inf crée par UsbFix ! D:\autorun.inf -> Dossier autorun.inf crée par UsbFix ! --------------- ! Fin du rapport ! ----------------

Destrio5 · Answer

---> Désinstalle Crawler Toolbar with Web Security Guard et VMN Toolbar.

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau.

---> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:files 
F:\waklko.pif 
F:\pslqcm.exe 
F:ger.exe 
F:\semo2x.exe 
F:\etcs.exe  
C:\Documents and Settings\poi\Application Data\vmntoolbar  
C:\PROGRA~1\Crawler

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Play Dead] 
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kamsoft] 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]   
"F:\waklko.pif"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winyialx.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winusng.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\fyban.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winlbuye.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winlgjpd.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Tempdejd.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\wincycu.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winmwut.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp
cogg.exe"=-
"F:\etcs.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\jtwv.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winryex.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\gwwvsq.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winnbrq.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winnsfys.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winnlkk.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\qbykq.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\yeijv.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\kreo.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\windvsmoh.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\acjswg.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winirfraj.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winjewdl.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winxcbfjp.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\jdbu.exe"=-
"C:\DOCUME~1\poi\LOCALS~1\Temp\winkdlvi.exe"=-
"C:\WINDOWS\TEMP\winbjdva.exe"=-   
"C:\WINDOWS\TEMP\winvrya.exe"=-
"C:\WINDOWS\TEMP\shed.exe"=-  
"C:\WINDOWS\TEMP\winacvp.exe"=-
"C:\WINDOWS\TEMP\winjuti.exe"=-
"C:\WINDOWS\TEMP\winnjlc.exe"=-
"C:\WINDOWS\TEMP\hxjahn.exe"=-  
"C:\WINDOWS\TEMP\winkwhywy.exe"=-
"C:\WINDOWS\TEMP\kbipm.exe"=-
"C:\WINDOWS\TEMP\vctyr.exe"=-
"C:\WINDOWS\TEMP\winpkil.exe"=-
"C:\WINDOWS\TEMP\eslda.exe"=-
"C:\WINDOWS\TEMP\winiwukk.exe"=-     
"C:\WINDOWS\TEMP\winsnnn.exe"=-
"C:\WINDOWS\TEMP\eufoaw.exe"=-
"C:\WINDOWS\TEMP
clpxp.exe"=-
"C:\WINDOWS\TEMP\winfbhgiq.exe"=-
"C:\WINDOWS\TEMP\winsiuc.exe"=-
"C:\WINDOWS\TEMP\afhl.exe"=-    
"C:\WINDOWS\TEMP\lajgsn.exe"=-
"C:\WINDOWS\TEMP\winplkggt.exe"=-   
"C:\WINDOWS\TEMP\winwrmxww.exe"=-    
"C:\WINDOWS\TEMP\irpns.exe"=-  
"C:\WINDOWS\TEMP\ykno.exe"=-

:commands
[purity]
[emptytemp]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

biba31 · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
F:\waklko.pif moved successfully.
F:\pslqcm.exe moved successfully.
F:ger.exe moved successfully.
File/Folder F:\semo2x.exe not found.
File/Folder F:\etcs.exe not found.
File/Folder C:\Documents and Settings\poi\Application Data\vmntoolbar not found.
File/Folder C:\PROGRA~1\Crawler not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Play Dead\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kamsoft\ not found.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\F:\waklko.pif deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winyialx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winusng.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\fyban.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winlbuye.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winlgjpd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Tempdejd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\wincycu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winmwut.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp
cogg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\F:\etcs.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\jtwv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winryex.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\gwwvsq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winnbrq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winnsfys.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winnlkk.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\qbykq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\yeijv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\kreo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\windvsmoh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\acjswg.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winirfraj.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winjewdl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winxcbfjp.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\jdbu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\DOCUME~1\poi\LOCALS~1\Temp\winkdlvi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winbjdva.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winvrya.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\shed.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winacvp.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winjuti.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winnjlc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\hxjahn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winkwhywy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\kbipm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\vctyr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winpkil.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\eslda.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winiwukk.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winsnnn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\eufoaw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP
clpxp.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winfbhgiq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winsiuc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\afhl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\lajgsn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winplkggt.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\winwrmxww.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\irpns.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\TEMP\ykno.exe deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\poi\LOCALS~1\Temp\etilqs_XMp8jvqvNpyxD56h3Fx0 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp
wpuq.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\piwf.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\winxlnvy.exe scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03192009_182842

Destrio5 · Answer

---> Refais un scan RSIT et poste le rapport log.

biba31 · Answer

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\TEMP
wpuq.exe
C:\WINDOWS\TEMP\winxlnvy.exe
C:\WINDOWS\TEMP\piwf.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\poi\Bureau\RSIT.exe
C:\Program Files	rend micro\poi.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.imesh.com/sidebar.html?src=ssb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60429
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60429
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {147D6308-0614-4112-89B1-31402F9B82C4} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\RunOnce: [OTMoveIt] C:\Documents and Settings\poi\Bureau\OTMoveIt3.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?4da68c61d46244d8959fccf8ff8804ea
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?4da68c61d46244d8959fccf8ff8804ea
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE

Destrio5 · Answer

Lance ComboFix mais en mode sans échec.

---> Pour redémarrer en mode sans échec : 
- Redémarre ton PC. 
- Au démarrage, tapote sur F8 (F5 sur certains PC) juste après l'affichage du BIOS et juste avant le chargement de Windows. 
- Dans le menu d'options avancées, choisis Mode sans échec. 
- Choisis ta session.

biba31 · Answer

c'est comme l'autre fois pour Combofix. l'ordi redémarre. et on me demande pas sur la console de récupération . et il pose le message qu'il a détecté un antivirus bien qu'il soit déjà désinstallé.
aucun rapport dans C:
dans C:/combofix/combofix.txt
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
	/wow section - STAGE 6
Accès refusé.

Destrio5 · Answer

--> Télécharge Catchme (de Przemyslaw Gmerek) sur ton Bureau. 
--> Double-clique sur catchme.exe (le .exe n'est pas forcément visible) afin de le lancer.
--> Lorsque la recherche sera terminée, poste le rapport catchme.log dans ta prochaine réponse. (Ce rapport est sur ton Bureau.)

biba31 · Answer

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcirt.dll 57344 bytes
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll 344064 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2

Destrio5 · Answer

---> Télécharge SDFix (créé par AndyManchesta) sur ton Bureau.
- Double-clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. 
- Redémarre ton ordinateur en mode sans échec.

---> Pour redémarrer en mode sans échec :
- Redémarre ton PC.
- Au démarrage, tapote sur F8 (F5 sur certains PC) juste après l'affichage du BIOS et juste avant le chargement de Windows.
- Dans le menu d'options avancées, choisis Mode sans échec.
- Choisis ta session.

---> Déroule la liste des instructions ci-dessous :
- Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double-clique sur RunThis.bat pour lancer le script.
- Appuie sur Y pour commencer le processus de nettoyage.
- Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
- Appuie sur une touche pour redémarrer le PC.
- Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
- Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
- Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
- Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
- Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse.

biba31 · Answer

quand je téleécharge SDfix un message apparait :


C:\Documents and Settings\...\Bureau\SDFix.exe.part ne pourra être enregistré car le fichier source ne peut être lu.

Réessayez plus tard ou contactez l'administrateur du serveur

et le téléchargement echoue
koi faire?

Destrio5 · Answer

Tu es essayé de le télécharger avec Firefox ?

biba31 · Answer

oui avec firefox

Destrio5 · Answer

Et avec Internet Explorer ?

biba31 · Answer

je viens d'essayer avec internet explorer . presque il va finir le téléchargement et ce message apparait:
 internet explorer ne peut pas télécharger SDfix de  downloads.andymanchesta.com
la connexion avec le serveur a été réinitialisée

Destrio5 · Answer

http://destrio5.free.fr/Telechargement_CCM/SDFix.exe

biba31 · Answer

eh ben!!!
un autre problème!!!!
je ne peux pas être en mode sans échec!
quand je tape F8 et puis je choisis mode sans échec puis le système d'exploitation, l'ordinateur reboot, redémarre une autre fois. j'ai essayé plusieurs fois mais en vain..
:(
quoi faire!!!

Destrio5 · Answer

Essaie de réparer le mode sans échec :
https://download.bleepingcomputer.com/sUBs/SafeBootKeyRepair.exe

biba31 · Answer

Reg export of SafeBoot key after repair:
========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot]
"AlternateShell"="cmd.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\procexp90.Sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AFD]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\AppMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Base]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Boot file system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Browser]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\CryptSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DcomLaunch]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Dhcp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmadmin]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmboot.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmio.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmload.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\dmserver]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\DnsCache]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\EventLog]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\HelpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ip6fw.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\ipnat.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanServer]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LanmanWorkstation]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\LmHosts]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Messenger]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NDIS Wrapper]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Ndisuio]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOS]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBIOSGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetBT]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetDDEGroup]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Netlogon]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetMan]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Network]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NetworkProvider]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\NtLmSsp]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PCI Configuration]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PlugPlay]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP Filter]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PNP_TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Primary disk]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\procexp90.Sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Networkdpcdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Networkdpdd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Networkdpwd.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Networkdsessmgr]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\RpcSs]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SCSI Class]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sermouse.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SharedAccess]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\SRService]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Streams Drivers]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\System Bus Extender]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\Tcpip]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\TDI]
@="Driver Group"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network	dpipe.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network	dtcp.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network	ermservice]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vga.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WinMgmt]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\WZCSVC]
@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
@="Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
@="CD-ROM Drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
@="Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
@="Net"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
@="NetClient"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
@="NetService"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
@="NetTrans"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
@="PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
@="SCSIAdapter"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
@="Floppy disk drive"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
@="Human Interface Devices"

========================

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\procexp90.Sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\PSEXESVC

Destrio5 · Answer

Retente le mode sans échec.

Destrio5 · Answer

---> Refais un scan RSIT et poste le rapport log.

biba31 · Answer

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\DOCUME~1\poi\LOCALS~1\Temp\qhyvj.exe
C:\DOCUME~1\poi\LOCALS~1\Temp\winajldbi.exe
C:\DOCUME~1\poi\LOCALS~1\Temp\oebgt.exe
C:\Documents and Settings\poi\Bureau\RSIT.exe
C:\Program Files	rend micro\poi.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.imesh.com/sidebar.html?src=ssb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60429
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60429
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {147D6308-0614-4112-89B1-31402F9B82C4} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'Default user')
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?4da68c61d46244d8959fccf8ff8804ea
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?4da68c61d46244d8959fccf8ff8804ea
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: PsExec (PSEXESVC) - Sysinternals - C:\WINDOWS\PSEXESVC.EXE

Destrio5 · Answer

1/

---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport. 
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

2/

&#9679; Télécharge ATF Cleaner sur ton Bureau.
&#9679; Double-clique sur le programme.
&#9679; Coche Select All et clique sur le bouton Empty Selected.

Si tu utilises le navigateur Firefox :
&#9679; Clique Firefox en haut et coche : Select All.
&#9679; Clique sur Empty Selected.
NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

Si tu utilises le navigateur Opera :
&#9679; Clique Opera en haut et coche : Select All.
&#9679; Clique sur Empty Selected.
NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

&#9679; Clique sur Exit du menu prinicipal pour fermer le programme.

biba31 · Answer

[ Rapport ToolsCleaner version 2.3.4 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\lopR.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\SDFIX: trouvé !
C:\Combofix: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Rsit: trouvé !
C:\ComboFix\Combofix.txt: trouvé !
C:\Documents and Settings\poi\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\poi\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\poi\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\poi\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\poi\Bureau\UsbFix.lnk: trouvé !
C:\Documents and Settings\poi\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\poi\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\poi\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\poi\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Program Files\UsbFix: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\poi\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\poi\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\poi\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Program Files	rend micro\HijackThis.exe: supprimé !
C:\lopR.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\ComboFix\Combofix.txt: supprimé !
C:\Documents and Settings\poi\Bureau\UsbFix.exe: supprimé !
C:\Documents and Settings\poi\Bureau\UsbFix.lnk: supprimé !
C:\Documents and Settings\poi\Bureau\OTMoveIt3.exe: supprimé !
C:\Documents and Settings\poi\Bureau\Rsit.exe: supprimé !
C:\Documents and Settings\poi\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Program Files	rend micro\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\Combofix: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\poi\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Program Files\UsbFix: supprimé !

biba31 · Answer

ça y est avec ATF cleaner!!
et puis?

Utilisateur anonyme · Answer

Hello BiBa, Pour avancer mon ami Destrio5 qui doit encore ronfler (:D) fais ceci stp : J'ai un doute sur deux fichiers... > Rends toi sur le site Virus Total : https://www.virustotal.com/gui/ et fais analyser le fichier suivant : (Clique sur puis copie/colle la ligne dans le cadre "Nom du Fichier", ensuite valide par . Clique alors sur ) C:\WINDOWS\Installer\{ABEB838C-A1A7-4C5D-B7E1-8B4314600207}\MsblIco.Exe et poste le résultat par copier/coller (ou le lien http, c'est plus rapide et préférable). - Si Virus total te dit que le fichier a déjà été analysé alors demande une nouvelle analyse. - Refais la même chose avec : C:\WINDOWS\ppdrv.ini N.B. : Les fichiers doivent être analysés un par un. Ouvrir plusieurs fenêtres sur Virus Total peut bloquer les envois. Pour finir poste un nouveau RSIT stp. Merci :)

biba31 · Answer

probleme de chargement de  virustotal.com

biba31 · Answer

oui
le chargement de la page prend beaucoup de temps et enfin rien n'apparait !!

Utilisateur anonyme · Answer

Hummm. 

Ok,
peux-tu poster un nouveau RSIT stp ?
On va voir déjà l'effet qu'a eut ATFcleaner.

Merci.

biba31 · Answer

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\TEMP\wridxn.exe
C:\WINDOWS\TEMP\winvvhbx.exe
C:\WINDOWS\TEMP\winqrjmhu.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Documents and Settings\poi\Bureau\RSIT.exe
C:\Program Files	rend micro\poi.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.imesh.com/sidebar.html?src=ssb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60429
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60429
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {147D6308-0614-4112-89B1-31402F9B82C4} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'Default user')
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?4da68c61d46244d8959fccf8ff8804ea
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?4da68c61d46244d8959fccf8ff8804ea
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE
O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: PsExec (PSEXESVC) - Sysinternals - C:\WINDOWS\PSEXESVC.EXE

Destrio5 · Answer

Tu as la version payante d'Antivir, elle fait parefeu ?

Utilisateur anonyme · Answer

Après avoir répondu à la question de Destrio fais ceci stp :

> Télécharge sur ton bureau OAD (Outil d'Aide au Diagnostic) de !aur3n7 : 
- Clique sur OAD.exe, tape le nom du fichier suivant, puis tape sur la touche <Entrée>.

qhyvj.exe

- Dans la fenêtre suivante choisis l'option 6 puis valide. Le scan va débuter puis le rapport de recherche s'affichera automatiquement dès qu'il aura terminé.
- Fais un copier/coller de ce rapport dans ton prochain poste.
Note : Certains Antivirus (comme Panda) peuvent émettre une alerte lors du téléchargement ou de l'utilisation. Il faut alors ignorer l'alerte ou désactiver l'antivirus le temps de la recherche.
- Effectue les mêmes recherches avec :

winajldbi.exe
et
oebgt.exe 


- Puis poste les résultats.


Elle est vraiment étrange ton infection.

biba31 · Answer

2009-04-10 ---- 16:34:19.10  

----------------------------------
§§§§§§ [qhyvj.exe] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

biba31 · Answer

2009-04-10 ---- 16:44:26.64  

----------------------------------
§§§§§§ [winajldbi.exe] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

biba31 · Answer

2009-04-10 ---- 16:48:53.67  

----------------------------------
§§§§§§ [oebgt.exe ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

biba31 · Answer

alors, quoi faire???!!

Utilisateur anonyme · Answer

Hummm...

Fais ceci stp :
> Télécharge MalwareByte's Anti-Malware : 
- Installe le programme puis lance le.
NB : S'il te manque COMCTL32.OCX alors télécharge le ici 
- Fais les mises à jour (clique sur "Mises à jour" puis "Recherche de mises à jour").
- Clique sur "Executer un examen rapide" puis "Rechercher" et sélectionne tous tes disques durs => le scan débute....patiente...
- A la fin du scanne, clique sur "supprimer" (Si des éléments sont difficiles à supprimer, un message te demandera de redémarrer : clique sur <Oui> alors)
- après suppression des infections : un rapport va être généré : sauvegarde le et poste le sur forum.
NB : Si tu as besoin : Tuto


Après,
>Télécharge et installe Ccleaner (logiciel à conserver et à utiliser régulièrement) : https://www.commentcamarche.net/telecharger/utilitaires/5647-ccleaner/ , si besoin est tu trouveras des Tutoriaux ici, ici et là.
(N'installe pas la Yahoo Toolbar)
> Démarre en mode sans échec : (image). Si problème : tuto ici
>Lance Ccleaner,,
- Choisi l’onglet "Options" puis clique sur "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures" (tout doit être supprimé).
- Dans l'onglet "Nettoyeur" clique sur "Analyse".
- Une fois l'analyse terminée, clique sur "Lancer le Nettoyage".
- Recommence jusqu’à ce qu’il ne trouve plus rien (cela varie en général entre 1 et 4 fois).
- Dans l'onglet "registre" => Recherches des erreurs => Réparer les erreurs sélectionnées => enregistre une sauvegarde => corriger toutes erreurs sélectionnées => ok => fermer.
N.B : Si Ccleaner te propose d'enregistrer une sauvegarde, reponds oui et enregistre sous 'Bureau'
- Recommence jusqu’à ce qu’il ne trouve plus rien (cela varie en général entre 1 et 4 fois).


Ces logiciels sont à conserver.

biba31 · Answer

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 1962
Windows 5.1.2600 Service Pack 2

2009-04-10 18:08:44
mbam-log-2009-04-10 (18-08-21).txt

Type de recherche: Examen rapide
Eléments examinés: 76456
Temps écoulé: 7 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Utilisateur anonyme · Answer

Re, Elément(s) de données du Registre infecté(s): HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken. As-tu bien supprimer les éléments infectés? Si tu ne la pas fait alors refais un scan et supprime les éléments découverts. Si oui ton pare feu et ton antivirus remarchent-ils ? Bon, alors fais cette manip sans redémarrer entre ATFCleaner et Combofix stp : > Télécharge ATF Cleaner par Atribune sur ton bureau. - Démarre ATF-Cleaner et coche la dernière case nommé 'select all'. - Clique sur et au message "Done Cleaning" sur NB : Si tu utilises Firefox ou Opera : - Clique sur Firefox ou Opera en haut puis choisis

biba31 · Answer

Running from: c:\documents and settings\*****\Bureau\ComboFix.exe AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Outdated) AV: Kaspersky Anti-Virus *On-access scanning enabled* (Outdated) * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2009-03-11 to 2009-04-11 ))))))))))))))))))))))))))))))) . 2009-04-11 19:49 . 2009-04-11 19:49 d-------- C:\32788R22FWJFW 2009-04-11 19:06 . 2009-04-11 19:06 d-------- c:\windows\system32\fr-fr 2009-04-10 21:08 . 2009-04-10 21:08 54,156 --ah----- c:\windows\QTFont.qfn 2009-04-10 21:08 . 2009-04-10 21:08 1,409 --a------ c:\windows\QTFont.for 2009-04-10 17:50 . 2009-04-10 17:50 d-------- c:\documents and settings\poi\Application Data\Malwarebytes 2009-04-10 17:49 . 2009-04-10 18:08 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-04-10 17:49 . 2009-04-10 17:49 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-04-10 17:49 . 2009-04-06 15:32 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-10 17:49 . 2009-04-06 15:32 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-04-10 15:12 . 2009-04-10 15:14 d-------- C:\rsit 2009-04-08 23:55 . 2009-04-11 19:05 1,374 --a------ c:\windows\imsins.BAK 2009-04-02 19:49 . 2005-05-17 14:24 311,296 --a------ c:\windows\system32\AegisI5.exe 2009-04-02 19:49 . 2006-01-18 08:08 290,918 --a------ c:\windows\system32\Install7x.dll 2009-04-02 19:49 . 2006-01-12 18:46 252,928 --a------ c:\windows\system32\drivers\rt73.sys 2009-04-02 19:49 . 2005-10-17 18:50 245,376 --a------ c:\windows\system32\drivers\rt2500usb.SYS 2009-04-02 19:49 . 2009-04-02 19:49 20,747 --a------ c:\windows\system32\drivers\AegisP.sys 2009-04-02 19:49 . 2005-11-30 10:33 2,048 --a------ c:\windows\system32\drivers\rt73.bin 2009-04-02 19:49 . 2005-08-19 14:51 138 --a------ c:\windows\filespec7x 2009-04-02 19:44 . 2009-04-02 19:48 d-------- c:\program files\RALINK 2009-03-18 13:07 . 2009-04-10 15:14 d-------- c:\program files\trend micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-10 20:33 --------- d-----w c:\documents and settings\poi\Application Data\Skype 2009-04-10 15:03 --------- d-----w c:\documents and settings\poi\Application Data\skypePM 2009-04-02 18:48 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-25 16:30 --------- d-----w c:\program files\Messenger Plus! Live 2009-03-18 16:02 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab 2009-03-12 20:08 --------- d-----w c:\documents and settings\poi\Application Data\Desktopicon 2009-03-12 20:04 --------- d-----w c:\documents and settings\poi\Application Data\Ahead 2009-03-08 19:02 --------- d-----w c:\program files\Fichiers communs\Symantec Shared 2009-03-08 18:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-03-08 18:55 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF 2009-03-08 18:55 10,563 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT 2009-03-08 18:38 --------- d-----w c:\program files\Windows Sidebar 2009-03-08 18:38 --------- d-----w c:\program files\Norton AntiVirus 2009-03-07 22:41 --------- d-----w c:\program files\Kaspersky Lab 2009-03-07 22:22 --------- d-----w c:\program files\Unlocker 2009-03-07 18:54 --------- d-----w c:\documents and settings\poi\Application Data\CoSoSys 2009-03-02 21:07 --------- d-----w c:\program files\CA Yahoo! Anti-Spy 2009-02-20 21:12 --------- d-----w c:\documents and settings\All Users\Application Data\SSScanAppDataDir 2009-02-19 06:04 --------- d-----w c:\documents and settings\All Users\Application Data\MSScanAppDataDir 2009-02-13 22:24 --------- d-----w c:\documents and settings\poi\Application Data\LimeWire 2007-12-18 12:17 630 ----a-w c:\program files\Art-lantis 4.5.lnk 2004-08-03 23:54 384 --sh--r c:\windows\inf\sdatabl.sav.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-10-22 259600] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nLite"="c:\windows\inf\nlite.cmd" [2004-08-25 385] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-19 44544] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2009-04-02 667648] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"= 1 (0x1) "DisableRegistryTools"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0/usprestrt\[u]0/usprestrt\[u]0/usprestrt [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk] path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk] path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^poi^Menu Démarrer^Programmes^Démarrage^RocketDock.lnk] path=c:\documents and settings\poi\Menu Démarrer\Programmes\Démarrage\RocketDock.lnk backup=c:\windows\pss\RocketDock.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] c:\windows\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 21:16 113520 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt] --a------ 2008-06-12 13:28 266497 c:\program files\Avira\AntiVir PersonalEdition Premium\avgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-04-21 16:03 167936 c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 00:54 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06FDXRC_103937] --a------ 2005-06-04 17:03 371408 c:\program files\Microsoft Encarta\Collection Microsoft Encarta 2006\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06FDXRC_1687046] --a------ 2005-06-04 17:03 371408 c:\program files\Microsoft Encarta\Collection Microsoft Encarta 2006\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06FDXRC_373953] --a------ 2005-06-04 17:03 371408 c:\program files\Microsoft Encarta\Collection Microsoft Encarta 2006\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06FDXRC_471453] --a------ 2005-06-04 17:03 371408 c:\program files\Microsoft Encarta\Collection Microsoft Encarta 2006\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E06FDXRC_620234] --a------ 2005-06-04 17:03 371408 c:\program files\Microsoft Encarta\Collection Microsoft Encarta 2006\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox] --a------ 2004-01-14 13:10 589824 c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hppwrsav] --a------ 1999-06-07 12:27 105472 c:\scanjet\PrecisionScanLT\hppwrsav.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 17:24 1767936 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-06-29 06:24 364544 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool] --a------ 2005-06-20 18:53 1056768 c:\program files\VIA\RAID\raid_tool.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] --a------ 2008-11-07 14:31 22042920 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-02-22 03:25 214416 c:\program files\Java\jre1.6.0_05\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-10-22 18:17 259600 c:\program files\Fichiers communs\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] --a------ 2008-05-02 05:15 85504 c:\program files\Unlocker\UnlockerAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-02-13 19:29 113152 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2008-05-03 17:12 4744432 c:\program files\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE] -ra------ 2004-01-30 01:33 180224 c:\windows\system32\pctspk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2005-10-04 14:12 90112 c:\windows\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer] --a------ 2005-03-08 03:33 53248 c:\windows\system32\VTTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 "UacDisableNotify"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"= "c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\MSN Messenger\msnmsgr.exe"= "c:\Program Files\MSN Messenger\livecall.exe"= "c:\Program Files\art-lantis 4.5\Art-lantis.exe"= "c:\WINDOWS\system32\rtcshare.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.321\French\setup.exe"= "c:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"= "c:\Program Files\Yahoo!\Messenger\YServer.exe"= "c:\Program Files\Real\RealPlayer\realplay.exe"= "c:\SCANJET\PrecisionScanLT\hppwrsav.exe"= "c:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe"= "c:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"= "c:\Program Files\Avira\AntiVir PersonalEdition Premium\avscan.exe"= "c:\Program Files\Unlocker\Unlocker.exe"= "c:\Program Files\MSN Messenger\usnsvc.exe"= "c:\Program Files\Real\RealPlayer\RecordingManager.exe"= "c:\Program Files\Skype\Phone\Skype.exe"= R2 PPSCAN;PPSCAN;c:\windows\system32\drivers\ppscan.sys [2009-01-11 91520] R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\fijkog.sys --> c:\windows\system32\drivers\fijkog.sys [?] S3 es1969;Pilote audio ESS Solo (WDM);c:\windows\system32\drivers\es1969.sys [2005-11-28 72192] S3 scsiscan;Pilote de scanneur SCSI;c:\windows\system32\drivers\scsiscan.sys [2009-01-11 10880] S3 wdm_au8830;Pilote audio Aureal Vortex 8830 (WDM);c:\windows\system32\drivers\adm8830.sys [2006-08-31 747392] --- Other Services/Drivers In Memory --- *Deregistered* - AntiVirScheduler *Deregistered* - AudioSrv *Deregistered* - BITS *Deregistered* - BlueSoleil Hid Service *Deregistered* - Browser *Deregistered* - C-DillaCdaC11BA *Deregistered* - CryptSvc *Deregistered* - DcomLaunch *Deregistered* - Dhcp *Deregistered* - dmserver *Deregistered* - Dnscache *Deregistered* - ERSvc *Deregistered* - EventSystem *Deregistered* - FastUserSwitchingCompatibility *Deregistered* - helpsvc *Deregistered* - ImapiService *Deregistered* - Irmon *Deregistered* - lanmanserver *Deregistered* - lanmanworkstation *Deregistered* - LmHosts *Deregistered* - MDM *Deregistered* - Netman *Deregistered* - Nla *Deregistered* - NWCWorkstation *Deregistered* - PolicyAgent *Deregistered* - ProtectedStorage *Deregistered* - RasMan *Deregistered* - RemoteRegistry *Deregistered* - RpcSs *Deregistered* - SamSs *Deregistered* - Schedule *Deregistered* - seclogon *Deregistered* - SENS *Deregistered* - SharedAccess *Deregistered* - ShellHWDetection *Deregistered* - Spooler *Deregistered* - srservice *Deregistered* - SSDPSRV *Deregistered* - stisvc *Deregistered* - TapiSrv *Deregistered* - TermService *Deregistered* - Themes *Deregistered* - TrkWks *Deregistered* - W32Time *Deregistered* - WebClient *Deregistered* - winmgmt *Deregistered* - wscsvc *Deregistered* - wuauserv *Deregistered* - WZCSVC . Contents of the 'Scheduled Tasks' folder 2009-03-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42] 2009-04-11 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 17:39] . - - - - ORPHANS REMOVED - - - - WebBrowser-{A057A204-BACC-4D26-8287-79A187E26987} - (no file) MSConfigStartUp-Cmaudio - cmicnfg.cpl . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/ IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?4da68c61d46244d8959fccf8ff8804ea IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?4da68c61d46244d8959fccf8ff8804ea LSP: avsda.dll FF - ProfilePath - c:\documents and settings\poi\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\ FF - prefs.js: browser.startup.homepage - google.com FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-11 20:00:55 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1343024091-1708537768-725345543-1006\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\گ•€|ےےےے"•€|ù•رw*] "C040710900063D11C8EF10054038389C"="C?\WINDOWS\system32\FM20ENU.DLL" "C040110900063D11C8EF10054038389C"="C?\WINDOWS\system32\FM20ENU.DLL" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(628) c:\windows\system32\avsda.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Avira\AntiVir PersonalEdition Premium\sched.exe c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe c:\windows\system32\drivers\CDAC11BA.EXE c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE . ************************************************************************** . Completion time: 2009-04-11 20:06:40 - machine was rebooted [poi] ComboFix-quarantined-files.txt 2009-04-11 19:06:35 Pre-Run: 18,370,330,624 octets libres Post-Run: 18,250,993,664 octets libres 300 --- E O F --- 2009-04-11 18:07:35

biba31 · Answer

mes amis, quoi faire maintenant? le PC est devenu très très très lent.tellement je ne peux pas travailler avec .  je commence à perdre l'espoir
:(

Destrio5 · Answer

On te donne des nouvelles dès que possible.

Destrio5 · Answer

--> Télécharge OTScanIt2.exe sur ton Bureau, et fais un double-clic dessus pour extraire les fichiers. Cela va créer un dossier nommé OTScanIt2 sur ton Bureau.

N.B : Si pendant le téléchargement et/ou l’installation tu reçois une alerte de ton antivirus, ignore-la. Certains composants de OTScanIt peuvent être détectés comme un virus par certains antivirus. Pense aussi à désactiver tes protections résidentes durant la procédure.

Note : Tu dois avoir ouvert une session avec un compte ayant les droits Administrateur pour exécuter ce programme.

--> Ferme TOUS LES AUTRES PROGRAMMES et laisse travailler OTScanIt2.
--> Ouvre le dossier OTScanIt2 et fais un double-clic sur OTScanIt2.exe pour lancer le programme (si tu es sous Windows Vista, fais un clic droit sur le programme et choisis Exécuter en tant qu'administrateur).
--> Sous "File Age" en haut, clique sur le menu déroulant et sélectionne "30 Days".
--> Sous Additional Scans, coche les cases situées devant les éléments suivants afin de les sélectionner : Reg - ColumnHandlers, Reg - Desktop Components, Reg - Disabled MS Config Items, Reg - File Associations, Reg - NetSvcs, Reg - Protocol Filters, Reg - Protocol Handlers, Reg - SafeBoot Minimal, Reg - SafeBoot Network, Reg - Session Manager Settings, Reg - Winsock2 Catalogs, File - Lop Check, File - Purity Scan, Files - Signature Check, et Evnt - EventViewer Logs ( Last 10 Errors).
--> Sous "Rootkit Search", sélectionne "Yes".

--> Ne modifie aucun autre paramètre.
--> Ensuite, clique sur le bouton Run Scan dans la barre d'outils. 
--> Laisse le programme tourner sans intervenir.
--> Lorsque l'analyse est terminée le Bloc-notes va s'ouvrir pour afficher le fichier rapport.
--> Clique sur le menu Format et vérifie que Retour automatique à la ligne n'est pas coché. S'il l'est, clique dessus afin de le décocher.
--> Essaie de poster le rapport sur le forum. Si tu ne peux pas, clique sur mon pseudo et tu auras mon adresse mail pour pouvoir me l'envoyer.

Destrio5 · Answer

Ouvre le dossier OTScanIt2 et fais un double-clic sur OTScanIt2.exe pour lancer le programme (si tu es sous Windows Vista, fais un clic-droit sur le programme et choisis Exécuter en tant qu'administrateur). Fais un copier/coller du texte ci-dessous (entre les deux espaces) dans la zone de saisie intitulée "Paste fix here" puis clique sur le bouton Run Fix. [Kill Explorer] [Unregister Dlls] [Processes - Safe List] YY -> asydr.exe -> %SystemRoot%\TEMP\asydr.exe YY -> winlqgjbr.exe -> %SystemRoot%\TEMP\winlqgjbr.exe YY -> winrxklnl.exe -> %SystemRoot%\TEMP\winrxklnl.exe [Registry - Safe List] < BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ YN -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> {7E853D72-626A-48EC-A868-BA8D5E23E045} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> {955BE0B8-BC85-4CAF-856E-8E0D8B610560} [HKLM] -> Reg Error: Value error. [Reg Error: Value error.] YN -> {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} [HKLM] -> Reg Error: Value error. [Reg Error: Value error.] < Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar YN -> "{147D6308-0614-4112-89B1-31402F9B82C4}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] < Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ YN -> ShellBrowser\"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> WebBrowser\"{147D6308-0614-4112-89B1-31402F9B82C4}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> WebBrowser\"{4B3803EA-5230-4DC3-A7FC-33638F3D3542}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] YN -> WebBrowser\"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] < Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ YN -> CmdMapping\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> [Console Java (Sun)] YN -> CmdMapping\"{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}" [HKLM] -> [Reg Error: Key error.] YN -> CmdMapping\"{77BF5300-1474-4EC7-9980-D32B190E9B07}" [HKLM] -> [Reg Error: Key error.] YN -> CmdMapping\"{C461FBFE-C0DE-4757-89DD-A5A833B9AC1F}" [HKLM] -> [Reg Error: Key error.] < Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\dfulp.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\dfulp.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\dfulp.exe:*:Enabled:ipsec] YY -> "C:\DOCUME~1\poi\LOCALS~1\Temp\edjm.exe" -> C:\Documents and Settings\poi\Local Settings emp\edjm.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\edjm.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\gndw.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\gndw.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\gndw.exe:*:Enabled:ipsec] YY -> "C:\DOCUME~1\poi\LOCALS~1\Temp\hlpkmr.exe" -> C:\Documents and Settings\poi\Local Settings emp\hlpkmr.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\hlpkmr.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\mrpadc.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\mrpadc.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\mrpadc.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\qtose.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\qtose.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\qtose.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\smrut.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\smrut.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\smrut.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\umvyw.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\umvyw.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\umvyw.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\vlva.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\vlva.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\vlva.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\vsya.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\vsya.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\vsya.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\windajm.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\windajm.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\windajm.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winfgnln.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winfgnln.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winfgnln.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\wingtyqb.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\wingtyqb.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\wingtyqb.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winlmunmd.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winlmunmd.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winlmunmd.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winnffd.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winnffd.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winnffd.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winngta.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winngta.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winngta.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winofels.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winofels.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winofels.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winogdv.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winogdv.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winogdv.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winpmjeru.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winpmjeru.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winpmjeru.exe:*:Enabled:ipsec] YY -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winpwed.exe" -> C:\Documents and Settings\poi\Local Settings emp\winpwed.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winpwed.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winquunm.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winquunm.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winquunm.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winryssge.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winryssge.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winryssge.exe:*:Enabled:ipsec] YY -> "C:\DOCUME~1\poi\LOCALS~1\Temp\wintepa.exe" -> C:\Documents and Settings\poi\Local Settings emp\wintepa.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\wintepa.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winusai.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winusai.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winusai.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winvcjv.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winvcjv.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winvcjv.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winwbungj.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winwbungj.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winwbungj.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winxbunpk.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winxbunpk.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winxbunpk.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winxqwanf.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winxqwanf.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winxqwanf.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\winypfuxn.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\winypfuxn.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\winypfuxn.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\xdtfbf.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\xdtfbf.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\xdtfbf.exe:*:Enabled:ipsec] YY -> "C:\DOCUME~1\poi\LOCALS~1\Temp\xnbtio.exe" -> C:\Documents and Settings\poi\Local Settings emp\xnbtio.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\xnbtio.exe:*:Enabled:ipsec] YN -> "C:\DOCUME~1\poi\LOCALS~1\Temp\yosqf.exe" -> C:\DOCUME~1\poi\LOCALS~1\Temp\yosqf.exe [C:\DOCUME~1\poi\LOCALS~1\Temp\yosqf.exe:*:Enabled:ipsec] YY -> "C:\WINDOWS\TEMP\asydr.exe" -> C:\WINDOWS\TEMP\asydr.exe [C:\WINDOWS\TEMP\asydr.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\cjobk.exe" -> C:\WINDOWS\TEMP\cjobk.exe [C:\WINDOWS\TEMP\cjobk.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\fnnlca.exe" -> C:\WINDOWS\TEMP\fnnlca.exe [C:\WINDOWS\TEMP\fnnlca.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\hlha.exe" -> C:\WINDOWS\TEMP\hlha.exe [C:\WINDOWS\TEMP\hlha.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\kkfj.exe" -> C:\WINDOWS\TEMP\kkfj.exe [C:\WINDOWS\TEMP\kkfj.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\oejyvn.exe" -> C:\WINDOWS\TEMP\oejyvn.exe [C:\WINDOWS\TEMP\oejyvn.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\pcnba.exe" -> C:\WINDOWS\TEMP\pcnba.exe [C:\WINDOWS\TEMP\pcnba.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\winclkkxo.exe" -> C:\WINDOWS\TEMP\winclkkxo.exe [C:\WINDOWS\TEMP\winclkkxo.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\winhedy.exe" -> C:\WINDOWS\TEMP\winhedy.exe [C:\WINDOWS\TEMP\winhedy.exe:*:Enabled:ipsec] YY -> "C:\WINDOWS\TEMP\winlqgjbr.exe" -> C:\WINDOWS\TEMP\winlqgjbr.exe [C:\WINDOWS\TEMP\winlqgjbr.exe:*:Enabled:ipsec] YY -> "C:\WINDOWS\TEMP\winrxklnl.exe" -> C:\WINDOWS\TEMP\winrxklnl.exe [C:\WINDOWS\TEMP\winrxklnl.exe:*:Enabled:ipsec] YN -> "C:\WINDOWS\TEMP\winuxprk.exe" -> C:\WINDOWS\TEMP\winuxprk.exe [C:\WINDOWS\TEMP\winuxprk.exe:*:Enabled:ipsec] < MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 YN -> \{1638ae09-c067-11dc-88b1-8488c0ac5ecb} -> YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\AUTOplaY\commaNd -> YN -> \{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\AUTOplaY\commaNd\"" -> F:\qmbr.pif [F:\qmbr.pif] YN -> \{1638ae09-c067-11dc-88b1-8488c0ac5ecb} -> YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\AutoRun\command -> YN -> \{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\AutoRun\command\"" -> F:\qmbr.pif [F:\qmbr.pif] YN -> \{1638ae09-c067-11dc-88b1-8488c0ac5ecb} -> YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\exPlorE\CommAND -> YN -> \{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\exPlorE\CommAND\"" -> F:\qmbr.pif [F:\qmbr.pif] YN -> \{1638ae09-c067-11dc-88b1-8488c0ac5ecb} -> YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\oPen\cOMMand -> YN -> \{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\oPen\cOMMand\"" -> F:\qmbr.pif [F:\qmbr.pif] [Files/Folders - Created Within 30 Days] NY -> 1 C:\*.tmp files -> C:\*.tmp NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp NY -> 6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp NY -> ComboFix.exe -> %UserProfile%\Bureau\ComboFix.exe NY -> Qoobox -> %SystemDrive%\Qoobox [Files/Folders - Modified Within 30 Days] NY -> 1 C:\*.tmp files -> C:\*.tmp NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp NY -> 6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp NY -> winrxklnl.exe -> %SystemRoot%\Temp\winrxklnl.exe NY -> asydr.exe -> %SystemRoot%\Temp\asydr.exe NY -> winlqgjbr.exe -> %SystemRoot%\Temp\winlqgjbr.exe NY -> winiptvh.exe -> %UserProfile%\Local Settings emp\winiptvh.exe NY -> imfoqb.exe -> %UserProfile%\Local Settings emp\imfoqb.exe NY -> hlpkmr.exe -> %UserProfile%\Local Settings emp\hlpkmr.exe NY -> winilbn.exe -> %UserProfile%\Local Settings emp\winilbn.exe NY -> winpwed.exe -> %UserProfile%\Local Settings emp\winpwed.exe NY -> vxkuab.exe -> %UserProfile%\Local Settings emp\vxkuab.exe NY -> wintugt.exe -> %UserProfile%\Local Settings emp\wintugt.exe NY -> wintepa.exe -> %UserProfile%\Local Settings emp\wintepa.exe NY -> edjm.exe -> %UserProfile%\Local Settings emp\edjm.exe NY -> xnbtio.exe -> %UserProfile%\Local Settings emp\xnbtio.exe NY -> qmgr0.dat -> %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr0.dat NY -> qmgr1.dat -> %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr1.dat [Purity] [Empty Temp Folders] [Reboot] L'exécution devrait être très rapide. Lorsque la correction est terminée, soit tu verras un message t'annonçant que c'est fini (finished), soit tu seras invité à faire redémarrer le PC pour terminer l'exécution. Si c'est fini, clique sur le bouton Ok et le Bloc-notes va s'ouvrir pour afficher un rapport de toutes les actions réalisées. Envoie-moi ces informations en réponse. Si un redémarrage est nécessaire, clique sur le bouton "Yes" pour faire redémarrer la machine. Après ce redémarrage, OTScanIt2 va finir de déplacer les fichiers qui ne pouvaient pas l'être précédemment, puis le Bloc-notes va s'ouvrir et afficher à ce moment-là les résultats finaux. Envoie-moi ces informations en réponse. Poste-moi le rapport sur le forum.

biba31 · Answer

Process Explorer.EXE killed successfully!
[Processes - Safe List]
No active process named asydr.exe was found!
File C:\WINDOWS\TEMP\asydr.exe not found.
No active process named winlqgjbr.exe was found!
File C:\WINDOWS\TEMP\winlqgjbr.exe not found.
No active process named winrxklnl.exe was found!
File C:\WINDOWS\TEMP\winrxklnl.exe not found.
[Registry - Safe List]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\{147D6308-0614-4112-89B1-31402F9B82C4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{147D6308-0614-4112-89B1-31402F9B82C4}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{147D6308-0614-4112-89B1-31402F9B82C4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{147D6308-0614-4112-89B1-31402F9B82C4}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{77BF5300-1474-4EC7-9980-D32B190E9B07} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{77BF5300-1474-4EC7-9980-D32B190E9B07}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{C461FBFE-C0DE-4757-89DD-A5A833B9AC1F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C461FBFE-C0DE-4757-89DD-A5A833B9AC1F}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\dfulp.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\edjm.exe deleted successfully.
File C:\Documents and Settings\poi\Local Settings	emp\edjm.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\gndw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\hlpkmr.exe deleted successfully.
File C:\Documents and Settings\poi\Local Settings	emp\hlpkmr.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\mrpadc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\qtose.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\smrut.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\umvyw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\vlva.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\vsya.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\windajm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winfgnln.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\wingtyqb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winlmunmd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winnffd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winngta.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winofels.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winogdv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winpmjeru.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winpwed.exe deleted successfully.
File C:\Documents and Settings\poi\Local Settings	emp\winpwed.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winquunm.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winryssge.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\wintepa.exe deleted successfully.
File C:\Documents and Settings\poi\Local Settings	emp\wintepa.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winusai.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winvcjv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winwbungj.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winxbunpk.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winxqwanf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\winypfuxn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\xdtfbf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\xnbtio.exe deleted successfully.
File C:\Documents and Settings\poi\Local Settings	emp\xnbtio.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\poi\LOCALS~1\Temp\yosqf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\asydr.exe deleted successfully.
File C:\WINDOWS\TEMP\asydr.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\cjobk.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\fnnlca.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\hlha.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\kkfj.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\oejyvn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\pcnba.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\winclkkxo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\winhedy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\winlqgjbr.exe deleted successfully.
File C:\WINDOWS\TEMP\winlqgjbr.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\winrxklnl.exe deleted successfully.
File C:\WINDOWS\TEMP\winrxklnl.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\TEMP\winuxprk.exe deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\AUTOplaY\commaNd\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\AUTOplaY\commaNd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\AutoRun\command not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\exPlorE\CommAND\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\exPlorE\CommAND not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\oPen\cOMMand\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}\ShEll\oPen\cOMMand not found.
[Files/Folders - Created Within 30 Days]
C:\Documents and Settings\poi\Bureau\ComboFix.exe moved successfully.
C:\Qoobox\Quarantine\Registry_backups folder moved successfully.
C:\Qoobox\Quarantine\C folder moved successfully.
C:\Qoobox\Quarantine folder moved successfully.
C:\Qoobox\BackEnv folder moved successfully.
C:\Qoobox folder moved successfully.
[Files/Folders - Modified Within 30 Days]
File C:\WINDOWS\Temp\winrxklnl.exe not found!
File C:\WINDOWS\Temp\asydr.exe not found!
File C:\WINDOWS\Temp\winlqgjbr.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\winiptvh.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\imfoqb.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\hlpkmr.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\winilbn.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\winpwed.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\vxkuab.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\wintugt.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\wintepa.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\edjm.exe not found!
File C:\Documents and Settings\poi\Local Settings	emp\xnbtio.exe not found!
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
[Purity]
Purity scan complete.
[Empty Temp Folders]
File delete failed. C:\Documents and Settings\poi\Local Settings	emp\Perflib_Perfdata_65c.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\poi\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\winilofda.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\winpicng.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\winxxgc.exe scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
RecycleBin -> emptied.
< End of fix log >
OTScanIt2 by OldTimer - Version 1.0.14.0 fix logfile created on 04212009_204219

Files moved on Reboot...
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat scheduled to be moved on reboot.
File C:\Documents and Settings\poi\Local Settings	emp\Perflib_Perfdata_65c.dat not found!
File C:\WINDOWS	emp\winilofda.exe not found!
File C:\WINDOWS	emp\winpicng.exe not found!
File C:\WINDOWS	emp\winxxgc.exe not found!

Registry entries deleted on Reboot...

Destrio5 · Answer

Des améliorations ?

biba31 · Answer

le gestionnaire des taches est toujours verrouillé et l'antivirus comme d'habitude, je peux pas l'exécuter
le PC reste comme d'habitude apparemment.

Destrio5 · Answer

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau.

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:services
abp470n5

:files 
C:\WINDOWS\system32\drivers\fijkog.sys 

:commands
[purity]
[emptytemp]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

biba31 · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========

Service\Driver abp470n5 deleted successfully.
========== FILES ==========
File/Folder C:\WINDOWS\system32\drivers\fijkog.sys not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\poi\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\fauyec.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\fugydk.exe scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05032009_144647

Files moved on Reboot...
File C:\DOCUME~1\poi\LOCALS~1\Temp\etilqs_XMp8jvqvNpyxD56h3Fx0 not found!
File C:\WINDOWS	emp
wpuq.exe not found!
File C:\WINDOWS	emp\piwf.exe not found!
File C:\WINDOWS	emp\winxlnvy.exe not found!
File C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\Cache\_CACHE_001_ not found!
File C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\Cache\_CACHE_002_ not found!
File C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\Cache\_CACHE_003_ not found!
File C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\Cache\_CACHE_MAP_ not found!
File C:\Documents and Settings\poi\Local Settings\Application Data\Mozilla\Firefox\Profiles\abxziayz.default\urlclassifier3.sqlite not found!

Destrio5 · Answer

--> Télécharge OTL (de OldTimer) sur ton Bureau.
--> Double-clique sur OTL pour le lancer. Prends le soin de fermer toutes les autres fenêtres Windows afin de ne pas interrompre le scan.
(Sous Vista, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)
--> Une fenêtre apparaît. Dans la section Output en haut de cette fenêtre, coche Minimal Output.
--> Coche également les cases à côté de LOP Check et Purity Check.
--> Dans la zone Extra List, coche Use SafeList si ce n'est pas déjà fait.
--> Enfin, clique sur le bouton Run Scan. Le scan ne prendra pas beaucoup de temps.
--> Une fois l'analyse terminée, deux fenêtres vont s'ouvrir dans le Bloc-notes : OTL.txt et Extras.txt. Ils se trouvent au même endroit que OTL (donc par défaut sur le Bureau).

Pour me transmettre les rapports :
--> Clique sur ce lien : http://www.cijoint.fr/
--> Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
--> Clique sur Ouvrir.
--> Clique sur Cliquez ici pour déposer le fichier.
--> Un lien de cette forme, http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt, est ajouté dans la page.
--> Copie ce lien dans ta réponse.

biba31 · Answer

salut, 

http://www.cijoint.fr/cjlink.php?file=cj200906/cijuA3fy4l.txt
http://www.cijoint.fr/cjlink.php?file=cj200906/cijtw1cLjf.txt

Destrio5 · Answer

1/

---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport. 
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).


2/

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

biba31 · Answer

info.txt logfile of random's system information tool 1.06 2009-06-24 07:07:15

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Nero\Nero 7
ero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Apple Software Update-->MsiExec.exe /I{74EC78BC-B379-4E29-9006-8F161DCAABA6}
Art-lantis 4.5-->C:\WINDOWS\unvise32.exe C:\Program Files\Art-lantis 4.5\Art.uninstal.log
Athan Basic 3.0 -->C:\WINDOWS\iun6002.exe "C:\Program Files\Athan\irunin.ini"
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
AutoCAD 2004-->MsiExec.exe /I{5783F2D7-0201-0409-0002-0060B0CE6BBA}
Autodesk Express Viewer-->C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove
Avira AntiVir Premium-->C:\Program Files\Avira\AntiVir PersonalEdition Premium\setup.exe /REMOVE
Barre d'outils Outlook de Windows Live (Windows Live Toolbar)-->MsiExec.exe /X{4002F73D-EBB3-4EA1-A2FF-DBCB4529759E}
Bloqueur de fenêtres pop-up (Windows Live Toolbar)-->MsiExec.exe /X{51F366F4-C2E4-429A-866A-59C885ED42FD}
BlueSoleil-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B9F499B8-D1F0-42FC-84BE-CC552123CCCB}\Setup.exe" -l0x40c 
CA VMN Anti-Spyware (remove only)-->"C:\Program Files\CA VMN Anti-Spyware\uninstall.exe"
CA Yahoo! Anti-Spy (remove only)-->"C:\Program Files\CA Yahoo! Anti-Spy\uninstall.exe"
Canon PhotoRecord-->MsiExec.exe /X{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}
Canon PIXMA iP1000-->C:\WINDOWS\system32\CNMCP6e.exe "-PRINTERNAMECanon PIXMA iP1000" "-HELPERDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP1000 Installer\Inst2\cnmis.dll" "-RCDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP1000 Installer\Inst2\cnmi0409.dll"
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe C:\Program Files\Canon\Easy-PhotoPrint\uninst.ini
Canon Utilities Easy-PrintToolBox-->C:\WINDOWS\BJPSUNST.EXE
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Codec Pack - All In 1 6.0.3.0-->C:\WINDOWS\iun6002.exe "C:\Program Files\Codec Pack - All In 1\irunin.ini"
Collection Microsoft Encarta 2006-->MsiExec.exe /I{06180000-3E21-46D6-9A91-D927BA08F41D}
Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{175B7C4A-CAF8-437A-B597-73E0D2D970FE}
Dev-C++ 5 beta 9 release (4.9.9.2)-->"C:\Dev-Cpp\uninstall.exe"
Direct Show Ogg Vorbis Filter (remove only)-->"C:\WINDOWS\system32\OggDSuninst.exe"
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Driver Detective-->C:\Program Files\InstallShield Installation Information\{621C02EA-AAFF-4026-A903-165D59529A16}\setup.exe -runfromtemp -l0x0409
EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{D518AD32-C710-4616-BA0D-D4B1FA5F82E8}
FindyKill-->C:\FindyKill\Uninstal.exe
Free FLV Converter V 6.32-->"C:\Program Files\Free FLV Converter\unins000.exe"
Gif Movie Gear 4-->"C:\Program Files\Visicom Media\GMG 4\uninst-gmg.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
HP PrecisionScan LT Software-->C:\SCANJET\PrecisionScanLT\uninstal.exe C:\SCANJET\PrecisionScanLT\uninstal.cfg
HSP56 Modem Drivers-->ptuninst.exe
IKEA HomePlanner Bedroom-->MsiExec.exe /I{36E7C1C1-E5F7-4E22-8B40-7B333FC616E3}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
L&H TTS3000 Français-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSFRF.inf, Uninstall
LiveUpdate (Symantec Corporation)-->MsiExec.exe /x {E80F62FF-5D3C-4A19-8409-9721F2928206} /l*v "C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate"
Macromedia Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Matroska (remove only)-->"C:\Program Files\Matroska\uninstall.exe"
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{3585ED1C-74C5-43B0-A232-831B96A12A2B}
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office FrontPage 2003-->MsiExec.exe /I{9017040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft Office XP Web Components-->MsiExec.exe /I{9026040C-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
MixVibes PRO 4 uninstall-->C:\Program Files\MixVibesPro4\uninstall.exe
Mozilla Firefox (3.0.11)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{E74559C2-BB47-45AD-83DD-0D66B67E7811}
Nero 7 Premium-->MsiExec.exe /I{70AB1576-7883-2313-C650-7A71270B1036}
OneCare Advisor (Windows Live Toolbar)-->MsiExec.exe /X{F242B06B-517F-4D62-B654-16B11564A912}
Pack Vista Inspirat 2 1.0-->C:\WINDOWS\BricoPacks\Vista Inspirat 2\Remove.exe
Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
PhotoFiltre Studio-->"C:\Program Files\PhotoFiltre Studio\Uninst.exe"
QuickTime-->MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}
Ralink Wireless LAN Card-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E91E8912-769D-42F0-8408-0E329443BABC}\setup.exe" -l0x9  -removeonly
RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c  -removeonly
Registry Mechanic 7.0-->"C:\Program Files\Registry Mechanic\unins000.exe"
SafeCast Shared Components-->C:\Program Files\Fichiers communs\Macrovision Shared\SafeCast\Install\CDAC13BA.EXE /uninstall
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sonic Foundry Sound Forge 6.0a-->MsiExec.exe /I{6CDC68BB-C997-4ADC-9BA0-6293FB88521E}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
StairDesigner 6.03a-->C:\Program Files\Boole & Partners\StairDesigner 6\Uninstall.exe
Unlocker 1.8.7-->C:\Program Files\Unlocker\uninst.exe
UsbFix-->C:\Program Files\UsbFix\Uninstal.exe
VIA Platform Device Manager-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} 
VIA Rhine-Family Fast Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
VIA/S3G Display Driver-->C:\PROGRA~1\VIA\UChromeP\s3minset.exe /u C:\PROGRA~1\VIA\UChromeP\UChromeP.uns
Winamp (remove only)-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{DCE65B11-710D-4C54-9DE5-1A6A0BD2186B}
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Sign-in Assistant-->MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {05AE605F-3146-46ED-BC52-0A14EBF57962}
Windows Live Toolbar-->MsiExec.exe /X{05AE605F-3146-46ED-BC52-0A14EBF57962}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Yahoo! Extras-->C:\PROGRA~1\Yahoo!\Common\unyext.exe
Yahoo! Install Manager-->C:\WINDOWS\system32egsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
Yahoo! Internet Mail-->C:\WINDOWS\system32egsvr32 /u /s C:\PROGRA~1\Yahoo!\Common\ymmapi.dll
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Software Update-->C:\PROGRA~1\Yahoo!\SOFTWA~1\UNINST~1.EXE
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Security center information======

AV: Avira AntiVir PersonalEdition (disabled) (outdated)
AV: Kaspersky Anti-Virus (outdated)

======System event log======

Computer Name: ES-1
Event Code: 7001
Message: Le service Avira AntiVir Premium MailGuard dépend du service Avira AntiVir Premium MailGuard helper service qui n'a pas pu démarrer en raison de l'erreur : 
Le service n'a pas répondu assez vite à la demande de lancement ou de contrôle.


Record Number: 4359
Source Name: Service Control Manager
Time Written: 20090428182017.000000+060
Event Type: error
User: 

Computer Name: ES-1
Event Code: 7000
Message: Le service Avira AntiVir Premium MailGuard helper service n'a pas pu démarrer en raison de l'erreur : 
Le service n'a pas répondu assez vite à la demande de lancement ou de contrôle.


Record Number: 4358
Source Name: Service Control Manager
Time Written: 20090428182017.000000+060
Event Type: error
User: 

Computer Name: ES-1
Event Code: 7009
Message: Délai (30000 millisecondes) d'attente pour une connexion du service Avira AntiVir Premium MailGuard helper service.

Record Number: 4357
Source Name: Service Control Manager
Time Written: 20090428182017.000000+060
Event Type: error
User: 

Computer Name: ES-1
Event Code: 7000
Message: Le service Avira AntiVir Premium Guard n'a pas pu démarrer en raison de l'erreur : 
Le service n'a pas répondu assez vite à la demande de lancement ou de contrôle.


Record Number: 4356
Source Name: Service Control Manager
Time Written: 20090428182017.000000+060
Event Type: error
User: 

Computer Name: ES-1
Event Code: 7009
Message: Délai (30000 millisecondes) d'attente pour une connexion du service Avira AntiVir Premium Guard.

Record Number: 4355
Source Name: Service Control Manager
Time Written: 20090428182017.000000+060
Event Type: error
User: 

=====Application event log=====

Computer Name: ES-1D0DC7C34A5A
Event Code: 12001
Message: The Messenger Sharing USN Journal Reader service started successfully.

Record Number: 717
Source Name: usnjsvc
Time Written: 20090125202325.000000+060
Event Type: 
User: 

Computer Name: ES-1
Event Code: 12001
Message: The Messenger Sharing USN Journal Reader service started successfully.

Record Number: 702
Source Name: usnjsvc
Time Written: 20090123185133.000000+060
Event Type: 
User: 

Computer Name: ES-1
Message: The Messenger Sharing USN Journal Reader service started successfully.

Record Number: 687
Source Name: usnjsvc
Time Written: 20090123131111.000000+060
Event Type: 
User: 

Computer Name: ES-1
Event Code: 1517
Message: Windows a sauvegardé le Registre utilisateur ES-1D0DC7C34A5A\poi alors qu'une application ou un service utilisait toujours le Registre pendant la fermeture de la session. La mémoire utilisée par le Registre de l'utilisateur n'a pas été libérée. le Registre sera déchargé lorsqu'il ne sera plus utilisé. 


Cela est souvent causé par des services s'exécutant en tant que compte d'utilisateur, essayez de configurer les services pour s'exécuter dans le compte service réseau ou service local.

Record Number: 677
Source Name: Userenv
Time Written: 20090122210543.000000+060
Event Type: warning
User: AUTORITE NT\SYSTEM

Computer Name: ES-1
Event Code: 4113
Message: 
Record Number: 672
Source Name: Avira AntiVir
Time Written: 20090122204243.000000+060
Event Type: warning
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem;C:\Program Files\Fichiers communs\Autodesk Shared
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

biba31 · Answer

"NoDrives"=
"NoFolderOptions"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home"
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\art-lantis 4.5\Art-lantis.exe"="C:\Program Files\art-lantis 4.5\Art-lantis.exe:*:Enabled:Art*lantis for Win32"
"C:\WINDOWS\system32tcshare.exe"="C:\WINDOWS\system32tcshare.exe:*:Disabled:Partage de l'application RTC"
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.321\French\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.321\French\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Real\RealPlayerealplay.exe"="C:\Program Files\Real\RealPlayerealplay.exe:*:Disabled:RealPlayer"
"C:\SCANJET\PrecisionScanLT\hppwrsav.exe"="C:\SCANJET\PrecisionScanLT\hppwrsav.exe:*:Enabled:ipsec"
"C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe:*:Enabled:ipsec"
"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"="C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe:*:Enabled:ipsec"
"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avscan.exe"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avscan.exe:*:Enabled:ipsec"
"C:\Program Files\Unlocker\Unlocker.exe"="C:\Program Files\Unlocker\Unlocker.exe:*:Enabled:ipsec"
"C:\Program Files\MSN Messenger\usnsvc.exe"="C:\Program Files\MSN Messenger\usnsvc.exe:*:Enabled:ipsec"
"C:\Program Files\Real\RealPlayer\RecordingManager.exe"="C:\Program Files\Real\RealPlayer\RecordingManager.exe:*:Enabled:ipsec"
"C:\DOCUME~1\poi\LOCALS~1\Temptcoa.exe"="C:\DOCUME~1\poi\LOCALS~1\Temptcoa.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winqwxi.exe"="C:\WINDOWS\TEMP\winqwxi.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winmfpnd.exe"="C:\WINDOWS\TEMP\winmfpnd.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\wingagkqu.exe"="C:\WINDOWS\TEMP\wingagkqu.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winfvjksy.exe"="C:\WINDOWS\TEMP\winfvjksy.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\qihl.exe"="C:\WINDOWS\TEMP\qihl.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\kiih.exe"="C:\WINDOWS\TEMP\kiih.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\yvclyp.exe"="C:\WINDOWS\TEMP\yvclyp.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP
snyxk.exe"="C:\WINDOWS\TEMP
snyxk.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winfprmk.exe"="C:\WINDOWS\TEMP\winfprmk.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\iluv.exe"="C:\WINDOWS\TEMP\iluv.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winjmfx.exe"="C:\WINDOWS\TEMP\winjmfx.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winpxcrjm.exe"="C:\WINDOWS\TEMP\winpxcrjm.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winfedx.exe"="C:\WINDOWS\TEMP\winfedx.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\wintecq.exe"="C:\WINDOWS\TEMP\wintecq.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winwkkv.exe"="C:\WINDOWS\TEMP\winwkkv.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\qjkknl.exe"="C:\WINDOWS\TEMP\qjkknl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\poi\LOCALS~1\Temp\yejbju.exe"="C:\DOCUME~1\poi\LOCALS~1\Temp\yejbju.exe:*:Enabled:ipsec"
"C:\DOCUME~1\poi\LOCALS~1\Temp\waewkw.exe"="C:\DOCUME~1\poi\LOCALS~1\Temp\waewkw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\poi\LOCALS~1\Temp\wintmmmny.exe"="C:\DOCUME~1\poi\LOCALS~1\Temp\wintmmmny.exe:*:Enabled:ipsec"
"C:\DOCUME~1\poi\LOCALS~1\Temp\winfwtgjt.exe"="C:\DOCUME~1\poi\LOCALS~1\Temp\winfwtgjt.exe:*:Enabled:ipsec"
"C:\DOCUME~1\poi\LOCALS~1\Temp\eeqcn.exe"="C:\DOCUME~1\poi\LOCALS~1\Temp\eeqcn.exe:*:Enabled:ipsec"
"C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\diievy.exe"="C:\WINDOWS\TEMP\diievy.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\qesw.exe"="C:\WINDOWS\TEMP\qesw.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\khmge.exe"="C:\WINDOWS\TEMP\khmge.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\xytvrr.exe"="C:\WINDOWS\TEMP\xytvrr.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winxpdkx.exe"="C:\WINDOWS\TEMP\winxpdkx.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winscmcx.exe"="C:\WINDOWS\TEMP\winscmcx.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\aryek.exe"="C:\WINDOWS\TEMP\aryek.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winiogt.exe"="C:\WINDOWS\TEMP\winiogt.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\oodvlo.exe"="C:\WINDOWS\TEMP\oodvlo.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\wingasjd.exe"="C:\WINDOWS\TEMP\wingasjd.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winrplacs.exe"="C:\WINDOWS\TEMP\winrplacs.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winmieiod.exe"="C:\WINDOWS\TEMP\winmieiod.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\kvqs.exe"="C:\WINDOWS\TEMP\kvqs.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\wingoyf.exe"="C:\WINDOWS\TEMP\wingoyf.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winrqqwfc.exe"="C:\WINDOWS\TEMP\winrqqwfc.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\wineedjrk.exe"="C:\WINDOWS\TEMP\wineedjrk.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\kbli.exe"="C:\WINDOWS\TEMP\kbli.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winnonpv.exe"="C:\WINDOWS\TEMP\winnonpv.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winlttpsu.exe"="C:\WINDOWS\TEMP\winlttpsu.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winpxibwx.exe"="C:\WINDOWS\TEMP\winpxibwx.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winwrhh.exe"="C:\WINDOWS\TEMP\winwrhh.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winqhtvrq.exe"="C:\WINDOWS\TEMP\winqhtvrq.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winvvmg.exe"="C:\WINDOWS\TEMP\winvvmg.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\wineoqc.exe"="C:\WINDOWS\TEMP\wineoqc.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\jrdna.exe"="C:\WINDOWS\TEMP\jrdna.exe:*:Enabled:ipsec"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\TEMP\mlpgq.exe"="C:\WINDOWS\TEMP\mlpgq.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winrokg.exe"="C:\WINDOWS\TEMP\winrokg.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\qkwexr.exe"="C:\WINDOWS\TEMP\qkwexr.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\oqjbs.exe"="C:\WINDOWS\TEMP\oqjbs.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\xusx.exe"="C:\WINDOWS\TEMP\xusx.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winpkcxol.exe"="C:\WINDOWS\TEMP\winpkcxol.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winscvmy.exe"="C:\WINDOWS\TEMP\winscvmy.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winvphw.exe"="C:\WINDOWS\TEMP\winvphw.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winwuic.exe"="C:\WINDOWS\TEMP\winwuic.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\sgtj.exe"="C:\WINDOWS\TEMP\sgtj.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\cxrkqo.exe"="C:\WINDOWS\TEMP\cxrkqo.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\vyna.exe"="C:\WINDOWS\TEMP\vyna.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\lwepv.exe"="C:\WINDOWS\TEMP\lwepv.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winiyvb.exe"="C:\WINDOWS\TEMP\winiyvb.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\vpwx.exe"="C:\WINDOWS\TEMP\vpwx.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\lnvrjy.exe"="C:\WINDOWS\TEMP\lnvrjy.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\bnsew.exe"="C:\WINDOWS\TEMP\bnsew.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winuuuq.exe"="C:\WINDOWS\TEMP\winuuuq.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winwhqrha.exe"="C:\WINDOWS\TEMP\winwhqrha.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\iknqr.exe"="C:\WINDOWS\TEMP\iknqr.exe:*:Enabled:ipsec"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\WINDOWS\TEMP
qtbyh.exe"="C:\WINDOWS\TEMP
qtbyh.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\uxqmsy.exe"="C:\WINDOWS\TEMP\uxqmsy.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\wamc.exe"="C:\WINDOWS\TEMP\wamc.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\qoix.exe"="C:\WINDOWS\TEMP\qoix.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winemtcgu.exe"="C:\WINDOWS\TEMP\winemtcgu.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winjuyjn.exe"="C:\WINDOWS\TEMP\winjuyjn.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winnppjwg.exe"="C:\WINDOWS\TEMP\winnppjwg.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winvjyk.exe"="C:\WINDOWS\TEMP\winvjyk.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\uvbp.exe"="C:\WINDOWS\TEMP\uvbp.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\vhger.exe"="C:\WINDOWS\TEMP\vhger.exe:*:Enabled:ipsec"
"C:\WINDOWS\TEMP\winitfd.exe"="C:\WINDOWS\TEMP\winitfd.exe:*:Enabled:ipsec"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1638ae09-c067-11dc-88b1-8488c0ac5ecb}]
shell\aUtoplaY\command - F:\firy.pif
shell\AutoRun\command - F:\firy.pif
shell\ExplOrE\command - F:\firy.pif
shell\Open\command - F:\firy.pif


======File associations======

.scr - open - "C:\WINDOWS
otepad.exe" "%1"
.scr - install - 
.scr - config - 

======List of files/folders created in the last 1 months======

2009-06-24 07:06:32 ----D---- C:sit
2009-06-02 19:55:29 ----D---- C:\Documents and Settings\poi\Application Data\Dev-Cpp
2009-06-02 19:54:41 ----D---- C:\Dev-Cpp

======List of files/folders modified in the last 1 months======

2009-06-24 07:07:10 ----D---- C:\Program Files	rend micro
2009-06-24 07:03:53 ----D---- C:\Program Files\Mozilla Firefox
2009-06-24 07:00:19 ----D---- C:\Documents and Settings\poi\Application Data\Skype
2009-06-24 07:00:05 ----D---- C:\WINDOWS	emp
2009-06-24 06:23:00 ----D---- C:\Documents and Settings\poi\Application Data\skypePM
2009-06-22 14:52:35 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-22 14:51:02 ----D---- C:\WINDOWS\system32\drivers
2009-06-21 18:35:19 ----A---- C:\WINDOWS\NeroDigital.ini
2009-06-20 00:57:56 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-17 23:32:09 ----D---- C:\Program Files\Yahoo!
2009-06-17 23:32:09 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
2009-06-17 23:32:05 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2009-06-17 23:30:51 ----D---- C:\WINDOWS\Prefetch
2009-06-17 23:29:29 ----D---- C:\WINDOWS\system32
2009-06-16 16:20:05 ----SD---- C:\Documents and Settings\poi\Application Data\Microsoft
2009-06-14 23:06:55 ----D---- C:\WINDOWS\system32\wbem
2009-06-14 23:06:54 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-01 09:51:14 ----A---- C:\WINDOWS\system32\MRT.exe
2009-05-30 16:10:54 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-05-26 17:45:29 ----A---- C:\WINDOWS\ppdrv.ini
2009-05-25 20:37:15 ----SH---- C:\boot.ini
2009-05-25 20:37:15 ----A---- C:\WINDOWS\win.ini
2009-05-25 20:37:15 ----A---- C:\WINDOWS\system.ini
2009-05-25 20:36:45 ----D---- C:\WINDOWS\pss

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-10-30 75072]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-09-28 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-04-02 20747]
R2 CdaC15BA;CdaC15BA; \??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS []
R2 irda;Protocole IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 MDC8021X;AEGIS Protocol (IEEE 802.1x) v2.3.1.9; C:\WINDOWS\system32\DRIVERS\mdc8021x.sys [2008-03-20 15781]
R2 NwlnkIpx;Protocole de transport compatible NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS
wlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;NetBIOS NWLink; C:\WINDOWS\system32\DRIVERS
wlnknb.sys [2001-09-28 63232]
R2 NwlnkSpx;Protocole NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS
wlnkspx.sys [2001-09-28 55936]
R2 PPSCAN;PPSCAN; C:\WINDOWS\system32\drivers\PPSCAN.sys [2002-03-29 91520]
R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\fijkog.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-10-04 3797632]
R3 BridgeMP;Miniport de pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
R3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2004-09-21 10804]
R3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys [2005-01-13 12500]
R3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2005-03-18 42496]
R3 MODEMCSA;Périphérique de filtrage de flux Unimodem; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 Ptserial;W2K Conexant Serial Device Driver; C:\WINDOWS\system32\DRIVERS\ptserial.sys [2004-05-24 362878]
R3 Rasirda;Miniport réseau étendu (IrDA); C:\WINDOWS\system32\DRIVERSasirda.sys [2001-08-17 19584]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-09-28 5888]
R3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERSt73.sys [2006-01-12 252928]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312]
R3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2004-11-05 82148]
R3 viagfx;viagfx; C:\WINDOWS\system32\DRIVERS\vtmini.sys [2005-06-01 227712]
R3 Vmodem;W2K Vmodem; C:\WINDOWS\system32\DRIVERS\vmodem.sys [2004-03-20 703737]
R3 Vpctcom;W2K Vpctcom; C:\WINDOWS\system32\DRIVERS\vpctcom.sys [2004-03-20 804754]
R3 Vvoice;W2K Vvoice; C:\WINDOWS\system32\DRIVERS\vvoice.sys [2004-03-20 70384]
S3 admjoy;Enumérateur de ports jeu Aureal; C:\WINDOWS\system32\DRIVERS\admjoy.sys [2004-08-03 10880]
S3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgntflt.sys []
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2004-10-19 20096]
S3 Bridge;Pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys [2005-01-17 23000]
S3 BTNetFilter;Bluetooth Network Filter; \??\C:\WINDOWS\system32\drivers\BTNetFilter.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2003-01-05 717263]
S3 es1969;Pilote audio ESS Solo (WDM); C:\WINDOWS\system32\drivers\es1969.sys [2001-08-17 72192]
S3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\WINDOWS\system32\DRIVERS\fetnd5.sys []
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 irsir;Pilote série infrarouge Microsoft; C:\WINDOWS\system32\DRIVERS\irsir.sys [2001-08-17 18688]
S3 mf;mf; C:\WINDOWS\system32\DRIVERS\mf.sys [2008-04-13 63744]
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-09-28 12288]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NWRDR;NetWare Rdr; C:\WINDOWS\system32\DRIVERS
wrdr.sys [2008-04-13 163584]
S3 scsiscan;Pilote de scanneur SCSI; C:\WINDOWS\system32\DRIVERS\scsiscan.sys [2008-04-13 11520]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys []
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S3 wdm_au8830;Pilote audio Aureal Vortex 8830 (WDM); C:\WINDOWS\system32\drivers\adm8830.sys [2001-08-17 747392]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Avira AntiVir Premium Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe [2008-10-15 68865]
R2 BlueSoleil Hid Service;BlueSoleil Hid Service; C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe [2005-01-27 176128]
R2 C-DillaCdaC11BA;C-DillaCdaC11BA; C:\WINDOWS\system32\drivers\CDAC11BA.EXE [2008-01-16 54784]
R2 Irmon;Moniteur infrarouge; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
S2 AntiVirMailService;Avira AntiVir Premium MailGuard; C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe [2008-07-11 164097]
S2 AntiVirService;Avira AntiVir Premium Guard; C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe [2008-10-15 151297]
S2 antivirwebservice;Avira AntiVir Premium WebGuard; C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE [2008-06-12 258305]
S2 AVEService;Avira AntiVir Premium MailGuard helper service; C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe [2008-05-09 41217]
S2 NWCWorkstation;Service client pour NetWare; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 676120]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 162864]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 166768]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]

-----------------EOF-----------------

Virus

83 réponses

Votre réponse

Discussions similaires

Newsletters