Probleme pour eliminer Win 32:Trojan-gen Othe
jorge
-
jorge -
jorge -
Bonjour,
Après plusieurs problème depuis une semaine sur mon pc qui est un Intel(R) CPU 1,80 GHz, 1.79 GHz, 0.99 Go de RAM? sous XP 2002 pack 2, je résume La semaine dernier c'est a dire lundi 9 mars 2009, une fenêtre ses ouverte sur le bureau avec cette mention SVChost.exe-Erreur d'application "0x75586eb5" et "0x0000008" la mémoire de peut pas être read et ok pour valider.
Je suis rester avec 3 jour, je n'avais plus de son et la bécane ramais, il semblerais que c'était un virus , j'ai réussit a résoudre le problème sans pouvoir identifier la bête, mais la aujourd'hui mon antivirus Avast a détecter autres chose et ne peut pas le résoudre, après un scan totale du pc il a découverts un bébête du nom de Win 32: Trojan-gen{Other} qui serais dans le fichier C:\WINDOWS\ QKezowozi.dll , et ils y en a 4 , serait il possible de me dire la démarche a suivre pour éliminer le problème s'il vous plais , même si c'est un vieux coucou il fonctionne très bien et étais très rapide avant tous c'est problème , je vous remercie de vôtres réponse.
Après plusieurs problème depuis une semaine sur mon pc qui est un Intel(R) CPU 1,80 GHz, 1.79 GHz, 0.99 Go de RAM? sous XP 2002 pack 2, je résume La semaine dernier c'est a dire lundi 9 mars 2009, une fenêtre ses ouverte sur le bureau avec cette mention SVChost.exe-Erreur d'application "0x75586eb5" et "0x0000008" la mémoire de peut pas être read et ok pour valider.
Je suis rester avec 3 jour, je n'avais plus de son et la bécane ramais, il semblerais que c'était un virus , j'ai réussit a résoudre le problème sans pouvoir identifier la bête, mais la aujourd'hui mon antivirus Avast a détecter autres chose et ne peut pas le résoudre, après un scan totale du pc il a découverts un bébête du nom de Win 32: Trojan-gen{Other} qui serais dans le fichier C:\WINDOWS\ QKezowozi.dll , et ils y en a 4 , serait il possible de me dire la démarche a suivre pour éliminer le problème s'il vous plais , même si c'est un vieux coucou il fonctionne très bien et étais très rapide avant tous c'est problème , je vous remercie de vôtres réponse.
A voir également:
- Probleme pour eliminer Win 32:Trojan-gen Othe
- 32 bits - Guide
- Power iso 32 bit - Télécharger - Gravure
- Win rar - Télécharger - Compression & Décompression
- Télécharger windows 7 32 bits usb - Télécharger - Systèmes d'exploitation
- Clé de produit windows 7 professionnel 32 bits gratuit - Guide
15 réponses
Bonjour, nous allons voir ce qu'il se passe sur ce pc.
I)Telecharger random's system information tool: (RSIT)
http://images.malwareremoval.com/random/RSIT.exe
1)Double clique sur l’icône RSIT.exe
2)Clique sur continue.
3)L’analyse terminée, deux fichiers s’ouvriront, poste moi les 2 rapports stp.
Si les 2 fichiers ne s’ouvrent pas va dans C:\rsit , tu y trouvera les 2 fichiers info.txt et log.txt
I)Telecharger random's system information tool: (RSIT)
http://images.malwareremoval.com/random/RSIT.exe
1)Double clique sur l’icône RSIT.exe
2)Clique sur continue.
3)L’analyse terminée, deux fichiers s’ouvriront, poste moi les 2 rapports stp.
Si les 2 fichiers ne s’ouvrent pas va dans C:\rsit , tu y trouvera les 2 fichiers info.txt et log.txt
alors on va tout verifier telecharge bitdefender total security 2009 (version gratuite pendant 30 jours)
apres tu fais une analyse de ton ordinateur normalment il va t'eliminer win32:trojan-gen other
une fois l'analyse terminer telecharge spybot et la fait tout verifer si il y a des erreur clique sur coriger les erreurs
une fois terminer teleharge ccleaner pour faire un nettoyage de tout sa.
puis normalement in ne devrais plus avoir de probleme si il y en a toujours conctacter moi sur le forum ou sinon vous pouvez m'envoyais un mail a cette adresse o114@hotmail.fr.
merci de me tenir au courant du reste des evenement
apres tu fais une analyse de ton ordinateur normalment il va t'eliminer win32:trojan-gen other
une fois l'analyse terminer telecharge spybot et la fait tout verifer si il y a des erreur clique sur coriger les erreurs
une fois terminer teleharge ccleaner pour faire un nettoyage de tout sa.
puis normalement in ne devrais plus avoir de probleme si il y en a toujours conctacter moi sur le forum ou sinon vous pouvez m'envoyais un mail a cette adresse o114@hotmail.fr.
merci de me tenir au courant du reste des evenement
Ree tu a la trac d'un vundo esur ton pc.
Malwarebyte's devrait le supprimer sans problèmes.
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
I)Télécharger sur ton bureau Malwarebyte's Anti-Malware :
telecharge malware's bytes a cette adresse:
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
1)Double-clic « mbam-setup »,l'installation se lance (installer sans rien changer).
2)Lance le programme,va dans l'onlet « mise à jour » puis clique « recherche de mise à jour ».
3)Va dans l'onglet « recherche » puis cocher « Exécuter un exament complet » >>clique « rechercher » puis lancer l'examen.
4)A la fin du scan ,si il y a des infections clique « afficher résultat ».
5)fermer toutes les autres applications.
6)Vérifier si tout est coché et clic « Supprimer la sélection ».
7)Un rapport s'ouvre copier-coller dans ta prochaine réponse
Malwarebyte's devrait le supprimer sans problèmes.
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
I)Télécharger sur ton bureau Malwarebyte's Anti-Malware :
telecharge malware's bytes a cette adresse:
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
1)Double-clic « mbam-setup »,l'installation se lance (installer sans rien changer).
2)Lance le programme,va dans l'onlet « mise à jour » puis clique « recherche de mise à jour ».
3)Va dans l'onglet « recherche » puis cocher « Exécuter un exament complet » >>clique « rechercher » puis lancer l'examen.
4)A la fin du scan ,si il y a des infections clique « afficher résultat ».
5)fermer toutes les autres applications.
6)Vérifier si tout est coché et clic « Supprimer la sélection ».
7)Un rapport s'ouvre copier-coller dans ta prochaine réponse
Voici le rapport de Malwarebytes, j'espère que c'est pas trop mauvais et désoler du contretemps, j'ai du m'absenter
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1861
Windows 5.1.2600 Service Pack 2
18/03/2009 18:33:50
mbam-log-2009-03-18 (18-33-50).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 144632
Temps écoulé: 1 hour(s), 3 minute(s), 19 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rgekocig (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\system32\MSINET.oca (Rogue.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1861
Windows 5.1.2600 Service Pack 2
18/03/2009 18:33:50
mbam-log-2009-03-18 (18-33-50).txt
Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 144632
Temps écoulé: 1 hour(s), 3 minute(s), 19 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rgekocig (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\WINDOWS\system32\MSINET.oca (Rogue.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
sinon il y a cette solution redémarre en mode sans échec et vide le contenu du dossier temp :
C:/windows/temp
Vide ta quarantaine et redémarre le pc.
C:/windows/temp
Vide ta quarantaine et redémarre le pc.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Ouvre hijackthis, clique sur do a system scan only .
Coche moi ces lignes en gras..
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search4top.net/040C/ie.asp
F3 - REG:win.ini: run=
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Clique sur fix checked.
Redémarre l'ordinateur.
Puis refait moi un nouveau log RSIT stp.
1) Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau.
http://oldtimer.geekstogo.com/OTMoveIt3.exe
Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.
:processes
explorer.exe
:Files
C:\WINDOWS\Qkezowozi.dll
:commands
[emptytemp]
[start explorer]
[reboot]
clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur Exit pour fermer.
Poste le rapport ( fichier .log ) situé dans C:\_OTMoveIt\MovedFiles.
Coche moi ces lignes en gras..
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search4top.net/040C/ie.asp
F3 - REG:win.ini: run=
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Clique sur fix checked.
Redémarre l'ordinateur.
Puis refait moi un nouveau log RSIT stp.
1) Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau.
http://oldtimer.geekstogo.com/OTMoveIt3.exe
Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.
:processes
explorer.exe
:Files
C:\WINDOWS\Qkezowozi.dll
:commands
[emptytemp]
[start explorer]
[reboot]
clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur Exit pour fermer.
Poste le rapport ( fichier .log ) situé dans C:\_OTMoveIt\MovedFiles.
Voila avec un peut de patience j'ai enfin compris , voila le rapport de OTMoveIt3
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\WINDOWS\Qkezowozi.dll not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\etilqs_fvHU2RrcsTzj6sUWYlHB scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3d8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5dc.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_e4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03182009_205605
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\WINDOWS\Qkezowozi.dll not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\etilqs_fvHU2RrcsTzj6sUWYlHB scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3d8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5dc.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_e4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03182009_205605
Salut,
Le fichier n'est plus présent sur le PC : le rapport RSIT te le dit :
Il reste la clé de registre à virer ...
Le fichier n'est plus présent sur le PC : le rapport RSIT te le dit :
"Rgekocig"=C:\WINDOWS\Qkezowozi.dll []
Il reste la clé de registre à virer ...
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Rgekocig"=-
ree jorge.merci crapoulou pour ton intervention j'ai encore du mal a décrypter un log RSIT.Comment voit tu si le fichier est présent ou pas dans le rapport RSIT ??
Merci de ton aide!
II)Telecharge et enregistre sur ton bureau Hijackthis :
http://www.trendsecure.com/portal/fr/_download/HiJackThis.exe
Ouvre hijackthis, clique sur do a system scan only .
Coche moi ces lignes en gras..
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search4top.net/040C/ie.asp
F3 - REG:win.ini: run=
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Clique sur fix checked.
Redémarre l'ordinateur.
Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.
:processes
explorer.exe
:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Rgekocig"=-
:commands
[emptytemp]
[start explorer]
[reboot]
clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur Exit pour fermer.
Poste le rapport ( fichier .log ) situé dans C:\_OTMoveIt\MovedFiles.
Merci de ton aide!
II)Telecharge et enregistre sur ton bureau Hijackthis :
http://www.trendsecure.com/portal/fr/_download/HiJackThis.exe
Ouvre hijackthis, clique sur do a system scan only .
Coche moi ces lignes en gras..
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search4top.net/040C/ie.asp
F3 - REG:win.ini: run=
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Clique sur fix checked.
Redémarre l'ordinateur.
Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.
:processes
explorer.exe
:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Rgekocig"=-
:commands
[emptytemp]
[start explorer]
[reboot]
clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur Exit pour fermer.
Poste le rapport ( fichier .log ) situé dans C:\_OTMoveIt\MovedFiles.
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Rgekocig"=C:\WINDOWS\Qkezowozi.dll []
Pas de date entre les crochets.
Je vous laisse, on va pas polluer le topic.
Si tu veux plus d'infos, on voit ça en MP.
Bonne continuation à vous.
Crapoulou.
"Rgekocig"=C:\WINDOWS\Qkezowozi.dll []
Pas de date entre les crochets.
Je vous laisse, on va pas polluer le topic.
Si tu veux plus d'infos, on voit ça en MP.
Bonne continuation à vous.
Crapoulou.
faire ça.
II)Telecharge et enregistre sur ton bureau Hijackthis :
http://www.trendsecure.com/portal/fr/_download/HiJackThis.exe
Ouvre hijackthis, clique sur do a system scan only .
Coche moi ces lignes en gras..
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search4top.net/040C/ie.asp
F3 - REG:win.ini: run=
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Clique sur fix checked.
Redémarre l'ordinateur.
Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.
:processes
explorer.exe
:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Rgekocig"=-
:commands
[emptytemp]
[start explorer]
[reboot]
clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur Exit pour fermer.
Poste le rapport ( fichier .log ) situé dans C:\_OTMoveIt\MovedFiles.
II)Telecharge et enregistre sur ton bureau Hijackthis :
http://www.trendsecure.com/portal/fr/_download/HiJackThis.exe
Ouvre hijackthis, clique sur do a system scan only .
Coche moi ces lignes en gras..
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search4top.net/040C/ie.asp
F3 - REG:win.ini: run=
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Clique sur fix checked.
Redémarre l'ordinateur.
Double-clique sur OTMoveIt.exe pour le lancer.
Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste Instructions for Items to be Moved.
:processes
explorer.exe
:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Rgekocig"=-
:commands
[emptytemp]
[start explorer]
[reboot]
clique sur MoveIt! pour lancer la suppression.
Le résultat apparaitra dans le cadre "Results".
Clique sur Exit pour fermer.
Poste le rapport ( fichier .log ) situé dans C:\_OTMoveIt\MovedFiles.
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\WINDOWS\Qkezowozi.dll not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\etilqs_fvHU2RrcsTzj6sUWYlHB scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3d8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5dc.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_e4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03182009_205605
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\WINDOWS\Qkezowozi.dll not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\etilqs_fvHU2RrcsTzj6sUWYlHB scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3d8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5dc.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_e4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03182009_205605
Ce n'est pas le bon rapport , donne moi le dernier stp.
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Rgekocig not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\etilqs_T5jEZNadDTI19t9hWjdm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF354D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3559.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3689.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3696.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3706.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3712.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3747.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3753.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF378B.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3797.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF37D2.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF37DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3853.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF385F.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF398A.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3996.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3A0D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3A23.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3A63.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3A6F.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3AA7.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3AEF.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3C4A.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3C57.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3CD7.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3CEB.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF4030.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF403C.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF4154.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF4160.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF434D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF435A.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF4390.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF439C.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3d8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5dc.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_e4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03182009_221111
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Rgekocig not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\etilqs_T5jEZNadDTI19t9hWjdm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF354D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3559.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3689.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3696.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3706.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3712.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3747.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3753.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF378B.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3797.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF37D2.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF37DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3853.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF385F.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF398A.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3996.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3A0D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3A23.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3A63.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3A6F.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3AA7.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3AEF.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3C4A.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3C57.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3CD7.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF3CEB.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF4030.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF403C.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF4154.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF4160.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF434D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF435A.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF4390.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\A\LOCALS~1\Temp\~DF439C.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_3d8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5dc.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_e4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\A\Local Settings\Application Data\Mozilla\Firefox\Profiles\i60pliw3.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03182009_221111
Logfile of random's system information tool 1.05 (written by random/random)
Run by A at 2009-03-18 13:54:52
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 66 GB (87%) free of 76 GB
Total RAM: 1015 MB (46% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:55:33, on 18/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\A\Bureau\RSIT.exe
C:\Program Files\trend micro\A.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search4top.net/040C/ie.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=explorer.exe
F3 - REG:win.ini: run=
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Rgekocig] rundll32.exe "C:\WINDOWS\Qkezowozi.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe