supprimer le virus Beagle/BagleRésolu/Fermé

Question

Bonjour,
j ai analyser mon Aspire 3100 de systéme WIN SP2 par   Findykill

si quelqu un peu m aider a resoudre ce probleme ça serait génial.

voici le rapport:



############################## [ FindyKill V4.720 ] 

# User : Ma Gnon‚ (Administrateurs) # PRESTAVE-38FE64
# Update on 22/03/09 by Chiquitine29
# Start at: 15:47:16 | 22/03/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

# Mobile AMD Sempron(tm) Processor 3400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Disabled
# AV : Kaspersky Internet Security 8.0.0.454 [ Enabled | (!) Outdated ]
# FW : Kaspersky Internet Security[ Enabled ]8.0.0.454

# C:\ # Disque fixe local # 25,26 Go (3,1 Go free) [ACER] # NTFS
# D:\ # Disque fixe local # 25,73 Go (1,41 Go free) [ACERDATA] # FAT32
# E:\ # Disque CD-ROM # 694,21 Mo (0 Mo free) [Mon disque] # CDFS
# F:\ # Disque CD-ROM
# G:\ # Disque CD-ROM
# H:\ # Disque CD-ROM
# I:\ # Disque CD-ROM
# J:\ # Disque CD-ROM
 
############################## [ Active Processes ] 
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\svchost.exe
D:\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Rocket Division Software\StarWind Lite\StarWindServiceLite.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\Google Talk\googletalk.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
 
################## [ Infected Files / Folders C:\ ] 
 
Deleted ! - C:\InfoSat.txt  
 
################## [ C:\WINDOWS ] 
 
 
################## [ C:\WINDOWS\system32 ] 
 
 
################## [ C:\WINDOWS\system32\drivers ] 
 
 
################## [ C:\.. Application Data ... ] 
 
 
################## [  Registry / Infected keys ]   
 
 
################## [ Cleaning Removable drives ]  
 
# Deleting files : 
 
 
################## [ Registry / Mountpoint2 ] 
 
# -> Not found ! 
 
################## [ Searching Other Infections ] 
 
# -> Nothing found.
 
################## [ PEH Corrupted ] 
 
C:\program file\Nouveau dossier\Mozilla Firefox\uninstall\helper.exe
C:\Program Files\Alwil Software\Avast4\ashAvast.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashLogV.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashPopWz.exe
C:\Program Files\Alwil Software\Avast4\ashQuick.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashSimp2.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Alwil Software\Avast4\ashSkPcc.exe
C:\Program Files\Alwil Software\Avast4\ashSkPck.exe
C:\Program Files\Alwil Software\Avast4\ashUpd.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\aswRegSvr.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\sched.exe
C:\Program Files\Alwil Software\Avast4\VisthLic.exe
C:\Program Files\Alwil Software\Avast4\VisthUpd.exe
C:\WINDOWS\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\sysinfo.exe
C:\WINDOWS\SoftwareDistribution\Download\44b6174a4a693136d02d4a7ecd7cbd54\update\update.exe
 
################## [ ! End of Report # FindyKill V4.720 ! ]

jlpjlp · Answer

slt,

désinstalle avast comme ceci:

https://www.avast.com/fr-fr/uninstall-utility



et mets antivir et colle un rapport avec:
https://www.malekal.com/avira-free-security-antivirus-gratuit/


puis


Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

koloj · Answer

info.txt logfile of random's system information tool 1.06 2009-03-22 17:20:41

======Uninstall list======

-->C:\Program Files\Nero\Nero 7
ero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.60 beta-->"C:\Program Files\7-Zip\Uninstall.exe"
Adobe After Effects 6.5-->MsiExec.exe /I{61CEB2D7-8D3B-4247-B75E-A95F6699B90A}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
AMV2 video codec-->C:\WINDOWS\eiunin21.exe "C:\Program Files\Amv2Codec\install.DAT"
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ASIO4ALL-->D:\Image line\ASIO4ALL v2\uninstall.exe
Ask Toolbar-->rundll32 C:\PROGRA~1\AskTBar\bar\2.bin\AskTBar.dll,O 
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
Astro Gemini Screensaver Manager 2.0-->"C:\Program Files\Astro Gemini Software\Screensaver Manager 2.0\unins000.exe"
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Blender (remove only)-->"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Catalyst Control Center - Branding-->MsiExec.exe /I{FA3A247D-437A-455E-A88F-7EB6E5F9E799}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CHEMIX Ver. 2.30-->"C:\WINDOWS\UNISTB32.EXE" /U "C:\Program Files\CHEMIX School2_30\UNINST0.000" "C:\Program Files\CHEMIX School2_30\UNINST1.000"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Collab-->C:\Program Files\Image-Line\Collab\uninstall.exe
Contextual Tool Milehighads-->C:\WINDOWS\system32\cont_milehighads-remove.exe
Correctif pour Windows XP (KB935448)-->"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Counter Strike 1.6 - By PirocaHP.F!N4LShare-->C:\WINDOWS\unvise32.exe c:\uninstal_cs.log
Dealio Toolbar 3.4-->MsiExec.exe /X{6105648C-0C3C-481D-8C11-1F4952D6FB53}
Deckadance-->D:\Image line\Deckadance\uninstall.exe
Dwg2Img-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BFCD5069-52AC-4B3F-902A-CDC5CD5D21DA}\setup.exe" 
EA SPORTS online 2005-->D:\FIFA 2005\EASOUNInstaller.exe
eMule-->"C:\Program Files\eMule\Uninstall.exe"
ffdshow [rev 2180] [2008-10-04]-->"C:\Program Files\ffdshow\unins000.exe"
FIFA 2005-->D:\vid\EAUninstall.exe
FindyKill-->C:\Program Files\FindyKill\Uninstal.exe
Firebird SQL Server - MAGIX Edition-->C:\Program Files\MAGIX\Common\Database\unwise.exe
Firebird SQL Server - MAGIX Edition-->C:\Program Files\MAGIX\Common\Database\unwise.exe
FL Studio v7.0-->"C:\Program Files\Image-Line\FL Studio 7\unins000.exe"
Google Talk Plugin-->MsiExec.exe /I{B279F2F1-3B2F-3A96-AC11-5743CD43DCCB}
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
IL Download Manager-->C:\Program Files\Image-Line\Downloader\uninstall.exe
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Logitech Desktop Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0x40c UNINSTALL
Ma-Config.com-->MsiExec.exe /X{DD987A54-122B-4CFD-A8C5-5577027A6B78}
MAGIX Music Maker 2008 Producer Edition Trial 13.0.2.1 (F)-->C:\Program Files\MAGIX\MusicMaker2008PE_Version_a_telecharger\unwise.exe
MAGIX Screenshare 4.3.6.1987 (F)-->C:\Program Files\MAGIX\PCVisit\unwise.exe
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Encarta 2009 - Collection-->MsiExec.exe /I{09180081-2C94-4A67-8E55-8483C019C7D2}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
MixVibes STANDARD 6 uninstall-->C:\Program Files\MixVibes6\uninstall.exe
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Firefox (3.0.7)-->D:\program file\Nouveau dossier\Mozilla Firefox\uninstall\helper.exe
MP3 Player Utilities 3.68-->MsiExec.exe /I{D98BFAD2-0C90-47F4-9D69-2EFF21631884}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
Nero 7 Demo-->MsiExec.exe /I{C985153C-3801-EB63-1432-088E71801036}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Package de pilotes Windows - Advanced Micro Devices (AmdK8) Processor  (04/28/2006 1.3.1.0)-->C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_4C9003F79A472E408F11C51BDF222156676824AF\amdk8.inf
Paquete de idioma de Microsoft .NET Framework 2.0 - ESN-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - ESN\install.exe
PoiZone-->C:\Program Files\Image-Line\PoiZone\uninstall.exe
Prince of Persia l'Ame du Guerrier-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EE5BC0BB-9EDA-423C-8276-48857B735D68}\Setup.exe" -l0x40c 
Prince of Persia T2T-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DFFE2B1F-07E0-45A9-8801-CD8514CAA876}\setup.exe" -l0x40c  -removeonly
Python 2.5.2-->MsiExec.exe /I{6B976ADF-8AE8-434E-B282-A06C7F624D2F}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
RON Tool Milehighads-->C:\WINDOWS\system32\ohjgomngiqgsrau.exe
SafeCast Shared Components-->C:\Program Files\Fichiers communs\Macrovision Shared\SafeCast\Install\CDAC13BA.EXE /uninstall
Search Settings 1.2-->MsiExec.exe /X{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2BFA&SUBSYS_1025009F\HXFSETUP.EXE -U -IAcrS09Fp.inf
StarWind Lite, v10.0 (Build 20080630, Win32)-->"C:\Program Files\Rocket Division Software\StarWind Lite\unins000.exe"
Sumatra PDF reader-->"C:\Program Files\SumatraPDF\uninstall.exe"
SuperCopier2-->"C:\Program Files\SuperCopier2\SC2Uninst.exe"
Text-To-Speech-Runtime-->MsiExec.exe /X{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}
Total Video Converter 3.10-->"C:\Program Files\Total Video Converter\unins000.exe"
Toxic Biohazard-->C:\Program Files\Image-Line\Toxic Biohazard\uninstall.exe
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Viewpoint Media Player (Remove Only)-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe -u
VLC media player 0.9.6-->C:\Program Files\VideoLAN\VLC\uninstall.exe
V-Ray for Maya 2008 for x86-->"C:\Program Files\Chaos Group\V-Ray\Maya 2008 for x86/uninstall/wininstaller.exe"-uninstall="C:\Program Files\Chaos Group\V-Ray\Maya 2008 for x86/uninstall/install.log" -uninstallApp="V-Ray for Maya 2008 for x86"
V-Ray for Maya 8.5 for x86-->"C:\Program Files\Chaos Group\V-Ray\Maya 8.5 for x86/uninstall/wininstaller.exe"-uninstall="C:\Program Files\Chaos Group\V-Ray\Maya 8.5 for x86/uninstall/install.log" -uninstallApp="V-Ray for Maya 8.5 for x86"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1}
XfrogTUNE 1.0-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Greenworks\XfrogTUNE 1.0\Uninst.isu"
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG

======Security center information======

AV: Kaspersky Internet Security (outdated)
FW: Kaspersky Internet Security

======System event log======

Computer Name: PRESTAVE-38FE64
Event Code: 7036
Message: Le service HTTP SSL est entré dans l'état : en cours d'exécution.

Record Number: 1775
Source Name: Service Control Manager
Time Written: 20090312092442.000000+000
Event Type: Informations
User: 

Computer Name: PRESTAVE-38FE64
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service HTTP SSL.

Record Number: 1774
Source Name: Service Control Manager
Time Written: 20090312092442.000000+000
Event Type: Informations
User: AUTORITE NT\SERVICE LOCAL

Computer Name: PRESTAVE-38FE64
Event Code: 7036
Message: Le service Hôte de périphérique universel Plug-and-Play est entré dans l'état : en cours d'exécution.

Record Number: 1773
Source Name: Service Control Manager
Time Written: 20090312092406.000000+000
Event Type: Informations
User: 

Computer Name: PRESTAVE-38FE64
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Hôte de périphérique universel Plug-and-Play.

Record Number: 1772
Source Name: Service Control Manager
Time Written: 20090312092404.000000+000
Event Type: Informations
User: PRESTAVE-38FE64\Ma Gnoné

Computer Name: PRESTAVE-38FE64
Event Code: 7036
Message: Le service Service de découvertes SSDP est entré dans l'état : en cours d'exécution.

Record Number: 1771
Source Name: Service Control Manager
Time Written: 20090312092404.000000+000
Event Type: Informations
User: 

=====Application event log=====

Computer Name: PRESTAVE-38FE64
Event Code: 1
Message: 
Record Number: 685
Source Name: Bonjour Service
Time Written: 20090105192601.000000+000
Event Type: Informations
User: 

Computer Name: PRESTAVE-38FE64
Event Code: 105
Message: The service was started.

Record Number: 684
Source Name: ATI Smart
Time Written: 20090105192559.000000+000
Event Type: Informations
User: 

Computer Name: PRESTAVE-38FE64
Event Code: 1517
Message: Windows a sauvegardé le Registre utilisateur PRESTAVE-38FE64\Ma Gnoné alors qu'une application ou un service utilisait toujours le Registre pendant la fermeture de la session. La mémoire utilisée par le Registre de l'utilisateur n'a pas été libérée. le Registre sera déchargé lorsqu'il ne sera plus utilisé. 


Cela est souvent causé par des services s'exécutant en tant que compte d'utilisateur, essayez de configurer les services pour s'exécuter dans le compte service réseau ou service local.

Record Number: 683
Source Name: Userenv
Time Written: 20090105170206.000000+000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PRESTAVE-38FE64
Event Code: 20
Message: 
Record Number: 682
Source Name: Google Update
Time Written: 20090105162942.000000+000
Event Type: erreur
User: PRESTAVE-38FE64\Ma Gnoné

Computer Name: PRESTAVE-38FE64
Event Code: 20
Message: 
Record Number: 681
Source Name: Google Update
Time Written: 20090105152942.000000+000
Event Type: erreur
User: PRESTAVE-38FE64\Ma Gnoné

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SYSTEMROOT%\SYSTEM32;%SYSTEMROOT%;%SYSTEMROOT%\SYSTEM32\WBEM;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\WINDOWS\SYSTEM32;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 76 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=4c02
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"MAYA_MODULE_PATH"=;C:\Program Files\Maya\plugins/conf;C:\Maya\plugins/conf;C:\Maya-demo\plugin/conf
"VRAY_FOR_MAYA85_MAIN_x86"=C:\Maya-demo\plugin
"VRAY_FOR_MAYA85_PLUGINS_x86"=C:\Maya-demo\plugin/vrayplugins
"VRAY_FOR_MAYA2008_MAIN_x86"=C:\Maya\plugins
"VRAY_FOR_MAYA2008_PLUGINS_x86"=C:\Maya\plugins/vrayplugins
"SPM_HOST"=localhost

-----------------EOF-----------------

koloj · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Ma Gnoné at 2009-03-22 17:20:14
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 4 GB (14%) free of 26 GB
Total RAM: 894 MB (63% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS	asks\AB1C984E918B0AD2.job
C:\WINDOWS	asks\GoogleUpdateTaskUserS-1-5-21-1123561945-854245398-839522115-1003.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
Winamp Toolbar Loader - C:\Program Files\Winamp Toolbar\winamptb.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
Click-to-Call BHO - C:\Program Files\Windows Live\Messenger\wlchtc.dll [2009-02-06 73072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}]
EoBho Class - C:\PROGRA~1\EoRezo\EoAdv\EOREZO~1.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A87B991-A31F-4130-AE72-6D0C294BF082}]
DealioBHO Class - C:\Program Files\Dealio\kb127\Dealio.dll [2008-05-26 3170144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-10 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}]
Ask Search Assistant BHO

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-10 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
SearchSettings Class - C:\Program Files\Search Settings\kb127\SearchSettings.dll [2008-06-12 1111904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-10 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]
Ask Toolbar BHO

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - Winamp Toolbar - C:\Program Files\Winamp Toolbar\winamptb.dll []
{ED0E8CA5-42FB-4B18-997B-769E0408E79D} - FreshDownload Bar - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dll []
{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - Dealio - C:\Program Files\Dealio\kb127\Dealio.dll [2008-05-26 3170144]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-01 61440]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"SearchSettings"=C:\Program Files\Search Settings\SearchSettings.exe [2008-06-12 991584]
"1 mags 16 more"=C:\Documents and Settings\All Users.WINDOWS\Application Data\Admin Inter 1 Mags\Math Meow.exe []
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2008-09-23 2879488]
"AzMixerSel"=C:\Program Files\Realtek\InstallShield\AzMixerSel.exe [2008-09-23 53248]
"Ante bags flap that"=C:\Documents and Settings\All Users.WINDOWS\Application Data\kind setup ante bags\Name Ball.exe [2009-03-22 745472]
"au"=C:\Program Files\Dealio\DealioAU.exe [2008-05-26 595296]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-10 136600]
"kcbww"=C:\DOCUME~1\MAGNON~1\LOCALS~1\Temp\service.exe []
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-09-23 16248320]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-09-23 69632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-05 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe [2005-10-28 94208]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]
"SuperCopier2.exe"=C:\Program Files\SuperCopier2\SuperCopier2.exe []
"Google Update"=C:\Documents and Settings\Ma Gnoné\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /c []
"BackWeb LiteInstaller"=C:\DOCUME~1\MAGNON~1\LOCALS~1\Temp\ins1.tmp\LDMClient.exe  /NoIntervention []
"ares"=D:\Ares\Ares.exe -h []
"warn delete"=C:\DOCUME~1\MAGNON~1\APPLIC~1\EXTRAA~1\Storecreative.exe []
"L09EXLRD_2603953"=D:\Microsoft Student con Encarta Premium 2009 DVD\EDICT.EXE -m []
"E09FXLRD_24952140"=D:\Microsoft Encarta 2009 - Collection DVD\EDICT.EXE [2008-05-28 351000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"NT Printing Services6"=C:\WINDOWS\SYSTEM32\dllhosts.exe [2008-12-21 52224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\SYSTEM32\Ati2evxx.dll [2006-04-27 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\SYSTEM32\WgaLogon.dll [2008-09-05 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayaYsrr]
yayaYsrr.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{516B16E3-E30E-4EF3-B8A8-2E70D4743383}"=C:\WINDOWS\system32\yayaYsrr.dll []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork
m.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=1
"NoLogOff"=0
"area51"=5
"NoResolveSearch"=1
"NoRun"=0
"NoFind"=0
"NoSetFolders"=0
"DisallowRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Ares\Ares.exe"="C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows"
"D:\WoW-2.3.0.7561-enUS-downloader.exe"="D:\WoW-2.3.0.7561-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\iMesh Applications\iMesh\iMesh.exe"="C:\Program Files\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh"
"C:\Spn\edt.exe"="C:\Spn\edt.exe:*:Enabled:edt"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"D:\famili album\iMesh.exe"="D:\famili album\iMesh.exe:*:Enabled:iMesh"
"C:\Documents and Settings\Ma Gnoné\Bureau\cs2d_0109\CounterStrike2D.exe"="C:\Documents and Settings\Ma Gnoné\Bureau\cs2d_0109\CounterStrike2D.exe:*:Enabled:CounterStrike2D"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\FlashGet\FlashGet.exe"="C:\Program Files\FlashGet\FlashGet.exe:*:Enabled:Flashget"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Documents and Settings\Ma Gnoné\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll"="C:\Documents and Settings\Ma Gnoné\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin"
"C:\Documents and Settings\Ma Gnoné\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\Ma Gnoné\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"E:\STHIW\STSetup.exe"="E:\STHIW\STSetup.exe:*:Enabled:SpeedTouch Home Install Wizard"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{742752fc-8ee3-11dd-a934-0016d4660c85}]
shell\AUtoplay\command - K:\hawnm.pif
shell\AutoRun\command - K:\hawnm.pif
shell\expLOre\command - K:\hawnm.pif
shell\open\command - K:\hawnm.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94478e56-0334-11de-ab55-0090d0441487}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Hitman.exe
shell\Open\command - K:\Hitman.exe


======File associations======

.reg - open - "regedit.exe" "%1"

======List of files/folders created in the last 1 months======

2009-03-22 17:20:14 ----DC---- C:sit
2009-03-22 17:20:14 ----D---- C:\Program Files	rend micro
2009-03-22 17:09:15 ----AC---- C:\FindyKill.txt
2009-03-22 16:31:19 ----AC---- C:\InfoSat.txt
2009-03-22 16:15:23 ----A---- C:\WINDOWS
tbtlog.txt
2009-03-22 14:11:51 ----D---- C:\Program Files\FindyKill
2009-03-22 13:06:08 ----HD---- C:\Program Files\Uninstall Information
2009-03-21 16:16:04 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\NCH Swift Sound
2009-03-20 21:09:06 ----D---- C:\Program Files\CCleaner
2009-03-20 11:45:02 ----R---- C:\WINDOWS\Alcmtr.exe
2009-03-17 15:23:39 ----A---- C:\WINDOWS\musiceditor.INI
2009-03-17 13:47:30 ----D---- C:\Documents and Settings\Ma Gnoné\Application Data\Deckadance
2009-03-13 19:10:40 ----D---- C:\Program Files\MAGIX
2009-03-12 11:55:01 ----DC---- C:\Temp
2009-03-12 11:28:25 ----A---- C:\WINDOWS\system32\atioglx1.dll
2009-03-11 23:44:58 ----A---- C:\WINDOWS\Robota.INI
2009-03-11 23:44:46 ----D---- C:\Documents and Settings\Ma Gnoné\Application Data\MAGIX
2009-03-11 23:44:15 ----A---- C:\WINDOWS\system32\mpg4c32.dll
2009-03-11 23:41:23 ----A---- C:\WINDOWS\system32\msxml4a.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\TTIC32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\TTI32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\STRING32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\MXRestore.exe
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\mgxcdr.txt
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\mgxasio2.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLTPO32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLRES32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLRD32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLPTL32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLPRJ32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLPRF32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLPNT32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLMSC32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLIX.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLISO32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLIO32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLIMG32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLDRV32.dll
2009-03-11 23:41:21 ----A---- C:\WINDOWS\system32\DLLDIR32.dll
2009-03-11 23:41:20 ----A---- C:\WINDOWS\system32\DLLDEV32.dll
2009-03-11 23:41:20 ----A---- C:\WINDOWS\system32\DLLCPY32.dll
2009-03-11 23:41:20 ----A---- C:\WINDOWS\system32\DLLCDF32.dll
2009-03-11 23:41:20 ----A---- C:\WINDOWS\system32\DLLCDA32.dll
2009-03-11 23:41:20 ----A---- C:\WINDOWS\system32\DLLAV32.dll
2009-03-11 23:40:23 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\MAGIX
2009-03-11 23:39:49 ----A---- C:\WINDOWS\system32\DLLDEV32i.dll
2009-03-11 23:39:19 ----D---- C:\WINDOWS\system32\MAGIX
2009-03-11 23:39:19 ----A---- C:\WINDOWS\system32\mgxoschk.dll
2009-03-11 23:39:19 ----A---- C:\WINDOWS\mgxoschk.ini
2009-03-11 17:15:55 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-03-11 17:15:43 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-03-11 09:53:32 ----SHC---- C:\BOOT.BAK
2009-03-11 09:51:27 ----A---- C:\WINDOWS\UPGRADE.TXT
2009-03-11 09:51:22 ----D---- C:\WINDOWS\setup.pss
2009-03-08 22:18:01 ----D---- C:\Program Files\MixVibes6
2009-03-06 09:25:58 ----D---- C:\WINDOWS\.jagex_cache_32
2009-03-05 00:14:55 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-03-05 00:14:49 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-03-05 00:14:44 ----A---- C:\WINDOWS\imsins.BAK
2009-03-05 00:14:34 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-02-27 21:07:56 ----D---- C:\Documents and Settings\Ma Gnoné\Application Data\Help
2009-02-27 21:04:03 ----AH---- C:\WINDOWS\akebook.ini
2009-02-27 21:04:03 ----AH---- C:\WINDOWS\a3kebook.ini
2009-02-27 21:04:03 ----A---- C:\WINDOWS\ANS2000.INI
2009-02-27 21:03:46 ----D---- C:\Program Files\Viewpoint
2009-02-25 10:46:04 ----A---- C:\WINDOWS\system32\javaws.exe
2009-02-25 10:46:04 ----A---- C:\WINDOWS\system32\javaw.exe
2009-02-25 10:46:04 ----A---- C:\WINDOWS\system32\java.exe

======List of files/folders modified in the last 1 months======

2009-03-22 17:20:14 ----RD---- C:\Program Files
2009-03-22 17:11:57 ----AD---- C:\WINDOWS\system32
2009-03-22 17:11:57 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-03-22 17:09:40 ----D---- C:\Program Files\eMule
2009-03-22 17:09:19 ----D---- C:\WINDOWS\Temp
2009-03-22 17:07:35 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-03-22 16:28:59 ----D---- C:\Program Files\Fichiers communs
2009-03-22 16:20:56 ----HD---- C:\WINDOWS\system32\drivers
2009-03-22 16:15:23 ----SD---- C:\WINDOWS
2009-03-22 15:50:57 ----D---- C:\WINDOWS\Prefetch
2009-03-22 14:34:18 ----D---- C:\Documents and Settings\Ma Gnoné\Application Data\Extra Atom
2009-03-22 13:07:10 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-03-22 13:05:06 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-03-22 13:03:45 ----D---- C:\WINDOWS\system32\CatRoot2
2009-03-21 22:57:42 ----D---- C:\Documents and Settings\Ma Gnoné\Application Data\dvdcss
2009-03-21 22:30:07 ----SHD---- C:\WINDOWS\Installer
2009-03-21 22:19:44 ----HD---- C:\WINDOWS\inf
2009-03-21 11:38:31 ----D---- C:\WINDOWS\system32\CatRoot
2009-03-20 17:05:40 ----A---- C:\WINDOWS\PhotoSnapViewer.INI
2009-03-20 11:44:58 ----D---- C:\WINDOWS\system32\RTCOM
2009-03-20 11:44:16 ----D---- C:\Program Files\Realtek
2009-03-18 17:37:38 ----A---- C:\WINDOWS\NeroDigital.ini
2009-03-17 18:39:54 ----D---- C:\WINDOWS\system32\config
2009-03-17 13:45:30 ----D---- C:\Program Files\Image-Line
2009-03-15 22:11:13 ----D---- C:\Documents and Settings\Ma Gnoné\Application Data\Ahead
2009-03-14 13:05:28 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-03-13 09:52:18 ----D---- C:\Program Files\SuperCopier2
2009-03-13 09:49:56 ----D---- C:\WINDOWS\Minidump
2009-03-13 09:49:43 ----D---- C:\Program Files\WinRAR
2009-03-12 12:04:01 ----A---- C:\WINDOWS\win.ini
2009-03-12 12:04:01 ----A---- C:\WINDOWS\system.ini
2009-03-12 11:55:17 ----A---- C:\WINDOWS\system32\Amv2mtCodec.ini
2009-03-12 11:55:17 ----A---- C:\WINDOWS\system32\Amv2Codec.ini
2009-03-11 23:44:30 ----D---- C:\WINDOWS\Help
2009-03-11 23:42:17 ----RSD---- C:\WINDOWS\Fonts
2009-03-11 10:33:06 ----SD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft
2009-03-11 10:06:23 ----SHC---- C:\boot.ini
2009-03-11 09:03:55 ----HD---- C:\WINDOWS\$hf_mig$
2009-03-09 12:04:33 ----A---- C:\WINDOWS\ModemLog_HDAUDIO Soft Data Fax Modem with SmartCP.txt
2009-03-09 09:05:46 ----DC---- C:\program file
2009-03-08 22:57:49 ----D---- C:\Documents and Settings\Ma Gnoné\Application Data\OpenOffice.org2
2009-03-05 00:15:16 ----D---- C:\WINDOWS\Debug
2009-03-04 10:24:13 ----D---- C:\Documents and Settings
2009-03-03 15:16:34 ----SHDC---- C:\RECYCLER
2009-03-03 12:27:43 ----HD---- C:\Program Files\InstallShield Installation Information
2009-02-27 13:59:49 ----A---- C:\WINDOWS\system32ar.exe
2009-02-25 20:55:00 ----A---- C:\WINDOWS\system32\MRT.exe
2009-02-25 10:46:00 ----D---- C:\Program Files\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Pilote de processeur AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-05-10 43520]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2008-11-04 5632]
R1 StarPortLite;StarPort Storage Controller (Lite); C:\WINDOWS\system32\DRIVERS\StarPortLite.sys [2008-08-20 93544]
R1 WmiAcpi;Interface de gestion Microsoft Windows pour ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832]
R2 CdaC15BA;CdaC15BA; \??\C:\WINDOWS\system32\drivers\CdaC15BA.SYS []
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-10-05 12544]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-04-27 1540096]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-03 14080]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys [2006-01-11 935424]
R3 HSXHWAZL;HSXHWAZL; C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys [2006-01-11 194048]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-09-23 4304384]
R3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-05 67584]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-05 26624]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-05 57600]
R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-05 17024]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys [2006-01-11 671232]
S1 InCDPass;InCDPass; C:\WINDOWS\system32\drivers\InCDPass.sys []
S1 InCDRm;InCD Reader; C:\WINDOWS\system32\drivers\InCDRm.sys []
S2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys []
S3 aj51437j;aj51437j; C:\WINDOWS\system32\drivers\aj51437j.sys []
S3 btaudio;Périphérique audio Bluetooth; C:\WINDOWS\system32\drivers\btaudio.sys []
S3 BTKRNL;Enumérateur de bus Bluetooth; C:\WINDOWS\system32\DRIVERS\btkrnl.sys []
S3 BTWDNDIS;Serveur d'accès au réseau local Bluetooth; C:\WINDOWS\system32\DRIVERS\btwdndis.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys []
S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 NTIDrvr;NTIDrvr; \??\C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\NTIDrvr.sys []
S3 PID_0928;Logitech QuickCam Express(PID_0928); C:\WINDOWS\system32\DRIVERS\LV561AV.SYS []
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 USB_RNDIS;Thomson ST Remote NDIS Device Driver; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-05 12672]
S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 InCDFs;InCD File System; C:\WINDOWS\system32\drivers\InCDFs.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 mchInjDrv;mchInjDrv; C:\WINDOWS\system32\drivers\mchInjDrv.sys []
S4 sr;Pilote de filtre de restauration système; C:\WINDOWS\system32\DRIVERS\sr.sys [2004-08-05 73600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 C-DillaCdaC11BA;C-DillaCdaC11BA; C:\WINDOWS\system32\drivers\CDAC11BA.EXE [2008-09-21 54784]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-10 152984]
R2 StarWindServiceLite;StarWind Service Lite; C:\Program Files\Rocket Division Software\StarWind Lite\StarWindServiceLite.exe [2008-07-04 312320]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-08-20 593920]
S2 btwdins;Bluetooth Service; D:\bin\btwdins.exe []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-12-04 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 Boonty Games;Boonty Games; C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe []
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe []
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-05 14336]
S4 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-04-27 405504]

-----------------EOF-----------------

jlpjlp · Answer

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D. 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt) 

______________________


tu télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 

* Double-clique dessus pour lancer l'installation 
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau 
* Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche) 
* Patiente jusqu'à la fin du scan 
* Poste le rapport généré (C:\lopR.txt)

koloj · Answer

merci de vouloir bien m aider ... grace a vous j ai resolu mon probleme ..
merci.
now..  j ai activer mes mise a jour ..mon antivirus .. et le par_ feu..

jlpjlp · Answer

fais le message 4

Supprimer le virus Beagle/Bagle

6 réponses

Discussions similaires

Newsletters