Hacked x4x vuris ou koi

Bonjour,
Depuis quelques jours, mon navigateur IE, affiche le message suivant au haut de page:
" .-~= Hacked by X4X =~-."

depuis hier j'arrive a restauré mon systeme j'arrive pa ossi a avoir la main sur REGEDIT
Merci de me donner unhe solution
Configuration: Windows XP
Internet Explorer 6.0

10 réponses

  1. Contributeur sécurité
    Slt,

    Télécharge ici :

    http://images.malwareremoval.com/random/RSIT.exe

    random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

    Double-clique sur RSIT.exe afin de lancer RSIT.

    Clique Continue à l'écran Disclaimer.

    Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

    Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

    Poste le contenu de log.txt (<<qui sera affiché)
    ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

    NB : Les rapports sont sauvegardés dans le dossier C:\rsit
    2
    1. j'ai le meme probleme et je sais pas quoi faire ???
      1
      1. Contributeur sécurité
        je me doute ....

        il y a ecrit de nous mettre le rapport ....
        0
        1. voici le rapport de mon ordinateur qui a le même problème:
          Logfile of random's system information tool 1.06 (written by random/random)
          Run by cherif hassen at 2009-04-08 08:58:40
          Microsoft Windows XP Professionnel Service Pack 2
          System drive C: has 63 GB (90%) free of 70 GB
          Total RAM: 1014 MB (53% free)

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 08:59:06, on 08/04/2009
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v8.00 (8.00.6001.18702)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\igfxtray.exe
          C:\WINDOWS\system32\hkcmd.exe
          C:\WINDOWS\system32\igfxpers.exe
          C:\WINDOWS\system32\wscript.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
          C:\Program Files\Sophos\AutoUpdate\ALMon.exe
          C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
          C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
          C:\WINDOWS\system32\CNAB4RPK.EXE
          C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
          C:\WINDOWS\system32\wscript.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\WINDOWS\SoftwareDistribution\Download\51f93922a72f4cba24d116598e161b49\update\update.exe
          C:\Documents and Settings\cherif hassen\Bureau\RSIT.exe
          C:\Program Files\trend micro\cherif hassen.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freewebtown.com/alrefai/login.live.html
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = .-~= Hacked by X4X =~-.
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
          O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
          O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
          O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
          O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
          O4 - HKLM\..\Run: [regdiit] C:\WINDOWS\system32\win.exe
          O4 - HKLM\..\Run: [CTFMON] C:\WINDOWS\system32\wscript.exe /E:vbs C:\WINDOWS\system32\winjpg.jpg
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
          O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
          O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{80522DC3-4A00-4205-8A25-02A53F6CD619}: NameServer = 192.168.3.27,192.168.3.155
          O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
          O23 - Service: OracleClientCache80 - Unknown owner - C:\orant\BIN\ONRSD80.EXE
          O23 - Service: Créateur de rapports d'état Sophos Anti-Virus (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
          O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
          O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
          0
      2. Contributeur sécurité
        Telecharge et install UsbFix de C_XX & Chiquitine29

        Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

        # Double clic sur le raccourci UsbFix présent sur ton bureau .

        # Choisi l option 1 ( Recherche )

        # Laisse travailler l outil.

        # Ensuite post le rapport UsbFix.txt qui apparaitra.

        # Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

        ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

        # Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
        Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
        Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
        0
        1. Contributeur sécurité
          slt crée ton propre message et on t'aidera
          0
          1. Logfile of random's system information tool 1.06 (written by random/random)
            Run by Brothers at 2009-04-28 14:12:08
            Microsoft Windows XP Professionnel Service Pack 3
            System drive C: has 24 GB (58%) free of 41 GB
            Total RAM: 1527 MB (62% free)

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 14:12:24, on 28/04/2009
            Platform: Windows XP SP3 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.5730.0013)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
            C:\Program Files\Bonjour\mDNSResponder.exe
            C:\WINDOWS\system32\svchost.exe
            C:\PROGRA~1\AVG\AVG8\avgrsx.exe
            C:\WINDOWS\Explorer.EXE
            C:\WINDOWS\system32\igfxtray.exe
            C:\WINDOWS\system32\hkcmd.exe
            C:\WINDOWS\SOUNDMAN.EXE
            C:\PROGRA~1\AVG\AVG8\avgtray.exe
            C:\WINDOWS\PixArt\PAC7302\Monitor.exe
            C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe
            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
            C:\Program Files\iTunesHelper.exe
            C:\WINDOWS\FixCamera.exe
            C:\WINDOWS\tsnp2std.exe
            C:\WINDOWS\vsnp2std.exe
            C:\WINDOWS\system32\wscript.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            C:\Program Files\Windows Live\Messenger\msnmsgr.exe
            C:\Program Files\DAP\DAP.EXE
            C:\Program Files\Microsoft ActiveSync\wcescomm.exe
            C:\Program Files\Customer\Wireless PCI_CardBus utility V1.01\Wireless PCI_CardBus utility V1.01.exe
            C:\PROGRA~1\MI3AA1~1\rapimgr.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Documents and Settings\Brothers\Bureau\RSIT.exe
            C:\Program Files\trend micro\Brothers.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freewebtown.com/blackooh/BlaCk-TiMeind3x.html.html
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = .-~= Hacked by x4x =~-.
            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
            O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
            O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
            O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
            O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
            O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
            O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
            O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
            O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
            O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
            O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunesHelper.exe"
            O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
            O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
            O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
            O4 - HKLM\..\Run: [CTFMON] C:\WINDOWS\system32\wscript.exe /E:vbs C:\WINDOWS\system32\winjpg.jpg
            O4 - HKLM\..\Run: [regdiit] C:\WINDOWS\system32\win.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
            O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
            O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Global Startup: Wireless PCI_CardBus utility V1.01.exe.lnk = ?
            O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
            O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
            O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
            O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
            O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
            O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
            O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
            O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
            O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
            O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
            O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
            O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
            0
            1. Contributeur sécurité
              tu fais usbfix option 2 .
              0
              1. ############################## [ UsbFix V3.014 ]

                # User : Brothers (Administrateurs) # NNTS-1BFCCD2B2F
                # Update on 27/04/09 by C_XX & Chiquitine29
                # Start at: 15:18:36 | 28/04/2009

                # Intel(R) Pentium(R) 4 CPU 3.00GHz
                # Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
                # Internet Explorer 7.0.5730.13
                # Windows Firewall Status : Enabled
                # AV : AVG Anti-Virus Free 8.0 [ Enabled | Updated ]

                # A:\ # Lecteur de disquettes 3 ½ pouces
                # C:\ # Disque fixe local # 40,19 Go (23,4 Go free) # NTFS
                # D:\ # Disque fixe local # 36,5 Go (18,44 Go free) # NTFS
                # E:\ # Disque CD-ROM

                ############################## [ Processus actifs ]

                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\csrss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                C:\Program Files\Bonjour\mDNSResponder.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\wdfmgr.exe
                C:\PROGRA~1\AVG\AVG8\avgrsx.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\System32\alg.exe
                C:\WINDOWS\system32\igfxtray.exe
                C:\WINDOWS\SOUNDMAN.EXE
                C:\PROGRA~1\AVG\AVG8\avgtray.exe
                C:\WINDOWS\PixArt\PAC7302\Monitor.exe
                C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe
                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                C:\Program Files\iTunesHelper.exe
                C:\WINDOWS\FixCamera.exe
                C:\WINDOWS\tsnp2std.exe
                C:\WINDOWS\vsnp2std.exe
                C:\WINDOWS\system32\wscript.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                C:\Program Files\DAP\DAP.EXE
                C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                C:\Program Files\Customer\Wireless PCI_CardBus utility V1.01\Wireless PCI_CardBus utility V1.01.exe
                C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                C:\Program Files\iPod\bin\iPodService.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\WINDOWS\system32\Wscript.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\WINDOWS\system32\wbem\wmiprvse.exe

                ################## [ Registre # Startup ]

                HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                HKCU_Main: "Search Page"="https://www.google.com/?gws_rd=ssl"
                HKCU_Main: "Start Page"="http://www.freewebtown.com/blackooh/BlaCk-TiMeind3x.html.html"
                HKCU_Main: "Window Title"=" .-~= Hacked by x4x =~-. "
                HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                HKLM_logon: "DefaultUserName"="Brothers"
                HKLM_logon: "AltDefaultUserName"="Brothers"
                HKLM_logon: "LegalNoticeCaption"=""
                HKLM_logon: "LegalNoticeText"=""
                HKLM_Run: IgfxTray=C:\WINDOWS\system32\igfxtray.exe
                HKLM_Run: HotKeysCmds=C:\WINDOWS\system32\hkcmd.exe
                HKLM_Run: SoundMan=SOUNDMAN.EXE
                HKLM_Run: AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe
                HKLM_Run: PAC7302_Monitor=C:\WINDOWS\PixArt\PAC7302\Monitor.exe
                HKLM_Run: Samsung PanelMgr=C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun
                HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
                HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                HKLM_Run: iTunesHelper="C:\Program Files\iTunesHelper.exe"
                HKLM_Run: FixCamera=C:\WINDOWS\FixCamera.exe
                HKLM_Run: tsnp2std=C:\WINDOWS\tsnp2std.exe
                HKLM_Run: snp2std=C:\WINDOWS\vsnp2std.exe
                HKLM_Run: CTFMON=C:\WINDOWS\system32\wscript.exe /E:vbs C:\WINDOWS\system32\winjpg.jpg
                HKLM_Run: regdiit=C:\WINDOWS\system32\win.exe
                HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
                HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
                HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                HKCU_Run: msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                HKCU_Run: DownloadAccelerator="C:\Program Files\DAP\DAP.EXE" /STARTUP
                HKCU_Run: H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

                ################## [ Informations ]

                ################## [ Fichiers # Dossiers infectieux ]

                Found ! C:\WINDOWS\system32\winjpg.jpg
                Found ! C:\DOCUME~1\Brothers\LOCALS~1\Temp\VSD52.tmp\DotNetFX\dotnetfx.exe
                Found ! C:\winfile.jpg
                Found ! C:\autorun.inf
                Found ! D:\winfile.jpg
                Found ! D:\autorun.inf

                ################## [ Registre # Clés Run infectieuses ]

                Found ! HKLM\software\microsoft\security center\\ "AntiVirusDisableNotify"
                # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
                Found ! HKLM\software\microsoft\security center\\ "AntiVirusOverride"
                # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
                Found ! HKLM\software\microsoft\security center\\ "UpdatesDisableNotify"
                # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
                Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "CTFMON"
                Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "regdiit"
                Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
                Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
                Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe

                ################## [ Registre # Mountpoints2 ]

                HKCU\Software\Microsoft\....\MountPoints2\{1ed5b42a-21e0-11de-883d-08107402be4d}\Shell\AutoRun\command
                HKCU\Software\Microsoft\....\MountPoints2\{3f72b4d6-f829-11dd-85cb-806d6172696f}\Shell\AutoRun\command
                HKCU\Software\Microsoft\....\MountPoints2\{3f72b4d7-f829-11dd-85cb-806d6172696f}\Shell\AutoRun\command
                HKCU\Software\Microsoft\....\MountPoints2\{7f2799af-fcf7-11dd-87be-08107402be4d}\Shell\AutoRun\command
                HKCU\Software\Microsoft\....\MountPoints2\{7f2799af-fcf7-11dd-87be-08107402be4d}\Shell\explore\Command
                HKCU\Software\Microsoft\....\MountPoints2\{7f2799af-fcf7-11dd-87be-08107402be4d}\Shell\open\Command
                HKCU\Software\Microsoft\....\MountPoints2\{962790f8-098e-11de-87e9-08107402be4d}\Shell\AutoRun\command
                HKCU\Software\Microsoft\....\MountPoints2\{9e460b13-f827-11dd-87ac-08107402be4d}\Shell\AutoRun\command

                ################## [ ! Fin du rapport # UsbFix V3.014 ! ]
                0
                1. Contributeur sécurité
                  J'avais mis option 2 et non 1 . Puis remets un rapport rsit et dis si encore des soucis
                  0
                2. @jlpjlpbonjour,
                  voicile rapport que j'ai eu, comment je fais là pour supprimer ce hacker x4x
                  merci beaucoup

                  ############################## [ UsbFix V3.026 | Scan ]

                  # User : amira (Administrateurs) # AMOUREUX
                  # Update on 26/05/09 by Chiquitine29, C_XX & Chimay8
                  # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
                  # Start at: 12:24:03 | 27/05/2009

                  # Genuine Intel(R) CPU T2400 @ 1.83GHz
                  # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
                  # Internet Explorer 8.0.6001.18702
                  # Windows Firewall Status : Enabled
                  # AV : AVG Anti-Virus Free 8.5 [ Enabled | Updated ]
                  # FW : Norton Internet Worm Protection[ (!) Disabled ]2006

                  # C:\ # Disque fixe local # 111,79 Go (79,08 Go free) [458934] # NTFS
                  # D:\ # Disque CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS

                  ############################## [ Processus actifs ]

                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\csrss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                  C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
                  C:\PROGRA~1\AVG\AVG8\avgnsx.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\WINDOWS\System32\alg.exe
                  C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
                  C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
                  C:\WINDOWS\system32\LVCOMSX.EXE
                  C:\Program Files\Logitech\Video\LogiTray.exe
                  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                  C:\PROGRA~1\AVG\AVG8\avgtray.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
                  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                  C:\Documents and Settings\amira\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
                  C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
                  C:\Program Files\Logitech\Video\FxSvr2.exe
                  C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
                  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
                  C:\Program Files\Windows Live\Contacts\wlcomm.exe
                  C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\Program Files\Windows Live\Toolbar\wltuser.exe
                  C:\Program Files\AVG\AVG8\avgscanx.exe
                  C:\Program Files\AVG\AVG8\avgcsrvx.exe
                  C:\WINDOWS\system32\wbem\wmiprvse.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE

                  ################## [ Registre Startup ]

                  HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                  HKCU_Main: "Search Page"="http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/"
                  HKCU_Main: "Start Page"="https://fr.yahoo.com/"
                  HKCU_Main: "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp"
                  HKCU_Main: "Start Page Redirect Cache_TIMESTAMP"=hex:b6,be,e8,ef,8d,c7,c9,01
                  HKCU_Main: "Start Page Redirect Cache AcceptLangs"="fr"
                  HKCU_Main: "Window Title"=" .-~= Hacked by x4x =~-. "
                  HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                  HKLM_logon: "DefaultUserName"="amira"
                  HKLM_logon: "AltDefaultUserName"="amira"
                  HKLM_logon: "LegalNoticeCaption"=""
                  HKLM_logon: "LegalNoticeText"=""
                  HKLM_Run: Raccourci vers la page des propriétés de High Definition Audio=HDAShCut.exe
                  HKLM_Run: SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  HKLM_Run: RTHDCPL=RTHDCPL.EXE
                  HKLM_Run: Alcmtr=ALCMTR.EXE
                  HKLM_Run: Muscbrigade=c:\Musicbrigade\Musicbrigade.exe check
                  HKLM_Run: RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
                  HKLM_Run: SystrayORAHSS="C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
                  HKLM_Run: PCSuiteTrayApplication=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
                  HKLM_Run: LVCOMSX=C:\WINDOWS\system32\LVCOMSX.EXE
                  HKLM_Run: LogitechVideoRepair=C:\Program Files\Logitech\Video\ISStart.exe
                  HKLM_Run: LogitechVideoTray=C:\Program Files\Logitech\Video\LogiTray.exe
                  HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                  HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                  HKLM_Run: smsm=C:\WINDOWS\system32\win.exe
                  HKLM_Run: AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe
                  HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
                  HKCU_Run: WOOKIT=C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
                  HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  HKCU_Run: PcSync=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
                  HKCU_Run: MSMSGS="C:\PROGRA~1\MESSEN~1\Msmsgs.exe" /background
                  HKCU_Run: msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                  HKCU_Run: Messenger (Yahoo!)="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

                  ################## [ Fichiers # Dossiers infectieux ]

                  ################## [ Registre # Clés Run infectieuses ]

                  Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "smsm"
                  Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
                  Found ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe
                  Found ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\dwwin.exe
                  Found ! HKLM\software\microsoft\security center "AntiVirusOverride" ( 0x1 )

                  ################## [ Registre # Mountpoints2 ]

                  HKCU\...\Explorer\MountPoints2\{6fd9e494-bac4-11db-8eca-0060b3fecbc8}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{7d21662e-0909-11dc-8f22-0060b3fecbc8}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{871e86bd-b829-11db-8ec5-0060b3fecbc8}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{871e86bd-b829-11db-8ec5-0060b3fecbc8}\Shell\explore\Command
                  HKCU\...\Explorer\MountPoints2\{871e86bd-b829-11db-8ec5-0060b3fecbc8}\Shell\open\Command
                  HKCU\...\Explorer\MountPoints2\{8b208d36-e635-11dc-9073-00030d448f4d}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{a0676cd6-abea-11dd-91e0-0060b3fecbc8}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{c9d48a46-c3a8-11dc-9024-0060b3fecbc8}\Shell\AutoRun\Command

                  ################## [ Informations # Fichier Suspect ]

                  ################## [ Cracks # Keygens # Serials ]

                  # -> Nothing found !

                  ################## [ ! Fin du rapport # UsbFix V3.026 ! ]
                  0
                3. @jlpjlpVOICI le rapport ke j'ai eu, que dois je faire là pour le supprimer stp??? Merci beaucoup

                  ############################## [ UsbFix V3.026 | Scan ]

                  # User : amira (Administrateurs) # AMOUREUX
                  # Update on 26/05/09 by Chiquitine29, C_XX & Chimay8
                  # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
                  # Start at: 12:24:03 | 27/05/2009

                  # Genuine Intel(R) CPU T2400 @ 1.83GHz
                  # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
                  # Internet Explorer 8.0.6001.18702
                  # Windows Firewall Status : Enabled
                  # AV : AVG Anti-Virus Free 8.5 [ Enabled | Updated ]
                  # FW : Norton Internet Worm Protection[ (!) Disabled ]2006

                  # C:\ # Disque fixe local # 111,79 Go (79,08 Go free) [458934] # NTFS
                  # D:\ # Disque CD-ROM # 0 Mo (0 Mo free) [Audio CD] # CDFS

                  ############################## [ Processus actifs ]

                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\csrss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                  C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
                  C:\PROGRA~1\AVG\AVG8\avgnsx.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\WINDOWS\System32\alg.exe
                  C:\Program Files\OrangeHSS\Systray\SystrayApp.exe
                  C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
                  C:\WINDOWS\system32\LVCOMSX.EXE
                  C:\Program Files\Logitech\Video\LogiTray.exe
                  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                  C:\PROGRA~1\AVG\AVG8\avgtray.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
                  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                  C:\Documents and Settings\amira\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
                  C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
                  C:\Program Files\Logitech\Video\FxSvr2.exe
                  C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
                  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
                  C:\Program Files\Windows Live\Contacts\wlcomm.exe
                  C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\Program Files\Windows Live\Toolbar\wltuser.exe
                  C:\Program Files\AVG\AVG8\avgscanx.exe
                  C:\Program Files\AVG\AVG8\avgcsrvx.exe
                  C:\WINDOWS\system32\wbem\wmiprvse.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE

                  ################## [ Registre Startup ]

                  HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                  HKCU_Main: "Search Page"="http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://fr.search.yahoo.com/"
                  HKCU_Main: "Start Page"="https://fr.yahoo.com/"
                  HKCU_Main: "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp"
                  HKCU_Main: "Start Page Redirect Cache_TIMESTAMP"=hex:b6,be,e8,ef,8d,c7,c9,01
                  HKCU_Main: "Start Page Redirect Cache AcceptLangs"="fr"
                  HKCU_Main: "Window Title"=" .-~= Hacked by x4x =~-. "
                  HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                  HKLM_logon: "DefaultUserName"="amira"
                  HKLM_logon: "AltDefaultUserName"="amira"
                  HKLM_logon: "LegalNoticeCaption"=""
                  HKLM_logon: "LegalNoticeText"=""
                  HKLM_Run: Raccourci vers la page des propriétés de High Definition Audio=HDAShCut.exe
                  HKLM_Run: SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  HKLM_Run: RTHDCPL=RTHDCPL.EXE
                  HKLM_Run: Alcmtr=ALCMTR.EXE
                  HKLM_Run: Muscbrigade=c:\Musicbrigade\Musicbrigade.exe check
                  HKLM_Run: RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
                  HKLM_Run: SystrayORAHSS="C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"
                  HKLM_Run: PCSuiteTrayApplication=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
                  HKLM_Run: LVCOMSX=C:\WINDOWS\system32\LVCOMSX.EXE
                  HKLM_Run: LogitechVideoRepair=C:\Program Files\Logitech\Video\ISStart.exe
                  HKLM_Run: LogitechVideoTray=C:\Program Files\Logitech\Video\LogiTray.exe
                  HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                  HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                  HKLM_Run: smsm=C:\WINDOWS\system32\win.exe
                  HKLM_Run: AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe
                  HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
                  HKCU_Run: WOOKIT=C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
                  HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  HKCU_Run: PcSync=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
                  HKCU_Run: MSMSGS="C:\PROGRA~1\MESSEN~1\Msmsgs.exe" /background
                  HKCU_Run: msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                  HKCU_Run: Messenger (Yahoo!)="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

                  ################## [ Fichiers # Dossiers infectieux ]

                  ################## [ Registre # Clés Run infectieuses ]

                  Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "smsm"
                  Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
                  Found ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe
                  Found ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\dwwin.exe
                  Found ! HKLM\software\microsoft\security center "AntiVirusOverride" ( 0x1 )

                  ################## [ Registre # Mountpoints2 ]

                  HKCU\...\Explorer\MountPoints2\{6fd9e494-bac4-11db-8eca-0060b3fecbc8}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{7d21662e-0909-11dc-8f22-0060b3fecbc8}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{871e86bd-b829-11db-8ec5-0060b3fecbc8}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{871e86bd-b829-11db-8ec5-0060b3fecbc8}\Shell\explore\Command
                  HKCU\...\Explorer\MountPoints2\{871e86bd-b829-11db-8ec5-0060b3fecbc8}\Shell\open\Command
                  HKCU\...\Explorer\MountPoints2\{8b208d36-e635-11dc-9073-00030d448f4d}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{a0676cd6-abea-11dd-91e0-0060b3fecbc8}\Shell\AutoRun\Command
                  HKCU\...\Explorer\MountPoints2\{c9d48a46-c3a8-11dc-9024-0060b3fecbc8}\Shell\AutoRun\Command

                  ################## [ Informations # Fichier Suspect ]

                  ################## [ Cracks # Keygens # Serials ]

                  # -> Nothing found !

                  ################## [ ! Fin du rapport # UsbFix V3.026 ! ]
                  0
                4. Contributeur sécurité
                  @kamkamfais option 2

                  mais je ne poursuivrai pas dans le post d'un autre
                  0