Ordi qui s'éteint tout seul

gwen -  
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
J'ai un ordi windows XP, il a deux ans et depuis peu il s'éteint au bout de 20 min tout seul, et quand je regarde YouTube, il s'éteint au bout e 4min, c'est pénible!!! Je cherche à détetcter s'il y a un virus avec un programme de protection payable par mois auquel j'ai souscrit depuis longtemps, (chez Neuf) mais pas le temps, l'ordi s'éteint avent la fin de l'ananlyse... Pourtant les voyant de batterie et d'alimentation sont OK, qui peut m'aider??
Merci d'avance.
A b
Configuration: Windows XP
Firefox 3.0.8

10 réponses

  1. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    Slt,

    scan avec malwarebyte , fais un scan rapide et colle le rapport obtenu et vire ce qui est trouvé:

    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­

    ______________________

    Télécharge ici :

    http://images.malwareremoval.com/random/RSIT.exe

    random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

    Double-clique sur RSIT.exe afin de lancer RSIT.

    Clique Continue à l'écran Disclaimer.

    Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

    Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

    Poste le contenu de log.txt (<<qui sera affiché)
    ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

    NB : Les rapports sont sauvegardés dans le dossier C:\rsit
    0
    1. Zgwen
       
      Bonjour,
      Hé bien voici le message de Malewarebyte.
      Ensuite, que dois-je faire? Merci à vous!
      0
    2. gwen
       
      Zut, j'ai oublié dans mon élan de joindre le texte MalewareByte, le voici:

      Logfile of random's system information tool 1.06 (written by random/random)
      Run by Gwenaëlle at 2009-04-08 21:40:04
      Microsoft Windows XP Édition familiale Service Pack 3
      System drive C: has 16 GB (21%) free of 76 GB
      Total RAM: 1022 MB (40% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 21:40:22, on 08/04/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16791)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      C:\Program Files\Pack Securite\Common\FSMA32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
      C:\Program Files\Pack Securite\Common\FSMB32.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Pack Securite\Common\FCH32.EXE
      C:\Program Files\Pack Securite\Common\FAMEH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
      C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      C:\WINDOWS\system32\ZoomingHook.exe
      C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
      C:\WINDOWS\system32\TCtrlIOHook.exe
      C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
      C:\Program Files\ltmoh\Ltmoh.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\WINDOWS\system32\TPSBattM.exe
      C:\Program Files\Pack Securite\Common\FSM32.EXE
      C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\dla\tfswctrl.exe
      C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Apoint2K\Apoint.exe
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\DNA\btdna.exe
      C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
      C:\Program Files\Apoint2K\Apntex.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
      C:\Documents and Settings\Gwenaëlle\Bureau\RSIT.exe
      C:\Program Files\trend micro\Gwenaëlle.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
      O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe
      O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
      O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
      O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
      O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
      O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
      O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
      O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
      O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
      O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
      O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
      O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
      O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /S
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
      O17 - HKLM\System\CCS\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O17 - HKLM\System\CS1\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O17 - HKLM\System\CS2\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      0
  2. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    le rapport malwarebyte antimalware?

    _______________

    Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
    https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

    * Lance l'installation du programme en exécutant le fichier téléchargé.
    * Double-clique maintenant sur le raccourci de Toolbar-S&D.
    * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
    * Choisis maintenant l'option 2. Patiente jusqu'à la fin de la recherche.
    * Poste le rapport généré. (C:\TB.txt)

    ________________

    Telecharge et install UsbFix de C_XX & Chiquitine29

    Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir</gras>

    # Double clic sur le raccourci UsbFix présent sur ton bureau .

    # Choisi l option 1 ( Recherche )

    # Laisse travailler l outil.

    # Ensuite post le rapport UsbFix.txt qui apparaitra.

    # Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

    ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

    # Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
    Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
    Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
    0
    1. gwen
       
      Bonjour,
      C'est quoi cette adresse "eric.71 mespage, ect....."? Oui parceque je me méfie, sur ce site une personne m'a déjà planté mon ordi et quand je l'ai réinitialisé je le lui ai dit il m'a répondu "HI Hack et Krak boum Heu!" Là j'ai pas trop apprécié avoir perdu mes modèles de lettre de motivation et quelques photos de familles, mais je ne voudrai pas recommencer, je ne vois pas l'intérêt.J'ai trop de fichier à re mettre au disc dur externe pour faire la manoeuvre et rsiquer de réinitialiser. Désolée de ma méfiance pas très sympa mais je voudrai en savoir plus donc. Merci )
      0
    2. gwen
       
      OK,
      J'ai lancé l'outil, voici les rapport TB....Puis je dois m'occuper de nettoyer tous les USB, c'est ça?
      A bientôt!
      0
    3. gwen
       
      Salut,
      J'ai lancé USBfix pour un disque dur externe, voici le rapport:


      ############################## [ UsbFix V3.006 ]

      # User : Gwenaëlle (Administrateurs) # GWEN
      # Update on 11/04/09 by C_XX & Chiquitine29
      # Start at: 23:00:30 | 10/04/2009

      # Intel(R) Pentium(R) M processor 1.73GHz
      # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
      # Internet Explorer 7.0.5730.13
      # Windows Firewall Status : Enabled
      # AV : Pack Securite Plus 7.00 7.00 [ Enabled | Updated ]
      # FW : Pack Securite Plus 7.00[ Enabled ]7.00

      # C:\ # Disque fixe local # 74,33 Go (15,41 Go free) # NTFS
      # D:\ # Disque CD-ROM
      # E:\ # Disque fixe local # 55,88 Go (30,42 Go free) [SEA_DISC] # FAT32

      ############################## [ Processus actifs ]

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      C:\Program Files\Pack Securite\Common\FSMA32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Pack Securite\Common\FSMB32.EXE
      C:\Program Files\Pack Securite\Common\FCH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
      C:\Program Files\Pack Securite\Common\FAMEH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      C:\WINDOWS\System32\alg.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ZoomingHook.exe
      C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
      C:\WINDOWS\system32\TCtrlIOHook.exe
      C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
      C:\Program Files\ltmoh\Ltmoh.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\WINDOWS\system32\TPSBattM.exe
      C:\Program Files\Pack Securite\Common\FSM32.EXE
      C:\WINDOWS\system32\dla\tfswctrl.exe
      C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Apoint2K\Apoint.exe
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\DNA\btdna.exe
      C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
      C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      C:\Program Files\Apoint2K\Apntex.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Program Files\Azureus\Azureus.exe
      C:\WINDOWS\system32\igfxsrvc.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      ################## [ Registre # Startup ]

      HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
      HKCU_Main: "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
      HKCU_Main: "Start Page"="http://runonce.msn.com/?v=msgrv75"
      HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
      HKLM_logon: "DefaultUserName"="Gwena‰lle"
      HKLM_logon: "AltDefaultUserName"="Gwena‰lle"
      HKLM_logon: "LegalNoticeCaption"=""
      HKLM_logon: "LegalNoticeText"=""
      HKLM_Run: Zooming=ZoomingHook.exe
      HKLM_Run: Tvs=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      HKLM_Run: TPSMain=TPSMain.exe
      HKLM_Run: TPNF=C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      HKLM_Run: TFncKy=TFncKy.exe
      HKLM_Run: TCtryIOHook=TCtrlIOHook.exe
      HKLM_Run: SVPWUTIL=C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
      HKLM_Run: SmoothView=C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
      HKLM_Run: PadTouch=C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      HKLM_Run: NDSTray.exe=NDSTray.exe
      HKLM_Run: LtMoh=C:\Program Files\ltmoh\Ltmoh.exe
      HKLM_Run: HWSetup=C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
      HKLM_Run: HP Software Update=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      HKLM_Run: HP Component Manager="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      HKLM_Run: F-Secure TNB="C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
      HKLM_Run: F-Secure Manager="C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
      HKLM_Run: DXDllRegExe=dxdllreg.exe
      HKLM_Run: dla=C:\WINDOWS\system32\dla\tfswctrl.exe
      HKLM_Run: CeEKEY=C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      HKLM_Run: ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      HKLM_Run: Apoint=C:\Program Files\Apoint2K\Apoint.exe
      HKLM_Run: AGRSMMSG=AGRSMMSG.exe
      HKLM_Run: CFSServ.exe=CFSServ.exe -NoClient
      HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
      HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
      HKCU_Run: BitTorrent DNA="C:\Program Files\DNA\btdna.exe"
      HKCU_Run: updateMgr=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
      HKCU_Run: TOSCDSPD=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      HKCU_Run: SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      HKCU_Run: RegistryMechanic=C:\Program Files\Registry Mechanic\RegMech.exe /S
      HKCU_Run: MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

      ################## [ Informations ]


      ################## [ Fichiers # Dossiers infectieux ]


      ################## [ Registre # Clés infectieuses ]

      # -> Not Found !

      ################## [ Registre # Mountpoint2 ]

      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b76db30-7e5f-11dd-a2d7-00166f85994f}\Shell\AutoRun\command
      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2806ac54-ea42-11dd-a38e-00166f85994f}\Shell\AutoRun\command
      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2806ac54-ea42-11dd-a38e-00166f85994f}\Shell\Auto\Command

      ################## [ ! Fin du rapport # UsbFix V3.006 ! ]

      Oubliez le message concernant cette personne pas sympa qui m'avait mal conseillé!!Bref, je continue avec les clés USB,
      a bientôt!
      0
    4. gwen
       
      Rapport Clés USB,
      ############################## [ UsbFix V3.006 ]

      # User : Gwenaëlle (Administrateurs) # GWEN
      # Update on 11/04/09 by C_XX & Chiquitine29
      # Start at: 23:12:58 | 10/04/2009

      # Intel(R) Pentium(R) M processor 1.73GHz
      # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
      # Internet Explorer 7.0.5730.13
      # Windows Firewall Status : Enabled
      # AV : Pack Securite Plus 7.00 7.00 [ Enabled | Updated ]
      # FW : Pack Securite Plus 7.00[ Enabled ]7.00

      # C:\ # Disque fixe local # 74,33 Go (15,4 Go free) # NTFS
      # D:\ # Disque CD-ROM
      # E:\ # Disque CD-ROM # 4,44 Mo (0 Mo free) [U3 System] # CDFS
      # F:\ # Disque amovible # 948,8 Mo (452,73 Mo free) [EMTEC KEY] # FAT

      ############################## [ Processus actifs ]

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      C:\Program Files\Pack Securite\Common\FSMA32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Pack Securite\Common\FSMB32.EXE
      C:\Program Files\Pack Securite\Common\FCH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
      C:\Program Files\Pack Securite\Common\FAMEH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      C:\WINDOWS\System32\alg.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ZoomingHook.exe
      C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
      C:\WINDOWS\system32\TCtrlIOHook.exe
      C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
      C:\Program Files\ltmoh\Ltmoh.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\WINDOWS\system32\TPSBattM.exe
      C:\Program Files\Pack Securite\Common\FSM32.EXE
      C:\WINDOWS\system32\dla\tfswctrl.exe
      C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Apoint2K\Apoint.exe
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\DNA\btdna.exe
      C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
      C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      C:\Program Files\Apoint2K\Apntex.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Program Files\Azureus\Azureus.exe
      C:\WINDOWS\system32\igfxsrvc.exe
      C:\Documents and Settings\Gwenaëlle\Application Data\U3\0E60C6709031399B\LaunchPad.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      ################## [ Registre # Startup ]

      HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
      HKCU_Main: "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
      HKCU_Main: "Start Page"="http://runonce.msn.com/?v=msgrv75"
      HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
      HKLM_logon: "DefaultUserName"="Gwena‰lle"
      HKLM_logon: "AltDefaultUserName"="Gwena‰lle"
      HKLM_logon: "LegalNoticeCaption"=""
      HKLM_logon: "LegalNoticeText"=""
      HKLM_Run: Zooming=ZoomingHook.exe
      HKLM_Run: Tvs=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      HKLM_Run: TPSMain=TPSMain.exe
      HKLM_Run: TPNF=C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      HKLM_Run: TFncKy=TFncKy.exe
      HKLM_Run: TCtryIOHook=TCtrlIOHook.exe
      HKLM_Run: SVPWUTIL=C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
      HKLM_Run: SmoothView=C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
      HKLM_Run: PadTouch=C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      HKLM_Run: NDSTray.exe=NDSTray.exe
      HKLM_Run: LtMoh=C:\Program Files\ltmoh\Ltmoh.exe
      HKLM_Run: HWSetup=C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
      HKLM_Run: HP Software Update=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      HKLM_Run: HP Component Manager="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      HKLM_Run: F-Secure TNB="C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
      HKLM_Run: F-Secure Manager="C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
      HKLM_Run: DXDllRegExe=dxdllreg.exe
      HKLM_Run: dla=C:\WINDOWS\system32\dla\tfswctrl.exe
      HKLM_Run: CeEKEY=C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      HKLM_Run: ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      HKLM_Run: Apoint=C:\Program Files\Apoint2K\Apoint.exe
      HKLM_Run: AGRSMMSG=AGRSMMSG.exe
      HKLM_Run: CFSServ.exe=CFSServ.exe -NoClient
      HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
      HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
      HKCU_Run: BitTorrent DNA="C:\Program Files\DNA\btdna.exe"
      HKCU_Run: updateMgr=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
      HKCU_Run: TOSCDSPD=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      HKCU_Run: SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      HKCU_Run: RegistryMechanic=C:\Program Files\Registry Mechanic\RegMech.exe /S
      HKCU_Run: MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

      ################## [ Informations ]

      # Contenu de l'autorun E:\autorun.inf
      [AutoRun]
      open=LaunchU3.exe -a
      icon=LaunchU3.exe,0

      [Definitions]
      Launchpad=LaunchPad.exe
      Vtype=2

      [CopyFiles]
      FileNumber=1
      File1=LaunchPad.zip

      [Update]
      URL=


      ################## [ Fichiers # Dossiers infectieux ]

      Found ! E:\autorun.inf

      ################## [ Registre # Clés infectieuses ]

      # -> Not Found !

      ################## [ Registre # Mountpoint2 ]

      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b76db30-7e5f-11dd-a2d7-00166f85994f}\Shell\AutoRun\command
      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2806ac54-ea42-11dd-a38e-00166f85994f}\Shell\AutoRun\command
      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2806ac54-ea42-11dd-a38e-00166f85994f}\Shell\Auto\Command

      ################## [ ! Fin du rapport # UsbFix V3.006 ! ]

      J'espère que j'ai tout bien fait, A bientôt!
      0
  3. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir</gras>

    # Double clic sur le raccourci UsbFix présent sur ton bureau

    # choisi l option 2 ( Suppression )

    # Ton bureau disparaitra et le pc redémarrera .

    # Au redémarrage , UsbFix scannera ton pc , laisse travailler l outil.

    # Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

    # Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

    ( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

    __________________________

    colle le rapport d'un scan en ligne
    avec un des suivants:

    bitdefender en ligne :
    http://www.bitdefender.fr/scan_fr/scan8/ie.html

    Panda en ligne :
    http://pandasoftware.fr

    Kaspersky en ligne
    https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
    0
    1. gwen
       
      Bonjour,
      J'ai fait analysé le PC et les disque dur externes, il me reste une clés USB, mais je ne comprends pas où et comment envoyer le rapport USBFix.txt, sur le site BitDefender il n'ya rien. ALors voici le Usb Fix.txt...J'attends des nouvelles!


      ############################## [ UsbFix V3.006 ]

      # User : Gwenaëlle (Administrateurs) # GWEN
      # Update on 11/04/09 by C_XX & Chiquitine29
      # Start at: 23:00:30 | 10/04/2009

      # Intel(R) Pentium(R) M processor 1.73GHz
      # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
      # Internet Explorer 7.0.5730.13
      # Windows Firewall Status : Enabled
      # AV : Pack Securite Plus 7.00 7.00 [ Enabled | Updated ]
      # FW : Pack Securite Plus 7.00[ Enabled ]7.00

      # C:\ # Disque fixe local # 74,33 Go (15,41 Go free) # NTFS
      # D:\ # Disque CD-ROM
      # E:\ # Disque fixe local # 55,88 Go (30,42 Go free) [SEA_DISC] # FAT32

      ############################## [ Processus actifs ]

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      C:\Program Files\Pack Securite\Common\FSMA32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Pack Securite\Common\FSMB32.EXE
      C:\Program Files\Pack Securite\Common\FCH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
      C:\Program Files\Pack Securite\Common\FAMEH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      C:\WINDOWS\System32\alg.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ZoomingHook.exe
      C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
      C:\WINDOWS\system32\TCtrlIOHook.exe
      C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
      C:\Program Files\ltmoh\Ltmoh.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\WINDOWS\system32\TPSBattM.exe
      C:\Program Files\Pack Securite\Common\FSM32.EXE
      C:\WINDOWS\system32\dla\tfswctrl.exe
      C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Apoint2K\Apoint.exe
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\DNA\btdna.exe
      C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
      C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      C:\Program Files\Apoint2K\Apntex.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Program Files\Azureus\Azureus.exe
      C:\WINDOWS\system32\igfxsrvc.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      ################## [ Registre # Startup ]

      HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
      HKCU_Main: "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
      HKCU_Main: "Start Page"="http://runonce.msn.com/?v=msgrv75"
      HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
      HKLM_logon: "DefaultUserName"="Gwena‰lle"
      HKLM_logon: "AltDefaultUserName"="Gwena‰lle"
      HKLM_logon: "LegalNoticeCaption"=""
      HKLM_logon: "LegalNoticeText"=""
      HKLM_Run: Zooming=ZoomingHook.exe
      HKLM_Run: Tvs=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      HKLM_Run: TPSMain=TPSMain.exe
      HKLM_Run: TPNF=C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      HKLM_Run: TFncKy=TFncKy.exe
      HKLM_Run: TCtryIOHook=TCtrlIOHook.exe
      HKLM_Run: SVPWUTIL=C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
      HKLM_Run: SmoothView=C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
      HKLM_Run: PadTouch=C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      HKLM_Run: NDSTray.exe=NDSTray.exe
      HKLM_Run: LtMoh=C:\Program Files\ltmoh\Ltmoh.exe
      HKLM_Run: HWSetup=C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
      HKLM_Run: HP Software Update=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      HKLM_Run: HP Component Manager="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      HKLM_Run: F-Secure TNB="C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
      HKLM_Run: F-Secure Manager="C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
      HKLM_Run: DXDllRegExe=dxdllreg.exe
      HKLM_Run: dla=C:\WINDOWS\system32\dla\tfswctrl.exe
      HKLM_Run: CeEKEY=C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      HKLM_Run: ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      HKLM_Run: Apoint=C:\Program Files\Apoint2K\Apoint.exe
      HKLM_Run: AGRSMMSG=AGRSMMSG.exe
      HKLM_Run: CFSServ.exe=CFSServ.exe -NoClient
      HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
      HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
      HKCU_Run: BitTorrent DNA="C:\Program Files\DNA\btdna.exe"
      HKCU_Run: updateMgr=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
      HKCU_Run: TOSCDSPD=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      HKCU_Run: SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      HKCU_Run: RegistryMechanic=C:\Program Files\Registry Mechanic\RegMech.exe /S
      HKCU_Run: MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

      ################## [ Informations ]


      ################## [ Fichiers # Dossiers infectieux ]


      ################## [ Registre # Clés infectieuses ]

      # -> Not Found !

      ################## [ Registre # Mountpoint2 ]

      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b76db30-7e5f-11dd-a2d7-00166f85994f}\Shell\AutoRun\command
      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2806ac54-ea42-11dd-a38e-00166f85994f}\Shell\AutoRun\command
      Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2806ac54-ea42-11dd-a38e-00166f85994f}\Shell\Auto\Command

      ################## [ ! Fin du rapport # UsbFix V3.006 ! ]

      A bientôt!
      0
  4. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    j'avais mis option 2 pour usbfix!
    0
    1. gwen
       
      Oui j'ai fait option 2, mais le rapport est celui là il me semble. La conclusion de l'analnyse ensuite est "pas de virus détecté", dois-je continuer avec les autres clés USB?
      0
  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    pour usbfix il faut avant brancher toutes tes clés usb puis seulement ensuite tu fais usbfix option 2

    : vire usbfix puis mets la derniere version ici
    http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe UsbFix

    et recommence

    et

    si il y a des infections ici

    ################## [ Registre # Mountpoint2 ]

    Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b76db30-7e5f-11dd-a2d7-00166f85994f}\Shell\AutoRun\command
    Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2806ac54-ea42-11dd-a38e-00166f85994f}\Shell\AutoRun\command
    Found ! HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2806ac54-ea42-11dd-a38e-00166f85994f}\Shell\Auto\Command

    ______________________________

    a plus
    0
    1. gwen
       
      Bonjour,
      je ne comprends pas, j'ai rescanner mon ordi avec le disque dur externe branché avant Usbfix nouvelle version, etc'est comme si le disque dur externe n'était pas repéré, car le logiciel me demande de brancher les clés usb, ect.....Alors je mets option 2, suppression, mais à la fin au redémarrage j'ai encore un rapport, qui est-ce qui y comprend qlqchose?

      Au cas où, le rapport d'ojourd'hui.


      ############################## [ UsbFix V3.010 ]

      # User : Gwenaëlle (Administrateurs) # GWEN
      # Update on 19/04/09 by C_XX & Chiquitine29
      # Start at: 19:31:52 | 22/04/2009
      # Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

      # Intel(R) Pentium(R) M processor 1.73GHz
      # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
      # Internet Explorer 8.0.6001.18702
      # Windows Firewall Status : Disabled
      # AV : Antivirus BitDefender 12.0 [ Enabled | Updated ]
      # AV : Pack Securite Plus 7.00 7.00 [ Enabled | Updated ]
      # FW : Pack Securite Plus 7.00[ Enabled ]7.00
      # FW : Pare-feu BitDefender [ Enabled ]12.0

      # C:\ # Disque fixe local # 74,33 Go (14,3 Go free) # NTFS
      # D:\ # Disque CD-ROM # 1,13 Go (0 Mo free) [090118_2315] # UDF

      ############################## [ Processus actifs ]

      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
      C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\logonui.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      C:\Program Files\Pack Securite\Common\FSMA32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
      C:\WINDOWS\system32\HPZipm12.exe
      C:\Program Files\Pack Securite\Common\FSMB32.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Pack Securite\Common\FCH32.EXE
      C:\Program Files\Pack Securite\Common\FAMEH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
      C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      C:\WINDOWS\System32\alg.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\userinit.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\wbem\wmiprvse.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      ################## [ Fichiers # Dossiers infectieux ]


      ################## [ Registre # Clés Run infectieuses ]

      # -> Not Found !

      ################## [ Registre # Startup ]

      HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
      HKCU_Main: "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
      HKCU_Main: "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
      HKCU_Main: "Window Title"=""
      HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
      HKLM_logon: "AltDefaultUserName"="Gwena‰lle"
      HKLM_logon: "DefaultUserName"=""
      HKLM_logon: "LegalNoticeCaption"=""
      HKLM_logon: "LegalNoticeText"=""
      HKLM_Run: Zooming=ZoomingHook.exe
      HKLM_Run: Tvs=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      HKLM_Run: TPSMain=TPSMain.exe
      HKLM_Run: TPNF=C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      HKLM_Run: TFncKy=TFncKy.exe
      HKLM_Run: TCtryIOHook=TCtrlIOHook.exe
      HKLM_Run: SVPWUTIL=C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
      HKLM_Run: SmoothView=C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
      HKLM_Run: PadTouch=C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      HKLM_Run: NDSTray.exe=NDSTray.exe
      HKLM_Run: LtMoh=C:\Program Files\ltmoh\Ltmoh.exe
      HKLM_Run: HWSetup=C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
      HKLM_Run: HP Software Update=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      HKLM_Run: HP Component Manager="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      HKLM_Run: F-Secure TNB="C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
      HKLM_Run: F-Secure Manager="C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
      HKLM_Run: DXDllRegExe=dxdllreg.exe
      HKLM_Run: dla=C:\WINDOWS\system32\dla\tfswctrl.exe
      HKLM_Run: CeEKEY=C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      HKLM_Run: ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      HKLM_Run: Apoint=C:\Program Files\Apoint2K\Apoint.exe
      HKLM_Run: AGRSMMSG=AGRSMMSG.exe
      HKLM_Run: CFSServ.exe=CFSServ.exe -NoClient
      HKLM_Run: BDAgent="C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
      HKLM_Run: BitDefender Antiphishing Helper="C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
      HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
      HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
      HKCU_Run: BitTorrent DNA="C:\Program Files\DNA\btdna.exe"
      HKCU_Run: updateMgr=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
      HKCU_Run: TOSCDSPD=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      HKCU_Run: SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      HKCU_Run: RegistryMechanic=C:\Program Files\Registry Mechanic\RegMech.exe /S
      HKCU_Run: MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

      ################## [ Registre # Mountpoints2 ]

      # -> Not Found !

      ################## [ Listing des fichiers présent ]

      C:\AUTOEXEC.BAT
      C:\NTDETECT.COM
      C:\boot.ini

      ################## [ Vaccination ]

      # C:\autorun.inf -> Folder created by UsbFix.

      ################## [ ! Fin du rapport # UsbFix V3.010 ! ]
      0
  7. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    remets un rapport rsit pour verifier et dis tes souci actuels
    0
    1. gwen
       
      Pardon, je ne sais pas ce que veut dire "remet un rapport rsit", j'ai mis un rapport de usbfix, mon ordi est mal en point, internet va très doucement et j'ai peur que peu à peu des fenêtres intempestives s'ouvrent et qu'il plante. Je pense que mon disque dur externe est infecté mais pourquoi je n'arrive pas à le désinfecter avec Usbfix?
      0
  8. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    Télécharge ici :

    http://images.malwareremoval.com/random/RSIT.exe

    random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

    Double-clique sur RSIT.exe afin de lancer RSIT.

    Clique Continue à l'écran Disclaimer.

    Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

    Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

    Poste le contenu de log.txt (<<qui sera affiché)
    ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

    NB : Les rapports sont sauvegardés dans le dossier C:\rsit
    0
    1. gwen
       
      Salut,
      Voici le rapport de Log.txt, mais je ne sais pas où est le rapport info.txt.Est-ce que cela suffit?
      Que fais-je avec le logiciel Bitdefender? Hier je n'avait mêmeplus accès à Yhaoo.....Pffff.
      Pourvu que je sorte mon ordi de là!!Merci de m'aider, help!

      Logfile of random's system information tool 1.06 (written by random/random)
      Run by Gwenaëlle at 2009-04-27 22:18:57
      Microsoft Windows XP Édition familiale Service Pack 3
      System drive C: has 15 GB (20%) free of 76 GB
      Total RAM: 1022 MB (26% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 22:19:33, on 27/04/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      C:\Program Files\Pack Securite\Common\FSMA32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
      C:\Program Files\Pack Securite\Common\FSMB32.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Pack Securite\Common\FCH32.EXE
      C:\Program Files\Pack Securite\Common\FAMEH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
      C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ZoomingHook.exe
      C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
      C:\WINDOWS\system32\TCtrlIOHook.exe
      C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
      C:\Program Files\ltmoh\Ltmoh.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Pack Securite\Common\FSM32.EXE
      C:\WINDOWS\system32\dla\tfswctrl.exe
      C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Apoint2K\Apoint.exe
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
      C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\DNA\btdna.exe
      C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\Program Files\Apoint2K\Apntex.exe
      C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
      C:\WINDOWS\system32\TPSBattM.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Pack Securite\FSGUI\fsavgui.exe
      C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
      C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Documents and Settings\Gwenaëlle\Bureau\RSIT.exe
      C:\Program Files\trend micro\Gwenaëlle.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
      O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe
      O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
      O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
      O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
      O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
      O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
      O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
      O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
      O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
      O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
      O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
      O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
      O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
      O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
      O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /S
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
      O17 - HKLM\System\CCS\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O17 - HKLM\System\CS1\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O17 - HKLM\System\CS2\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
      0
    2. gwen
       
      RE, au cas où mieux vaut deux fois qu'une: Rappport, merci!!!!!!Salut,
      Voici le rapport de Log.txt, mais je ne sais pas où est le rapport info.txt.Est-ce que cela suffit?
      Que fais-je avec le logiciel Bitdefender? Hier je n'avait mêmeplus accès à Yhaoo.....Pffff.
      Pourvu que je sorte mon ordi de là!!Merci de m'aider, help!

      Logfile of random's system information tool 1.06 (written by random/random)
      Run by Gwenaëlle at 2009-04-27 22:18:57
      Microsoft Windows XP Édition familiale Service Pack 3
      System drive C: has 15 GB (20%) free of 76 GB
      Total RAM: 1022 MB (26% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 22:19:33, on 27/04/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      C:\Program Files\Pack Securite\Common\FSMA32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\FSGK32.EXE
      C:\Program Files\Pack Securite\Common\FSMB32.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Pack Securite\Common\FCH32.EXE
      C:\Program Files\Pack Securite\Common\FAMEH32.EXE
      C:\Program Files\Pack Securite\Anti-Virus\fsqh.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      C:\Program Files\Pack Securite\Anti-Virus\fssm32.exe
      C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      C:\Program Files\Pack Securite\FSAUA\program\fsus.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Pack Securite\Anti-Virus\fsav32.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ZoomingHook.exe
      C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
      C:\WINDOWS\system32\TCtrlIOHook.exe
      C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
      C:\Program Files\ltmoh\Ltmoh.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
      C:\Program Files\Pack Securite\Common\FSM32.EXE
      C:\WINDOWS\system32\dla\tfswctrl.exe
      C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
      C:\Program Files\Apoint2K\Apoint.exe
      C:\WINDOWS\AGRSMMSG.exe
      C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
      C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\DNA\btdna.exe
      C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\Program Files\Apoint2K\Apntex.exe
      C:\Program Files\Pack Securite\FSGUI\fsguidll.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
      C:\WINDOWS\system32\TPSBattM.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Pack Securite\FSGUI\fsavgui.exe
      C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
      C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Documents and Settings\Gwenaëlle\Bureau\RSIT.exe
      C:\Program Files\trend micro\Gwenaëlle.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
      O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe
      O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
      O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
      O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
      O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe
      O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
      O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
      O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
      O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
      O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Pack Securite\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
      O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
      O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
      O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
      O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
      O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
      O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
      O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
      O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
      O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /S
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
      O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
      O17 - HKLM\System\CCS\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O17 - HKLM\System\CS1\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O17 - HKLM\System\CS2\Services\Tcpip\..\{17786E22-0062-45BF-A068-27EA32F40F8F}: NameServer = 86.64.145.140,84.103.237.140
      O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
      O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe
      O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe
      O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe
      O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Pack Securite\Common\FSMA32.EXE
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

      --
      End of file - 12966 bytes

      ======Scheduled tasks folder======

      C:\WINDOWS\tasks\AppleSoftwareUpdate.job
      C:\WINDOWS\tasks\Scheduled scanning task.job
      C:\WINDOWS\tasks\Symantec NetDetect.job
      C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job

      ======Registry dump======

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
      Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
      Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
      RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-10-03 308832]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
      Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
      DriveLetterAccess - C:\WINDOWS\system32\dla\tfswshx.dll [2005-05-31 118844]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
      Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
      Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2008-11-20 251504]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
      Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 544032]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]
      {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 544032]
      {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll [2009-03-24 95536]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
      "Zooming"=C:\WINDOWS\system32\ZoomingHook.exe [2005-06-06 24576]
      "Tvs"=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe [2005-04-05 73728]
      "TPSMain"=C:\WINDOWS\system32\TPSMain.exe [2005-08-12 266240]
      "TPNF"=C:\Program Files\TOSHIBA\TouchPad\TPTray.exe [2005-08-25 53248]
      "TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2008-10-03 185872]
      "TFncKy"=TFncKy.exe []
      "TCtryIOHook"=C:\WINDOWS\system32\TCtrlIOHook.exe [2005-08-22 28672]
      "SVPWUTIL"=C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe [2004-05-01 65536]
      "SmoothView"=C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe [2005-05-17 118784]
      "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-02-16 282624]
      "PadTouch"=C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe [2005-08-30 1077328]
      "NDSTray.exe"=NDSTray.exe []
      "LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2003-09-06 184320]
      "HWSetup"=C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe [2004-05-01 28672]
      "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
      "HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-12-22 241664]
      "F-Secure TNB"=C:\Program Files\Pack Securite\FSGUI\TNBUtil.exe [2007-04-26 740208]
      "F-Secure Manager"=C:\Program Files\Pack Securite\Common\FSM32.EXE [2007-04-26 183208]
      "DXDllRegExe"=dxdllreg.exe []
      "dla"=C:\WINDOWS\system32\dla\tfswctrl.exe [2005-05-31 122941]
      "CeEKEY"=C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe [2005-09-06 671744]
      "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-08-05 344064]
      "Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2004-03-24 196608]
      "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2004-12-22 88358]
      "CFSServ.exe"=CFSServ.exe -NoClient []
      "BDAgent"=C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe [2009-04-16 778240]
      "BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe [2009-02-23 69632]

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
      "BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2008-12-15 342848]
      "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]
      "TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2005-04-11 65536]
      "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]
      "RegistryMechanic"=C:\Program Files\Registry Mechanic\RegMech.exe /S []
      "MsnMsgr"=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]

      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
      Démarrage rapide de HP Photosmart Premier.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
      HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

      C:\Documents and Settings\Gwenaëlle\Menu Démarrer\Programmes\Démarrage
      Lancement rapide de Microsoft Office OneNote 2003.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
      C:\WINDOWS\system32\Ati2evxx.dll [2005-08-04 46080]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
      C:\WINDOWS\system32\igfxdev.dll [2005-07-19 135168]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
      WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
      "dontdisplaylastusername"=0
      "legalnoticecaption"=
      "legalnoticetext"=
      "shutdownwithoutlogon"=1
      "undockwithoutlogon"=1

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "NoDriveTypeAutoRun"=36
      "NoDriveAutoRun"=FFFFFFFF
      "NoDrives"=0
      "NoViewContextMenu"=0
      "NoWinKeys"=0

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "HonorAutoRunSetting"=
      "NoLogOff"=

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
      "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
      "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
      "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
      "C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
      "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
      "C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Disabled:Azureus"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
      "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
      "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

      ======List of files/folders created in the last 1 months======

      2009-04-22 19:33:34 ----RASHD---- C:\autorun.inf
      2009-04-16 18:10:26 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
      2009-04-16 18:10:10 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
      2009-04-16 18:09:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
      2009-04-16 18:09:22 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
      2009-04-16 18:09:11 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
      2009-04-16 18:08:54 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
      2009-04-15 16:50:53 ----D---- C:\WINDOWS\ie8updates
      2009-04-15 16:49:41 ----A---- C:\WINDOWS\imsins.BAK
      2009-04-15 16:45:12 ----HDC---- C:\WINDOWS\ie8
      2009-04-13 15:29:36 ----D---- C:\Documents and Settings\Gwenaëlle\Application Data\BitDefender
      2009-04-13 15:27:36 ----D---- C:\Program Files\BitDefender
      2009-04-13 15:27:36 ----D---- C:\Documents and Settings\All Users\Application Data\BitDefender
      2009-04-13 15:23:41 ----D---- C:\Program Files\Fichiers communs\BitDefender
      2009-04-10 22:47:37 ----D---- C:\UsbFix
      2009-04-10 22:41:03 ----A---- C:\TB.txt
      2009-04-09 22:55:08 ----D---- C:\ToolBar SD
      2009-04-08 20:53:44 ----D---- C:\Documents and Settings\Gwenaëlle\Application Data\Malwarebytes
      2009-04-08 20:53:35 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
      2009-04-08 20:53:34 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
      2009-04-08 20:49:31 ----D---- C:\Program Files\trend micro
      2009-04-08 20:49:26 ----D---- C:\rsit

      ======List of files/folders modified in the last 1 months======

      2009-04-27 22:19:33 ----D---- C:\WINDOWS\Temp
      2009-04-27 22:19:20 ----D---- C:\WINDOWS\Prefetch
      2009-04-27 22:17:52 ----D---- C:\Program Files\Mozilla Firefox
      2009-04-27 22:17:29 ----D---- C:\WINDOWS\system32
      2009-04-27 22:14:20 ----D---- C:\Documents and Settings\Gwenaëlle\Application Data\DNA
      2009-04-27 22:07:18 ----D---- C:\WINDOWS
      2009-04-27 22:04:14 ----D---- C:\Program Files\DNA
      2009-04-27 21:51:00 ----A---- C:\WINDOWS\SchedLgU.Txt
      2009-04-27 21:44:58 ----D---- C:\WINDOWS\system32\CatRoot2
      2009-04-27 21:44:37 ----A---- C:\WINDOWS\ModemLog_TOSHIBA Software Modem.txt
      2009-04-25 23:22:53 ----SD---- C:\WINDOWS\Tasks
      2009-04-23 20:37:42 ----D---- C:\Program Files\Mozilla Thunderbird
      2009-04-16 21:15:59 ----D---- C:\WINDOWS\system32\wbem
      2009-04-16 21:15:59 ----D---- C:\WINDOWS\AppPatch
      2009-04-16 18:10:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
      2009-04-16 18:10:33 ----HD---- C:\WINDOWS\inf
      2009-04-16 18:10:30 ----RSHDC---- C:\WINDOWS\system32\dllcache
      2009-04-16 18:09:35 ----HD---- C:\WINDOWS\$hf_mig$
      2009-04-15 16:55:36 ----D---- C:\WINDOWS\system32\fr-fr
      2009-04-15 16:55:35 ----D---- C:\WINDOWS\Media
      2009-04-15 16:55:35 ----D---- C:\WINDOWS\Help
      2009-04-15 16:55:35 ----D---- C:\Program Files\Internet Explorer
      2009-04-15 16:36:26 ----D---- C:\WINDOWS\Debug
      2009-04-13 15:32:59 ----HD---- C:\Config.Msi
      2009-04-13 15:31:01 ----SHD---- C:\WINDOWS\Installer
      2009-04-13 15:29:54 ----D---- C:\WINDOWS\system32\drivers
      2009-04-13 15:27:36 ----RD---- C:\Program Files
      2009-04-13 15:23:41 ----D---- C:\Program Files\Fichiers communs
      2009-04-11 00:16:18 ----D---- C:\Documents and Settings\Gwenaëlle\Application Data\Azureus
      2009-04-10 23:12:18 ----D---- C:\Documents and Settings\Gwenaëlle\Application Data\U3
      2009-04-06 07:57:26 ----A---- C:\WINDOWS\system32\MRT.exe
      2009-04-05 13:43:52 ----SHD---- C:\RECYCLER
      2009-04-05 13:37:22 ----A---- C:\WINDOWS\cdplayer.ini
      2009-04-04 23:14:44 ----D---- C:\Program Files\Registry Mechanic
      2009-04-04 22:04:56 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP

      ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2008-09-20 43672]
      R1 bdftdif;bdftdif; \??\C:\Program Files\Fichiers communs\BitDefender\BitDefender Firewall\bdftdif.sys []
      R1 F-Secure HIPS;F-Secure HIPS; \??\C:\Program Files\Pack Securite\HIPS\fshs.sys []
      R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
      R1 SrvcSSIOMngr;SrvcSSIOMngr; C:\WINDOWS\System32\Drivers\SSIoMngr.sys [2004-07-30 6400]
      R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2005-05-13 5627]
      R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2005-05-13 23545]
      R1 TPwSav;Common Driver; C:\WINDOWS\System32\Drivers\TPwSav.sys [2005-06-03 9600]
      R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
      R2 BDVEDISK;BDVEDISK; \??\C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys []
      R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2005-04-21 40544]
      R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
      R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2005-05-31 25725]
      R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2005-05-31 34845]
      R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2005-05-31 4125]
      R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2005-05-31 2273]
      R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2005-05-31 86876]
      R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2005-05-31 15069]
      R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2005-05-31 6365]
      R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2005-05-31 98716]
      R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2005-05-31 100605]
      R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2005-03-05 1066278]
      R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-06-21 2324480]
      R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2004-11-16 101874]
      R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
      R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
      R3 bdfm;BDFM; C:\WINDOWS\system32\drivers\bdfm.sys [2008-09-18 111112]
      R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2009-02-12 104328]
      R3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2008-12-10 242184]
      R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys []
      R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
      R3 F-Secure Gatekeeper;F-Secure Gatekeeper; \??\C:\Program Files\Pack Securite\Anti-Virus\minifilter\fsgk.sys []
      R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-10 21060]
      R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
      R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2008-09-23 47360]
      R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
      R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-03-04 74496]
      R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
      R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-06-23 162176]
      R3 Tvs;Toshiba Virtual Sound with SRS technologies; C:\WINDOWS\system32\DRIVERS\Tvs.sys [2005-07-29 30592]
      R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
      R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
      R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
      R3 w29n51;Pilote de carte de connexion réseau Intel(R) PRO/Wireless 2200BG pour Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2005-04-30 3281408]
      S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
      S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
      S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
      S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-07-19 1049180]
      S3 Profos;Profos; \??\C:\Program Files\Fichiers communs\BitDefender\BitDefender Threat Scanner\profos.sys []
      S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
      S3 sffdisk;Pilote de classe de stockage SFF; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
      S3 sffp_sd;Pilote de protocole de stockage SFF pour SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
      S3 tosrfec;Bluetooth ACPI from TOSHIBA; C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-03-24 8192]
      S3 Trufos;Trufos; \??\C:\Program Files\Fichiers communs\BitDefender\BitDefender Threat Scanner\trufos.sys []
      S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
      S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
      S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
      S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
      S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
      S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
      S4 F-Secure Filter;F-Secure File System Filter; \??\C:\Program Files\Pack Securite\Anti-Virus\Win2K\FSfilter.sys []
      S4 F-Secure Recognizer;F-Secure File System Recognizer; \??\C:\Program Files\Pack Securite\Anti-Virus\Win2K\FSrec.sys []

      ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
      R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-18 40960]
      R2 F-Secure Gatekeeper Handler Starter;FSGKHS; C:\Program Files\Pack Securite\Anti-Virus\fsgk32st.exe [2007-04-26 48072]
      R2 FSMA;F-Secure Management Agent; C:\Program Files\Pack Securite\Common\FSMA32.EXE [2007-04-26 113576]
      R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe [2009-03-24 415024]
      R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe [2009-03-27 1626112]
      R3 FSAUA;F-Secure Automatic Update Agent; C:\Program Files\Pack Securite\FSAUA\program\fsaua.exe [2007-04-26 457584]
      R3 FSDFWD;F-Secure Anti-Virus Firewall Daemon; C:\Program Files\Pack Securite\FWES\Program\fsdfwd.exe [2007-04-26 453488]
      S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800]
      S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
      S3 Arrakis3;BitDefender Arrakis Server; C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2009-01-20 172032]
      S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
      S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 137200]
      S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
      S3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
      S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
      S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
      S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
      S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

      -----------------EOF-----------------
      Ah au fait,le logiciel Hijack this était bien installé, SOS je ne veux pas réinitialiser mon ordi!!!!!!
      ______________________________________________________
      0
  9. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    sur un ordi ne mettre qu'un seul antivirus! alors vire bitdefender ou f secure

    ________________________

    puis dis si ton pc a encore des soucis
    0
  10. gwen
     
    Salut, j'ai déjà un antispyware avec neuf télécom mais ça n'a pas pu désinfecter le trojan...Je n'ai pas non plus f secure. Je retire Bitdefender quand-même?

    Sinon, sur le rapport, rien de spécial? Ca sert à quoi alors? Merci d'éclairer ma lanterne!!
    A bientôt!
    0
  11. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    , j'ai déjà un antispyware avec neuf télécom mais ça n'a pas pu désinfecter le trojan...Je n'ai pas non plus f secure.

    F SECURE = PROTECTION DE NEUF! c'est la meme chose!

    oui vire bitdefender
    0