un fichier grossit sans s'arreter... Résolu

Question

Bonjour,
il y a quelques temps que mon ordinateur ram. En voulant faire de la place dans mon disque partagé en deux parties et en m'interessant à la partie :C qui est celle ou est stoqué mes programes windows, je me suis rendu compte qu'elle était pleine à craquer et qu'en virant quelques musiques, images, videos, bloc notes qui trénaient sur le bureau, je me rend compte ce soir, donc quelques jours plus tard que le disque se retrouve presque saturé! j'ai donc mis avast en marche pour essayer de détecter un quelquonque virus et il est resté bloqué sur un fichier du nom "pyagcore.log" j'ai regardé son emplacement (C:\Documents and Settings\LocalService\Application Data\agi\logs) et arrivé dans "Documents and Settings", le fichier "LocalService" n'éxistait pas, les fichiers caché sont rendus visible mais celui ci est introuvable! donc j'ai tapé son nom a la suite de "Documents and Settings" dans la barre et je suis parvenu a rentrer dedan. je continu le trajet Application Data\agi\logs et arrivé dans log, un unique fichier qui s'appel "pyagcore.log" se trouve la, il fait 31 198 525Ko en ce moment soit 29.7Go mais grossit petit a petit... Quand j'essai de le suprimer, il dit qu'un programme ou un autre utilisayeur s'en sert. et donc impossible e faire quoi que ce soit, quelqun pourait-il me dire ce qui se passe et comment faire pour reccuperer la place sur mon disque sans qu'il sature ?
Merci d'avance...

Redbart · Answer

slt
c'est un malware qui s'est installé
j'espère que tu lit l'anglais
http://www.freepchelp.co.uk/forum/malware-removal-av-firewalls-etc/4918-pyagcore-search-searchdetection.html

Botsie_Collins · Answer

Salut

Tu peux peut-être trouver une soution ici: http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Pannes-courantes/probleme-msn-pyagcore-sujet_202155_1.htm

Ca coûte rien d'aller voir...

Bonne chance.

Templier Nocturne · Answer

essaye de le supprimer en mode sans echec (F8 au démarrage)

srgntkvn · Answer

J'ai essayé le mode sans echec, je l'ai suprimé, mon disque dur se retrouve a 1/3plein! 
Problem... je retourne dans :C, LocalService, Application Data, et a cote de mon fichier windows, un fichier agi contenant un fichier logs qui contien lui meme un petit "pyagcore.log" qui faisait 401Ko et à l'heur ou j'ecri, il fait 18 122Ko! je vais essayer de suivre les explication sur comment suprimer un malware, mais l'anglais n'est pas mon point fort :s

Templier Nocturne · Answer

http://www.malekal.com/

srgntkvn · Answer

j'ai regardé le site que tu a posté, il y a beaucoup d'information sur les malware, il est pas mal le problem est que parmi les 7 catégories de malware existantes, j'ai aucune idée sur comment reconnaitre le mien!
donc ce serais un fichier s'appelant "pyagcore.log" donc un fichier pouvant s'ouvrir avec bloc note, hier ou plutot ce matin avant d'aller domir, en le suprimant a partir du mode sans echec il est réaparu en relançant mon ordi, le fichier etant petit (faisant quand meme 400Ko) j'avai possibilité de l'ouvrir. a l'interieur il y avai plusieurs lignes ou était listé toutes les milliémes de secondes et un message se répétant sur chaques lignes
ex: 01:44:52:246 <<...>>
01:44:52:247 <<...>>
...

Utilisateur anonyme · Answer

Bonjour srgntkvn
Telecharges HijackThis , tu le lances, clic sur " do a scann system and save log", a la fin, le bloc notes s'ouvres, tu fais un copier/coller de ce rapport dans un nouveau message ci dessous.
A+

srgntkvn · Answer

voila le rapport:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:34:18, on 19/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\documents and settings	hierry geneau\local settings\application data\gokkoam.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
C:\Program Files\agi\common\agservice.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32	askmgr.exe
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\agi\common\_agcutils.pyd
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\E_S91.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [gokkoam] "c:\documents and settings	hierry geneau\local settings\application data\gokkoam.exe" gokkoam
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\agi\common\agservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CdbgEvtSvc - Unknown owner - C:\WINDOWS\System32\CdbgEvtSvc.exe (file missing)
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)

srgntkvn · Answer

help...
je voudrais virer ce malware avant que ca sature... je ne veux pas etre obligé de le virer reguliairement en mode sans echecs...

srgntkvn · Answer

up vite svp je vais pas tarder a partir, j'en fait quoi du rapport... svp...

Utilisateur anonyme · Answer

RE
Un peu de patience.
Télécharges Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

Lances l'installation du programme en exécutant le fichier téléchargé.
Double-cliques maintenant sur le raccourci de Toolbar-S&D.
Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

Poste le rapport généré. (C:\TB.txt) 
--------------------------------------------------------------------
Télécharges Malwarebytes Anti-Malware (MBAM):
http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebytes anti malware

Installe-le en vérifiant que la case de mise à jour soit bien cochée en fin d'installation.

Après la mise à jour, lance-le et coche "Examen Rapide". Puis "Rechercher".

Si MBAM trouve quelque chose: fais "Voir les résultats" puis "Supprimer la sélection".

Poste le rapport généré.
Decoches les toolbars si il y en a de proposees a l'installation.
A+

srgntkvn · Answer

voila le rapport, je m'occupe de malwareBytes maintenant:

   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.80GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : thierry geneau ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 090418-0] 4.8.1229 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:39 Go (Free:30 Go)
   D:\ (CD or DVD)
   E:\ (Local Disk) - NTFS - Total:190 Go (Free:94 Go)
   F:\ (CD or DVD)
   G:\ (CD or DVD)
   S:\ (Local Disk) - NTFS - Total:4 Go (Free:3 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 19/04/2009|14:22 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (Documents and Settings) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (Documents and Settings) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

   (Program Files) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://actus.sfr.fr"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
   "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


   --------------------\  Recherche d'autres infections

 
   C:\DOCUME~1\THIERR~1\LOCALS~1\APPLIC~1\gokkoam.dat
   C:\DOCUME~1\THIERR~1\LOCALS~1\APPLIC~1\gokkoam.exe
   C:\DOCUME~1\THIERR~1\LOCALS~1\APPLIC~1\gokkoam_nav.dat
   C:\DOCUME~1\THIERR~1\LOCALS~1\APPLIC~1\gokkoam_navps.dat
   [b]==> EGDACCESS <==/b




   1 - "C:\ToolBar SD\TB_1.txt" - 19/04/2009|14:23 - Option : [1]

   -----------\  Fin du rapport a 14:23:46,82

srgntkvn · Answer

voila le rapport de malwarebyte:

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2009
Windows 5.1.2600 Service Pack 3

19/04/2009 14:39:12
mbam-log-2009-04-19 (14-39-12).txt

Type de recherche: Examen rapide
Eléments examinés: 69211
Temps écoulé: 5 minute(s), 22 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 10
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CdbgEvtSvc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gokkoam (Adware.Navipromo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings	hierry geneau\Local Settings\Application Data\gokkoam_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings	hierry geneau\Local Settings\Application Data\gokkoam_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings	hierry geneau\Local Settings\Application Data\gokkoam.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings	hierry geneau\Local Settings\Application Data\gokkoam.exe (Adware.Navipromo.H) -> Delete on reboot.
C:\WINDOWS\system32\phclv2j0ejc9.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.

Utilisateur anonyme · Answer

RE
Redemarres le PC, fais l'option 2 de " ToolBar S&D " et postes le rapport.
Telecharges Navilog1 , fais l'options 1 et postes le rapport.
Un tuto: http://il.mafioso.pagesperso-orange.fr/Navifix/presentation.htm
A+

srgntkvn · Answer

desolé pour le temps, je n'etait pas chez moi (faut bien profiter de son dernier jour de vacance :p)
Par contre je n'ai rien de toolbar il se trouve ou ?
donc voila le rapport de navilog1:

Search Navipromo version 3.7.6 commencé le 19/04/2009 à 18:15:17,82

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.80GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : thierry geneau ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1229 [VPS 090418-0] 4.8.1229 (Activated)


A:\ (USB)
C:\ (Local Disk) - NTFS - Total:39 Go (Free:30 Go)
D:\ (CD or DVD)
E:\ (Local Disk) - NTFS - Total:190 Go (Free:94 Go)
F:\ (CD or DVD)
G:\ (CD or DVD)
S:\ (Local Disk) - NTFS - Total:4 Go (Free:3 Go)


Recherche executé en mode normal


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users	hierry\menudm~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users	hierry" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings	hierry geneau\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings	hierry geneau\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings	hierry geneau	hierry\menudm~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings	hierry geneau\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings	hierry geneau\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 19/04/2009 à 18:20:21,87 ***

Utilisateur anonyme · Answer

RE
As tu fais l'option 2 de " ToolBar S&D " , il me faut le rapport aussi
A+

srgntkvn · Answer

le voila:

   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.80GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : thierry geneau ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 090418-0] 4.8.1229 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:39 Go (Free:30 Go)
   D:\ (CD or DVD)
   E:\ (Local Disk) - NTFS - Total:190 Go (Free:94 Go)
   F:\ (CD or DVD)
   G:\ (CD or DVD)
   S:\ (Local Disk) - NTFS - Total:4 Go (Free:3 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 19/04/2009|18:38 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (Documents and Settings) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
   (Documents and Settings) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

   (Program Files) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://actus.sfr.fr"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"
   "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 19/04/2009|14:23 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 19/04/2009|18:40 - Option : [2]

   -----------\  Fin du rapport a 18:40:43,37

Utilisateur anonyme · Answer

RE
Telecharges ComboFix sur le bureau
Arretes la protection residente de Avast, et des autres programmes de protection qui sont activeset fermes toutes les fenetres, ensuite tu lances ComboFix et tu me postes le rapport. Un tuto: https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
A+

srgntkvn · Answer

Re

Voila le rapport:

ComboFix 09-04-19.05 - thierry geneau 19/04/2009 19:18.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.511.213 [GMT 2:00]
Lancé depuis: c:\documents and settings	hierry geneau\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1229 [VPS 090418-0] *On-access scanning enabled* (Updated)
 * Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\patch.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CDBGEVTSVC


(((((((((((((((((((((((((((((   Fichiers créés du 2009-03-19 au 2009-04-19  ))))))))))))))))))))))))))))))))))))
.

2009-04-19 12:27 . 2009-04-19 12:27	--------	d-----w	c:\documents and settings\Application Data\Malwarebytes
2009-04-19 12:27 . 2009-04-19 12:27	--------	d-----w	c:\documents and settings\Application Data\Malwarebytes
2009-04-19 12:27 . 2009-04-06 13:32	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-04-19 12:27 . 2009-04-06 13:32	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-19 12:27 . 2009-04-19 12:27	--------	d-----w	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-19 12:21 . 2009-04-19 16:40	--------	d-----w	C:\ToolBar SD
2009-04-19 07:43 . 2009-04-19 07:25	15688	----a-w	c:\windows\system32\lsdelete.exe
2009-04-19 07:25 . 2009-04-19 07:24	64160	----a-w	c:\windows\system32\drivers\Lbd.sys
2009-04-19 07:23 . 2009-04-19 07:23	--------	dc-h--w	c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-19 07:23 . 2009-04-19 07:25	--------	d-----w	c:\documents and settings\All Users\Application Data\Lavasoft
2009-04-19 06:43 . 2009-04-19 06:41	102664	----a-w	c:\windows\system32\drivers	mcomm.sys
2009-04-19 06:41 . 2009-04-19 06:43	--------	d-----w	c:\documents and settings	hierry geneau\.housecall6.6
2009-04-19 06:02 . 2009-04-19 06:02	--------	d-----w	c:\documents and settings\All Users\Application Data\Zylom
2009-04-19 05:32 . 2008-08-22 09:47	24853813	----a-w	c:\windows\LPT$VPN.493
2009-04-19 05:31 . 2009-04-19 05:31	--------	d-----w	c:\windows\AU_Temp
2009-04-18 23:44 . 2009-04-18 23:44	--------	d-----w	c:\documents and settings\LocalService\Application Data\agi
2009-04-18 23:43 . 2009-04-18 23:43	--------	d-----w	c:\documents and settings	hierry geneau\Local Settings\Application Data\Logitech-LS
2009-04-18 22:45 . 2009-04-18 22:45	69048	----a-w	c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-04-18 22:36 . 2009-04-18 22:36	--------	d-----w	c:\windows\system32\Kaspersky Lab
2009-04-16 09:17 . 2009-02-06 10:10	227840	-c----w	c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 09:16 . 2009-03-06 14:20	286720	-c----w	c:\windows\system32\dllcache\pdh.dll
2009-04-16 09:16 . 2009-02-09 11:23	111104	-c----w	c:\windows\system32\dllcache\services.exe
2009-04-16 09:16 . 2009-02-09 10:53	401408	-c----w	c:\windows\system32\dllcachepcss.dll
2009-04-16 09:16 . 2009-02-09 10:53	473600	-c----w	c:\windows\system32\dllcache\fastprox.dll
2009-04-16 09:16 . 2009-02-09 10:53	685568	-c----w	c:\windows\system32\dllcache\advapi32.dll
2009-04-16 09:16 . 2009-02-09 10:53	735744	-c----w	c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 09:16 . 2009-02-09 10:53	453120	-c----w	c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 09:16 . 2009-02-09 10:53	739840	-c----w	c:\windows\system32\dllcache
tdll.dll
2009-04-16 09:14 . 2008-12-16 12:31	354304	-c----w	c:\windows\system32\dllcache\winhttp.dll
2009-04-16 09:14 . 2008-04-21 21:15	219136	-c----w	c:\windows\system32\dllcache\wordpad.exe
2009-04-15 23:10 . 2009-04-19 11:48	--------	d-----w	c:\documents and settings\Application Data\LimeWire
2009-04-15 23:10 . 2009-04-19 11:48	--------	d-----w	c:\documents and settings\Application Data\LimeWire
2009-04-15 15:01 . 2009-04-15 15:01	--------	d-----w	c:\windows\Patch Darluok
2009-04-14 15:43 . 2009-04-14 15:43	--------	d-----w	c:\documents and settings\Application Data\OpenOffice.org
2009-04-14 15:43 . 2009-04-14 15:43	--------	d-----w	c:\documents and settings\Application Data\OpenOffice.org
2009-04-13 11:16 . 2009-04-19 17:24	--------	d-----w	c:\documents and settings	hierry geneau\Tracing
2009-04-13 11:01 . 2009-04-13 11:06	--------	d-----w	c:\documents and settings	hierry geneau	hierry
2009-04-13 10:58 . 2009-04-19 12:27	--------	d-----w	c:\documents and settings\Application Data
2009-04-03 15:35 . 2009-04-03 15:35	34064	----a-w	c:\windows\system32\lhacm.acm
2009-04-01 18:57 . 2009-04-01 18:57	--------	d-----w	c:\windows\system32\IOSUBSYS
2009-03-28 10:48 . 2009-03-28 10:48	--------	d-----w	c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-21 14:07 . 2009-03-21 14:07	1054720	-c----w	c:\windows\system32\dllcache\kernel32.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-19 17:23 . 2009-04-19 12:43	1587	----a-w	C:\aaw7boot.log
2009-04-19 16:40 . 2009-04-19 12:22	2104	----a-w	C:\TB.txt
2009-04-19 16:20 . 2009-04-19 16:13	--------	d-----w	c:\program files\Navilog1
2009-04-19 16:20 . 2009-04-19 16:15	2787	----a-w	C:\fixnavi.txt
2009-04-19 12:28 . 2009-04-19 12:27	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-04-19 10:22 . 2008-08-28 15:17	--------	d-----w	c:\documents and settings\All Users\Application Data\Skype
2009-04-19 10:18 . 2009-04-19 10:18	1976104	----a-w	c:\program files\SkypeSetup.exe
2009-04-19 07:23 . 2009-04-19 07:23	--------	d-----w	c:\program files\Lavasoft
2009-04-19 07:20 . 2009-04-19 07:20	34543112	----a-w	c:\program files\Ad-AwareAE.exe
2009-04-19 06:43 . 2009-04-19 06:43	1975504	----a-w	c:\program files\TrendMicro_Downloader.exe
2009-04-19 06:30 . 2008-08-22 09:45	22617733	----a-w	C:\xscan.txt
2009-04-18 19:47 . 2008-08-17 17:58	--------	d-----w	c:\documents and settings\All Users\Application Data\Google Updater
2009-04-17 08:23 . 2003-04-24 12:00	73516	----a-w	c:\windows\system32\perfc00C.dat
2009-04-17 08:23 . 2003-04-24 12:00	465184	----a-w	c:\windows\system32\perfh00C.dat
2009-04-15 15:01 . 2009-04-15 15:01	--------	d-----w	c:\program files\World of Warcraft
2009-04-13 08:03 . 2008-08-17 18:03	--------	d---a-w	c:\documents and settings\All Users\Application Data\TEMP
2009-04-03 04:52 . 2008-12-27 19:08	--------	d-----w	c:\program files\EA GAMES
2009-04-02 20:55 . 2008-08-14 17:45	--------	d-----w	c:\program files\Google
2009-04-01 18:56 . 2008-09-10 14:25	--------	d-----w	c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-01 18:54 . 2008-09-10 14:25	--------	d-----w	c:\program files\Fichiers communs\Apple
2009-03-30 16:49 . 2008-08-14 19:28	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-03-06 14:20 . 2003-04-24 12:00	286720	----a-w	c:\windows\system32\pdh.dll
2009-03-03 00:13 . 2003-04-24 12:00	826368	----a-w	c:\windows\system32\wininet.dll
2009-02-27 06:58 . 2008-12-19 22:19	--------	d-----w	c:\program files\Microsoft Silverlight
2009-02-20 23:17 . 2008-08-14 18:54	--------	d-----w	c:\program files\Windows Live
2009-02-20 17:10 . 2004-08-19 23:09	78336	------w	c:\windows\system32\ieencode.dll
2009-02-12 09:57 . 2008-08-14 18:51	69048	-c--a-r	c:\documents and settings	hierry geneau\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-09 14:05 . 2003-04-24 12:00	1846912	----a-w	c:\windows\system32\win32k.sys
2009-02-09 11:23 . 2002-08-29 11:42	2025984	----a-w	c:\windows\system32
tkrnlpa.exe
2009-02-09 11:23 . 2003-04-24 12:00	2147328	----a-w	c:\windows\system32
toskrnl.exe
2009-02-09 11:23 . 2003-04-24 12:00	111104	----a-w	c:\windows\system32\services.exe
2009-02-09 10:53 . 2003-04-24 12:00	735744	----a-w	c:\windows\system32\lsasrv.dll
2009-02-09 10:53 . 2003-04-24 12:00	739840	----a-w	c:\windows\system32
tdll.dll
2009-02-09 10:53 . 2003-04-24 12:00	685568	----a-w	c:\windows\system32\advapi32.dll
2009-02-09 10:53 . 2003-04-24 12:00	401408	----a-w	c:\windows\system32pcss.dll
2009-02-06 18:39 . 2009-02-06 18:39	308600	-c--a-w	c:\windows\WLXPGSS.SCR
2009-02-06 17:52 . 2009-02-06 17:52	49504	----a-w	c:\windows\system32\sirenacm.dll
2009-02-06 10:39 . 2003-04-24 12:00	35328	----a-w	c:\windows\system32\sc.exe
2009-02-03 19:58 . 2003-04-24 12:00	56832	----a-w	c:\windows\system32\secur32.dll
2009-01-28 18:38 . 2009-01-28 18:38	216	----a-w	C:	emp.txt
2009-01-22 16:47 . 2009-01-22 16:47	16304771	-c--a-w	c:\program files\klcodec453f.exe
2008-10-28 10:07 . 2008-10-28 10:07	2547210	-c--a-w	c:\program files\UpLauncher_v1_24_0_to_v1_25_0.exe
2007-08-09 05:05 . 2009-01-10 11:51	23402288	-c--a-w	c:\program files\AdbeRdr810_en_US.exe
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-08-14 20480]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-10-08 196608]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-17 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-09-12 196608]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-10-02 684032]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-02-06 454000]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-19 515416]
"nwiz"="nwiz.exe" - c:\windows\system32
wiz.exe [2008-05-03 1630208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings	hierry geneau	hierry\Menu D‚marrer\Programmes\D‚marrage\
Club Internet.lnk - c:\program files\Club-Internet\Lanceur\lanceur.exe [2007-12-26 5484544]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
LE COMPAGNON CLUB.lnk - c:\program files\Club-Internet\Le Compagnon Club\bin\matcli.exe [2008-10-23 217088]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-8-14 450560]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\msmsgs.exe"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\WINDOWS\system32\dpvsetup.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"e:\disque d\UT2004\System\UT2004.exe"=
"e:\disque d\LimeWire\LimeWire.exe"=

R0 NVDual;NVDual; [x]
R2 sdAuxService;PC Tools Auxiliary Service; [x]
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-08-17 29744]
R3 lgusbsmodem;LGE Mobile USB  Modem; [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-04-19 64160]
S1 aswSP;avast! Self Protection; [x]
S2 AGWinService;AG Windows Service;c:\program files\agi\common\agservice.exe [2008-06-30 21504]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
S2 fssfltr;fssfltr;c:\windows\system32\DRIVERS\fssfltr_tdi.sys [2008-12-08 55136]
S2 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-04-19 951632]
S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;c:\windows\system32\DRIVERS\usb8023.sys [2008-04-13 12800]

.
Contenu du dossier 'Tâches planifiées'

2009-04-19 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 07:24]

2009-04-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-04-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-14 14:45]
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
HKLM-Run-EoEngine - (no file)
SafeBoot-Winre45.sys


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.club-internet.fr
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mWindow Title = 
uInternet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;club-internet.fr;*.club-internet.fr;grolier.fr;*.grolier.fr;*.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Trusted Zone: live.com\login
Trusted Zone: secuser.com\www
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game03.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\documents and settings\Application Data\Mozilla\Firefox\Profiles\19pzujc4.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592
pCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3
pPicasa3.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-19 19:24
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\¤* %3*_*a*u*t*o*_*f*i*l*e*\shell\open]
"MuiVerb"="@shimgvw.dll,-550"

[HKEY_LOCAL_MACHINE\software\Classes\¤* %3*_*a*u*t*o*_*f*i*l*e*\shell\open\command]
@=expand:"rundll32.exe %SystemRoot%\System32\shimgvw.dll,ImageView_Fullscreen %1"

[HKEY_LOCAL_MACHINE\software\Classes\¤* %3*_*a*u*t*o*_*f*i*l*e*\shell\open\DropTarget]
"Clsid"="{e84fda7c-1d6a-45f6-b725-cb260c236066}"

[HKEY_LOCAL_MACHINE\software\Classes\¤* %3*_*a*u*t*o*_*f*i*l*e*\shell\print\command]
@=expand:"rundll32.exe %SystemRoot%\System32\shimgvw.dll,ImageView_Fullscreen %1"

[HKEY_LOCAL_MACHINE\software\Classes\¤* %3*_*a*u*t*o*_*f*i*l*e*\shell\print\DropTarget]
"Clsid"="{60fd46de-f830-4894-a628-6fa81bc0190d}"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3076)
c:\docume~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32undll32.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
c:\progra~1\Motive\ASSTCO~1\MOTIVE~1.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32
vsvc32.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Heure de fin: 2009-04-19 19:28 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-04-19 17:28

Avant-CF: 32 021 868 544 octets libres
Après-CF: 32 235 835 392 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn

253	--- E O F ---	2009-04-16 23:08

Utilisateur anonyme · Answer

RE
Télécharges Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

http://images.malwareremoval.com/random/RSIT.exe

Double-cliques sur RSIT.exe.

Cliques sur Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

A noter: Les rapports se trouvent également ici: C:\rsit.
A+

srgntkvn · Answer

Donc le fichier info.txt:

info.txt logfile of random's system information tool 1.06 2009-04-19 20:31:28

======Uninstall list======

-->C:\PROGRA~1\CLUB-I~1\LECOMP~1\Uninstall.exe  TONLFR
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 6.0 Sprint-->MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
Adobe AIR-->C:\Program Files\Fichiers communs\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.4 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
Apple Mobile Device Support-->MsiExec.exe /I{162B71B8-8464-4680-A086-601D555B331D}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
BroadJump Client Foundation-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\BroadJump\Client Foundation\Uninst.isu" -c"C:\Program Files\BroadJump\Client Foundation\RmvBJCFD.dll" -b"CFD" -h"CFD" -a
Camera RAW Plug-In for EPSON Creativity Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8DAC1AE4-33D1-4A78-8A42-00E09EDECC3E}\SETUP.EXE" -l0x40c UNINST
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Configurateur Modem-->"C:\Program Files\Club-Internet\Assistance\uninstall.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
CX4300_5500_DX4400 Manuel-->C:\Program Files\EPSON\TPMANUAL\CX4300_5500_DX4400\FRA\USE_G\DOCUNINS.EXE
Easy CD Creator 5 Basic-->MsiExec.exe /I{609F7AC8-C510-11D4-A788-009027ABA5D0}
EPSON Attach To Email-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
EPSON Copy Utility 3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{67EDD823-135A-4D59-87BD-950616D6E857}\SETUP.EXE" -l0x40c -UnInstall
EPSON Easy Photo Print-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B66E665A-DF96-4C38-9422-C7F74BC1B4E5}\SETUP.EXE" -l0x40c UNINST
EPSON File Manager-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}\Setup.exe" -l0x40c UNINST
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON Scan Assistant-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x40c -u
EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
EPSON Web-To-Page-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE" -l0x40c -anything
Favorit-->"c:\documents and settings	hierry geneau\local settings\application data\gokkoam.exe" -uninstall
FinePix Studio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E3B3AB03-8ABC-46CF-8CA9-DB5581E1F368}\SETUP.EXE" -l0x40c 
FinePixViewer Resource-->C:\Program Files\InstallShield Installation Information\{B44529FF-501E-47CD-A06D-223C161BE058}\SETUP.EXE -runfromtemp -l0x040c -removeonly
Free YouTube Download 2.2-->"C:\Program Files\DVDVideoSoft\Free YouTube Download\unins000.exe"
Free YouTube to Mp3 Converter version 3.1-->"C:\Program Files\DVDVideoSoft\Free YouTube to Mp3 Converter\unins000.exe"
Free YouTube Uploader version 2.2-->"C:\Program Files\DVDVideoSoft\Free YouTube Uploader\unins000.exe"
FUJIFILM USB Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5490882C-6961-11D5-BAE5-00E0188E010B}\SETUP.EXE" 
Galerie de photos Windows Live-->MsiExec.exe /X{44E54A81-9D91-4AA1-9417-80AFF134F5FF}
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_0531C63A913CC9D1.exe" /uninstall
HijackThis 2.0.2-->"C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
ImTOO DVD to PSP Converter 5-->C:\Program Files\ImTOO\DVD to PSP Converter 5\Uninstall.exe
ImTOO PSP Video Converter-->C:\Program Files\ImTOO\PSP Video Converter\Uninstall.exe
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
InterVideo WinDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C1939820-A945-11D4-86F6-0001031E5712}\setup.exe" 
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
Kaspersky Online Scanner-->C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
Kiwee Toolbar-->MsiExec.exe /X{6252AFEB-930F-4A08-84D2-58F3ED5568B2}
K-Lite Codec Pack 4.5.3 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lanceur Club Internet v6-->"C:\Program Files\Club-Internet\Lanceur\uninstall.exe"
LE COMPAGNON CLUB-->C:\WINDOWS\Motive\TONLFR\MCCUninst.exe
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LG PC Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{993960EE-CA4D-443F-8F88-E24260DD5FD2}\setup.exe" -l0x40c  -removeonly
LimeWire 5.1.2-->"E:\disque d\LimeWire\uninstall.exe"
Logiciel QuickCam de Logitech-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x40c 
Logitech Desktop Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0x40c UNINSTALL
Logitech Print Service-->C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG
MAGIX Photo Clinic 4.5 (F)-->C:\MAGIX\Photo_Clinic_45\instslct.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live & Sponsor (CiD)-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft DirectX Transform optional components-->RUNDLL32.EXE ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\DXTXTRA.INF,UNINSTALL.NT,12
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 CD-ROM 2-->MsiExec.exe /I{0004040C-78E1-11D2-B60F-006097C998E7}
Microsoft Office Excel Viewer 2003-->MsiExec.exe /I{9084040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Word Viewer 2003-->MsiExec.exe /I{9085040C-6000-11D3-8CFE-0150048383C9}
Microsoft Search Enhancement Pack-->MsiExec.exe /I{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
musikCube 1.0 FR-->"C:\Program Files\musikCube_1.0\unins000.exe"
Navilog1 3.7.6-->"C:\Program Files\Navilog1\unins000.exe"
Nero - Burning Rom-->MsiExec.exe /X{A4D7B764-4140-11D4-88EB-0050DA3579C0}
NVIDIA Drivers-->C:\WINDOWS\system32
vuninst.exe UninstallGUI
OpenOffice.org 3.0-->MsiExec.exe /I{6860B340-530D-46B3-91F8-1AE1F70F7C33}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Patch Darluok-->"C:\WINDOWS\Patch Darluok\uninstall.exe" "/U:C:\Program Files\World of Warcraft\Uninstall\uninstall.xml"
PCI Audio Applications-->C:\Program Files\PCI Audio Applications\Bin\Uninstall.exe
PCI Audio Driver-->cmuninst.exe
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
Programme de gestion Camera de Logitech®-->"C:\Program Files\Fichiers communs\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
Project64 1.6-->MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}
SAMSUNG CDMA Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
SAMSUNG Mobile Composite Device Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\6\SSBCUninstall.exe
Samsung Mobile phone USB driver Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio 3 USB Driver Installer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -l0x40c  -removeonly
Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x040c -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update pour Microsoft .NET Framework 2.0 (KB928365)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {8056AC9E-49C5-4375-9ADE-B2F862C9DF51} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Uninstall 1.0.0.1-->"C:\Program Files\Fichiers communs\DVDVideoSoft\unins000.exe"
Unreal Anthology-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{14AA72DA-DB40-4A34-93A6-401A81D7AF9E}\Setup.exe" -l0x40c  -removeonly
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D6A2DDE3-9D7C-412C-932A-756580D29919}
Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Live Sync-->MsiExec.exe /X{9C5EB781-0D37-44B8-9A58-77B3E4BF5F5E}
Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinFast(R) Display Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{44BAC2DD-0574-4047-B736-A7687401C1CD}\setup.exe" 
Wow Cartographe 1.09-->C:\Program Files\WowCartographe\uninst.exe

======Security center information======

AV: avast! antivirus 4.8.1229 [VPS 090418-0]

======System event log======

Computer Name: FAMILLE
Event Code: 7023
Message: Le service Gestion d'applications s'est arrêté avec l'erreur : 
Le module spécifié est introuvable.


Record Number: 59606
Source Name: Service Control Manager
Time Written: 20090401205503.000000+120
Event Type: erreur
User: 

Computer Name: FAMILLE
Event Code: 7036
Message: Le service Gestion d'applications est entré dans l'état : arrêté.

Record Number: 59605
Source Name: Service Control Manager
Time Written: 20090401205503.000000+120
Event Type: Informations
User: 

Computer Name: FAMILLE
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Gestion d'applications.

Record Number: 59604
Source Name: Service Control Manager
Time Written: 20090401205503.000000+120
Event Type: Informations
User: FAMILLE	hierry geneau

Computer Name: FAMILLE
Event Code: 7023
Message: Le service Gestion d'applications s'est arrêté avec l'erreur : 
Le module spécifié est introuvable.


Record Number: 59603
Source Name: Service Control Manager
Time Written: 20090401205503.000000+120
Event Type: erreur
User: 

Computer Name: FAMILLE
Event Code: 7036
Message: Le service Gestion d'applications est entré dans l'état : arrêté.

Record Number: 59602
Source Name: Service Control Manager
Time Written: 20090401205503.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: FAMILLE
Event Code: 4098
Message: The AGWinService service has startedDone adding AGI as search scope.

Record Number: 613889360
Source Name: AGWinService
Time Written: 20090419203143.000000+120
Event Type: Informations
User: 

Computer Name: FAMILLE
Event Code: 4098
Message: The AGWinService service has startedGenerated search url http://kwtb.search.imgag.com/?c=WKKIW15365&sbs=2&sc=0&f=web&vernum=2.6.156&uid=&did=%7B26bdb6a1-6a53-11dd-babd-001638fda29b%7D&q=%7BsearchTerms%7D

Record Number: 613889359
Source Name: AGWinService
Time Written: 20090419203143.000000+120
Event Type: Informations
User: 

Computer Name: FAMILLE
Event Code: 4098
Message: The AGWinService service has startedAGI is not listed as a search scope.

Record Number: 613889358
Source Name: AGWinService
Time Written: 20090419203143.000000+120
Event Type: Informations
User: 

Computer Name: FAMILLE
Event Code: 4098
Message: The AGWinService service has startedS-1-5-21-1229272821-1580436667-839522115-1004\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}.

Record Number: 613889357
Source Name: AGWinService
Time Written: 20090419203143.000000+120
Event Type: Informations
User: 

Computer Name: FAMILLE
Event Code: 4098
Message: The AGWinService service has startedStart add AGI to available search scopes.

Record Number: 613889356
Source Name: AGWinService
Time Written: 20090419203143.000000+120
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Samsung\Samsung PC Studio 3;C:\Program Files\Fichiers communs\Adaptec Shared\System
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"PYTHONPATH"=C:\Program Files\agi\common;C:\Program Files\agi\common\python25.zip

-----------------EOF-----------------


Et le fichier log.txt:

Logfile of random's system information tool 1.06 (written by random/random)
Run by thierry geneau at 2009-04-19 20:30:59
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 31 GB (77%) free of 40 GB
Total RAM: 511 MB (20% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:31:22, on 19/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\agi\common\agservice.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings	hierry geneau\Bureau\RSIT.exe
C:\Program Files	rend micro	hierry geneau.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\agi\common\agservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)

reloulinformatik · Answer

avec le brun sur ton ordi reformate le ce sera plus vite fait !
et çà lui fera pas de mal !

srgntkvn · Answer

bin oui mais bon... j'ai pas fait toutes ces manip pour rien...

hisaeh · Answer

...attends le retour de Lacharpente, il reste quelques nettoyages.
Où en est ton fichier ? il grossit encore?

Utilisateur anonyme · Answer

Re
Encore un petit moment, je te dit la suite, laisses les gosses s'amuse.A part mettre un CD pour installer, c'est a peu pres tout ce qu'ils savent faire.

srgntkvn · Answer

il est resté au meme endrois! mis a part que depuis sa "supression" par mode sans echecs il a dépassé les 1Go...
Il reste beaucoup de manip? parceque je vais pas tarder a aller me coucher je me leve a 6h demain... et a partir de demain ca vas etre difficile d'avoir le pc, en semaine j'y touche pas souvent!

Utilisateur anonyme · Answer

RE
* Télécharge OtmoveIT (de Old_Timer) sur ton Bureau

http://oldtimer.geekstogo.com/OTMoveIt3.exe

* Double-clique sur OTMoveIt.exe pour le lancer.

* Assure toi que la case Unregister Dll's and Ocx's soit bien cochée.

* Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste List of Files/Folders to move.


-----------------------------

:processes
explorer.exe

:files
C:\PROGRA~1\CLUB-I~1\LECOMP~1\Uninstall.exe TONLFR 
C:\WINDOWS\Motive\TONLFR\MCCUninst.exe 
C:\Program Files\agi\common\agservice.exe 
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe 
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe 
C:\Documents and Settings\All Users\Application Data\Zylom 
C:\WINDOWS\system32\Kaspersky Lab 
C:\Documents and Settings\LocalService\Application Data\agi
C:\documents and settings	hierry geneau\local settings\application data\gokkoam.exe 
C:\Program Files\agi\common\_agcutils.pyd 

:commands
[purity]
[emptytemp]
[start explorer]
[reboot] 


-----------------------------


* Clique sur MoveIt! pour lancer la suppression.

* Le résultat apparaitra dans le cadre "Results".

* Clique sur Exit pour fermer.

* Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

* Le pc va redémarrer, c'est normal. Poste le rapport ensuite.

Repostes aussi un rapport HijackThis
A+

alabien30 · Answer

si sa na pas été dit installe pluto avira antivir pluto que avast.

srgntkvn · Answer

le voila:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\PROGRA~1\CLUB-I~1\LECOMP~1\Uninstall.exe TONLFR not found.
C:\WINDOWS\Motive\TONLFR\MCCUninst.exe moved successfully.
C:\Program Files\agi\common\agservice.exe moved successfully.
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe moved successfully.
File/Folder C:\Program Files\Spyware Doctor\pctsAuxs.exe not found.
File/Folder C:\Program Files\Spyware Doctor\pctsSvc.exe not found.
C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe moved successfully.
C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\sounds moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\properties moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels\spiral2 moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels\overlap moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels\dynomite moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels\doubledip moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\images\upsell moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\images\fr-FR moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\images\en-US moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\images moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\fonts moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\PopcapExtension moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\MyZylomExtension moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\data moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\bases moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\backup\VCUy6SiAsDER moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\backup moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner moved successfully.
C:\WINDOWS\system32\Kaspersky Lab moved successfully.
Folder move failed. C:\Documents and Settings\LocalService\Application Data\agi\logs scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\LocalService\Application Data\agi scheduled to be moved on reboot.
File/Folder C:\documents and settings	hierry geneau\local settings\application data\gokkoam.exe not found.
C:\Program Files\agi\common\_agcutils.pyd moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\History\History.IE5\MSHist012009041920090420\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\profile[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJedirectiframe[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\watch[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\KQQ0OQRS\affich-12074448-un-fichier-grossit-sans-s-arreter[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\10[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\history_manager[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\home[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\signin[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\1M7KUDKX\profile[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Cookies\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\fla6.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings	hierry geneau\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Cookies\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_658.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04192009_214945

Files moved on Reboot...
C:\Documents and Settings\LocalService\Application Data\agi\logs moved successfully.
C:\Documents and Settings\LocalService\Application Data\agi moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\profile[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJedirectiframe[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\watch[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\KQQ0OQRS\affich-12074448-un-fichier-grossit-sans-s-arreter[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\10[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\history_manager[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\home[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\signin[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\1M7KUDKX\profile[1].htm moved successfully.
File C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\fla6.tmp not found!
DllUnregisterServer procedure not found in C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll NOT unregistered.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll moved successfully.
C:\Documents and Settings	hierry geneau\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully.
File move failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS	emp\Perflib_Perfdata_658.dat moved successfully.

srgntkvn · Answer

le voila:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\PROGRA~1\CLUB-I~1\LECOMP~1\Uninstall.exe TONLFR not found.
C:\WINDOWS\Motive\TONLFR\MCCUninst.exe moved successfully.
C:\Program Files\agi\common\agservice.exe moved successfully.
C:\Program Files\Club-Internet\Le Compagnon Club\bin\mpbtn.exe moved successfully.
File/Folder C:\Program Files\Spyware Doctor\pctsAuxs.exe not found.
File/Folder C:\Program Files\Spyware Doctor\pctsSvc.exe not found.
C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe moved successfully.
C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\sounds moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\properties moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels\spiral2 moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels\overlap moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels\dynomite moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels\doubledip moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\levels moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\images\upsell moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\images\fr-FR moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\images\en-US moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\images moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR\fonts moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma\fr-FR moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\Zuma moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\PopcapExtension moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom\MyZylomExtension moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer\zylom moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom\ZylomGamesPlayer moved successfully.
C:\Documents and Settings\All Users\Application Data\Zylom moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\data moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\bases moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\backup\VCUy6SiAsDER moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\backup moved successfully.
C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner moved successfully.
C:\WINDOWS\system32\Kaspersky Lab moved successfully.
Folder move failed. C:\Documents and Settings\LocalService\Application Data\agi\logs scheduled to be moved on reboot.
Folder move failed. C:\Documents and Settings\LocalService\Application Data\agi scheduled to be moved on reboot.
File/Folder C:\documents and settings	hierry geneau\local settings\application data\gokkoam.exe not found.
C:\Program Files\agi\common\_agcutils.pyd moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\History\History.IE5\MSHist012009041920090420\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\profile[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJedirectiframe[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\watch[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\KQQ0OQRS\affich-12074448-un-fichier-grossit-sans-s-arreter[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\10[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\history_manager[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\home[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\signin[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\1M7KUDKX\profile[1].htm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Cookies\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\fla6.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings	hierry geneau\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Cookies\index.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_658.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04192009_214945

Files moved on Reboot...
C:\Documents and Settings\LocalService\Application Data\agi\logs moved successfully.
C:\Documents and Settings\LocalService\Application Data\agi moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\profile[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJedirectiframe[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\ME9Y44ZJ\watch[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\KQQ0OQRS\affich-12074448-un-fichier-grossit-sans-s-arreter[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\10[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\history_manager[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\home[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\38Q8XBDP\signin[1].htm moved successfully.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\1M7KUDKX\profile[1].htm moved successfully.
File C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\fla6.tmp not found!
DllUnregisterServer procedure not found in C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll NOT unregistered.
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\IadHide4.dll moved successfully.
C:\Documents and Settings	hierry geneau\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully.
File move failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS	emp\Perflib_Perfdata_658.dat moved successfully.

Utilisateur anonyme · Answer

RE
Il faut encore un rapport HijackThis.
A+

srgntkvn · Answer

Le 2nd rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:11:07, on 19/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS
otepad.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\DOCUME~1\THIERR~1\LOCALS~1\Temp\Fichiers Internet temporaires\Content.IE5\R5AIOMWA\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\agi\common\agservice.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)

Utilisateur anonyme · Answer

RE
Relances HijackThis,clic sur "do a scann only" et coches uniquement ces case:
*R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
*O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
*O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
*O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
*O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/
*O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
*O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\agi\common\agservice.exe (file missing)

Clic sur " Fixchecked" et refermes la fenetre.

Ensuite tu redemarres,
Nettoyage des programmes de desinfection.

Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau:

http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

Clique sur Recherche et laisse le scan se terminer.

Clique, sur Suppression pour finaliser.

Clique sur Quitter, pour que le rapport puisse se créer.

Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

============

Supprimes "ToolsCleaner" et "TCleaner.txt"

Telecharges CCleaner:
http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner

Tu le lances, il est preregle, tu fais analyse,lancer le nettoyage,ensuite le registre et reparer les erreurs, fais la sauvegarde demandee
Tu le refais plusieurs fois pour qu'il ne trouve plus rien

!! Très Important !!

Supprimer les anciens points de restauration:

* Cliquer "démarrer", clic droit sur poste de travail, proprietes et restauration du systeme.
* Cliquer sur l'onglet "Restauration du système".
* Cocher la case "Désactiver la restauration...", puis "Appliquer" et valider par "OK".
* Redémarrer le pc.

* Cliquer "démarrer",.... Retournes au meme endroit.
* Cliquer sur l'onglet "Restauration du système".
* Redécocher la case "Désactiver la restauration...", puis "Appliquer" et valider par "OK".

Les points sont supprimés.

Création d'un nouveau point:

* Cliquer "démarrer", "panneau de configuration", "performance et maintenance" puis "restauration du système" (en haut à gauche).
* Dans la nouvelle fenêtre, cocher la case "Créer un point de restauration".
* Cliquer sur "Suivant".
* Entrer un nom pour le point de restauration : ce nom doit être assez évocateur (comme: "Après désinfection...")
* Cliquer sur "Créer" et le point de restauration se créé automatiquement.

=============

Tu devrait installer Antivir qui est plus performant qu'Avast:
http://www.commentcamarche.net/telecharger/telecharger 55 antivir personal
Tu lui fais les mises a jour et un scanne tout de suite.

Pour desinstaller Avast:
https://www.avast.com/fr-fr/uninstall-utility
A desinstaller avant d'installer l'autre.

Comment se comporte ton PC?
A+

srgntkvn · Answer

[ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\TB.txt: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings	hierry geneau\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\R5AIOMWA\hijackthis.log: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files	rend micro\HijackThis.exe: trouvé !
C:\Program Files	rend micro\hijackthis.log: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files	rend micro\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\TB.txt: supprimé !
C:\Documents and Settings	hierry geneau\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\R5AIOMWA\hijackthis.log: supprimé !
C:\Program Files	rend micro\hijackthis.log: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Program Files\Navilog1: supprimé !

srgntkvn · Answer

Alors la, merci beaucoup, il a disparu! Bravo t'es un chef ;)

Utilisateur anonyme · Answer

RE
Normalement, pour la suppression des outils et des fichiers, c'est bon. Malwarebytes et ccleaner, tu les gardes et tu fais un nettoyage de temps en temps.
A+

Utilisateur anonyme · Answer

Re
De rien, c'etait avec plaisir. 
A+

dv59 · Answer

bonjour,
juste une idée en passant : s'il se relance au démarrage de l'ordi, c'est peu être qu'il à un implant dans le msconfig/démarrage et qu'il faut le supprimer aussi
a+

Un fichier grossit sans s'arreter...

38 réponses

Discussions similaires

Newsletters