Pubs intempestives au demarrage

Résolu

lalyla -
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention - 3 mai 2009 à 22:59

Bonjour, je ne suis pas très douée en informatique et je commence a désespérer.dés que je me connecte a internet je suis envahie par des pubs pas très catholiques et donc je dois attendre que ca se calme pour surfer.j ai entendu parler de hijackis mais je ne sais pas quoi supprimer!please HELP!!!

Configuration: Windows Vista Internet Explorer 7.0

Afficher la suite

64 réponses

Résumé de la discussion

Le problème porte sur une invasion de publicités intrusives et de logiciels publicitaires sur un PC Windows nécessitant des outils de détection et de suppression comme HijackThis. Parmi les solutions les plus pertinentes figurent l'exécution d'un scan avec HijackThis pour repérer les entrées malveillantes et la suppression des éléments signalés, suivies d’un outil de nettoyage complémentaire pour éradiquer les adwares. Des réponses insistent sur la simplicité nécessaire pour les débutants, rappelant que certains outils modifient les paramètres de démarrage et exigent une exécution en mode administrateur pour être efficaces. En complément, il est conseillé de sauvegarder les données et de vérifier manuellement les résultats de suppression pour éviter la suppression d’éléments essentiels ou de programmes légitimes.

Réponse 1 / 64
afideg Messages postés 10466 Date d'inscription Statut Contributeur sécurité Dernière intervention 602

Re,

Bonsoir,
Patiente un peu.
Mon ami crapoulou ne colle pas encore à son PC.
Il va revenir.
Merci

Nous sommes tous des bénévoles avec charge de famille ou autres préoccupations, souvent.
De surcroît, c'est l'heure de passer à table.

Al.
1
1. lalyla
  
  désolé je vais patienter
  
  0
Réponse 2 / 64
anthony5151 Messages postés 10927 Statut Contributeur sécurité 790

Bonjour,

Peux-tu utiliser ce logiciel de diagnostic stp, ça me permettra de t'aider :

• Télécharge Random's System Information Tool (RSIT) de random/random, et enregistre le sur ton Bureau.
• Double clique sur RSIT.exe pour lancer l'outil.
• Clique sur ' continue ' à l'écran Disclaimer.
• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés

Tutoriel illustré pour t'aider : https://www.androidworld.fr/
0
1. lalyla
  
  meci de t occuper de moi! j ai déja hijackis
  
  0
2. lalyla > lalyla
  
  ok je suis en train de faire ce que tu m as dit
  
  0
3. lalyla
  
  Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
  System drive C: has 184 GB (62%) free of 294 GB
  Total RAM: 3069 MB (62% free)
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 16:10:07, on 30/04/2009
  Platform: Windows Vista SP1 (WinNT 6.00.1905)
  MSIE: Internet Explorer v7.00 (7.00.6001.18226)
  Boot mode: Normal
  
  Running processes:
  C:\Windows\system32\Dwm.exe
  C:\WINDOWS\SYSTEM32\taskeng.exe
  C:\Windows\Explorer.EXE
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Windows\RtHDVCpl.exe
  C:\hp\support\hpsysdrv.exe
  c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
  C:\Program Files\Alwil Software\Avast4\ashDisp.exe
  C:\Program Files\Search Settings\SearchSettings.exe
  C:\Windows\PixArt\PAC207\Monitor.exe
  C:\Program Files\Unlocker\UnlockerAssistant.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
  C:\Windows\ehome\ehtray.exe
  C:\Users\Nadia\Program Files\DNA\btdna.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\OrangeHSS\Launcher\Launcher.exe
  C:\Program Files\Canal\Canal Widget\CANAL+ CANALSAT A LA DEMANDE.EXE
  C:\Windows\ehome\ehmsas.exe
  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
  C:\Program Files\OrangeHSS\systray\systrayapp.exe
  C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
  C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
  C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
  C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
  C:\hp\kbd\kbd.exe
  C:\Program Files\Internet Explorer\ieuser.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
  C:\Users\Nadia\Desktop\RSIT.exe
  C:\Program Files\Trend Micro\HijackThis\Nadia.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ke.voila.fr/S/voila?kw=
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orange.fr
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
  R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
  O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
  O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
  O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
  O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
  O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
  O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
  O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
  O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [Canal Widget] "C:\Program Files\Canal\Canal Widget\Launcher.exe"
  O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
  O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
  O4 - HKLM\..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
  O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
  O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
  O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Nadia\Program Files\DNA\btdna.exe"
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
  O4 - Startup: Worldnet.lnk = C:\Windows\System32\Worldnet.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
  O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
  O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll (file missing)
  O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll (file missing)
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
  O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
  O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
  O13 - Gopher Prefix:
  O15 - Trusted Zone: http://*.mappy.com
  O15 - Trusted Zone: http://*.orange.fr
  O15 - Trusted Zone: http://rw.search.ke.voila.fr
  O15 - Trusted Zone: http://orange.weborama.fr
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
  O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
  
  0
4. lalyla > lalyla
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
  Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
  Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A87B991-A31F-4130-AE72-6D0C294BF082}]
  DealioBHO Class - C:\Program Files\Dealio\kb127\Dealio.dll [2008-05-26 3170144]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
  Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
  Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2008-10-18 2436160]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
  Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-04-14 35840]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
  SearchSettings Class - C:\Program Files\Search Settings\kb127\SearchSettings.dll [2008-06-12 1111904]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
  HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2007-11-06 542016]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2008-10-18 2436160]
  {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - Dealio - C:\Program Files\Dealio\kb127\Dealio.dll [2008-05-26 3170144]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
  "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-07-03 6266880]
  "hpsysdrv"=c:\hp\support\hpsysdrv.exe [2007-04-18 65536]
  "KBD"=C:\HP\KBD\KbdStub.EXE [2006-12-08 65536]
  "StartCCC"=c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
  "HP Health Check Scheduler"=c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-03-14 70912]
  "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-04-14 148888]
  "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-10-14 49152]
  "hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-06-02 80896]
  "ORAHSSSessionManager"=C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe [2007-12-12 107248]
  "EoEngine"= []
  "avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
  "Canal Widget"=C:\Program Files\Canal\Canal Widget\Launcher.exe [2009-04-22 170072]
  "au"=C:\Program Files\Dealio\DealioAU.exe [2008-05-26 595296]
  "SearchSettings"=C:\Program Files\Search Settings\SearchSettings.exe [2008-06-12 991584]
  "PAC207_Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
  "Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2006-11-03 319488]
  "UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe [2008-05-02 15872]
  "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-21 1233920]
  "HPAdvisor"=C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [2008-04-14 972128]
  "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
  "BitTorrent DNA"=C:\Users\Nadia\Program Files\DNA\btdna.exe [2008-12-16 342848]
  "MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
  "swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [2008-10-18 171448]
  "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer]
  C:\Users\Nadia\AppData\Local\Temp\jKApnOIa.dll,#1 []
  
  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
  HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
  Worldnet.lnk - C:\Windows\System32\Worldnet.exe
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  "{E54729E8-BB3D-4270-9D49-7389EA579090}"=C:\Windows\system32\EZUPBH~1.DLL [2008-09-15 49152]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "DisableLockWorkstation"=0
  "DisableTaskMgr"=0
  "DisableChangePassword"=0
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "dontdisplaylastusername"=0
  "legalnoticecaption"=
  "legalnoticetext"=
  "shutdownwithoutlogon"=1
  "undockwithoutlogon"=1
  "FilterAdministratorToken"=1
  "EnableUIADesktopToggle"=0
  "HideFastUserSwitching"=0
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
  "NoLogoff"=0
  "NoClose"=0
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  "C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe"="C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS"
  "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{402d8454-a66f-11dd-a22f-001d92f67b16}]
  shell\AutoRun\command - F:\Setup.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8019d21-e077-11dd-8652-001d92f67b16}]
  shell\AutoRun\command - G:\start.exe
  
  ======List of files/folders created in the last 1 months======
  
  2009-04-30 16:10:05 ----D---- C:\rsit
  2009-04-16 12:28:13 ----A---- C:\Windows\system32\winhttp.dll
  2009-04-16 12:28:10 ----A---- C:\Windows\system32\xolehlp.dll
  2009-04-16 12:28:10 ----A---- C:\Windows\system32\msdtcprx.dll
  2009-04-16 12:28:03 ----A---- C:\Windows\system32\rpcss.dll
  2009-04-16 12:28:02 ----A---- C:\Windows\system32\ntoskrnl.exe
  2009-04-16 12:28:02 ----A---- C:\Windows\system32\ntkrnlpa.exe
  2009-04-16 12:28:01 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
  2009-04-16 12:28:00 ----A---- C:\Windows\system32\sdohlp.dll
  2009-04-16 12:28:00 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
  2009-04-16 12:28:00 ----A---- C:\Windows\system32\iasrecst.dll
  2009-04-16 12:28:00 ----A---- C:\Windows\system32\iashost.exe
  2009-04-16 12:28:00 ----A---- C:\Windows\system32\iasdatastore.dll
  2009-04-16 12:28:00 ----A---- C:\Windows\system32\iasads.dll
  2009-04-16 12:27:56 ----A---- C:\Windows\system32\lsasrv.dll
  2009-04-16 12:27:56 ----A---- C:\Windows\system32\kernel32.dll
  2009-04-16 12:27:55 ----A---- C:\Windows\system32\secur32.dll
  2009-04-16 12:27:55 ----A---- C:\Windows\system32\apilogen.dll
  2009-04-16 12:27:55 ----A---- C:\Windows\system32\amxread.dll
  2009-04-16 12:27:51 ----A---- C:\Windows\system32\mshtml.dll
  2009-04-16 12:27:49 ----A---- C:\Windows\system32\ieframe.dll
  2009-04-16 12:27:48 ----A---- C:\Windows\system32\urlmon.dll
  2009-04-16 12:27:47 ----A---- C:\Windows\system32\iertutil.dll
  2009-04-16 12:27:46 ----A---- C:\Windows\system32\wininet.dll
  2009-04-16 12:27:46 ----A---- C:\Windows\system32\msfeeds.dll
  2009-04-16 12:27:46 ----A---- C:\Windows\system32\iedkcs32.dll
  2009-04-16 12:27:45 ----A---- C:\Windows\system32\occache.dll
  2009-04-16 12:27:45 ----A---- C:\Windows\system32\ieUnatt.exe
  2009-04-16 12:27:45 ----A---- C:\Windows\system32\ieencode.dll
  2009-04-16 12:27:45 ----A---- C:\Windows\system32\ieaksie.dll
  2009-04-16 12:27:44 ----A---- C:\Windows\system32\mstime.dll
  2009-04-16 12:27:43 ----A---- C:\Windows\system32\jsproxy.dll
  2009-04-14 15:02:22 ----A---- C:\Windows\Home Sweet Home 2 Kitchens and Baths Uninstall Log.txt
  2009-04-14 12:06:53 ----D---- C:\Windows\Sun
  2009-04-14 12:06:07 ----A---- C:\Windows\system32\javaws.exe
  2009-04-14 12:06:07 ----A---- C:\Windows\system32\javaw.exe
  2009-04-14 12:06:07 ----A---- C:\Windows\system32\java.exe
  2009-04-14 12:06:07 ----A---- C:\Windows\system32\deploytk.dll
  2009-04-11 10:36:56 ----D---- C:\Users\Nadia\AppData\Roaming\Ludia
  2009-04-11 10:36:56 ----D---- C:\ProgramData\Ludia
  2009-04-11 10:36:41 ----D---- C:\Windows\Hell's Kitchen
  2009-04-11 10:36:41 ----D---- C:\Program Files\Hell's Kitchen
  2009-04-11 10:36:32 ----A---- C:\Windows\Hell's Kitchen Setup Log.txt
  2009-04-11 10:35:29 ----D---- C:\Windows\Home Sweet Home 2 Kitchens and Baths
  2009-04-11 10:35:19 ----A---- C:\Windows\Home Sweet Home 2 Kitchens and Baths Setup Log.txt
  2009-04-11 10:31:08 ----D---- C:\Windows\Restaurant Rush
  2009-04-11 10:31:08 ----D---- C:\Program Files\Restaurant Rush
  2009-04-11 10:30:53 ----A---- C:\Windows\Restaurant Rush Setup Log.txt
  
  ======List of files/folders modified in the last 1 months======
  
  2009-04-30 16:10:07 ----D---- C:\Windows\Prefetch
  2009-04-30 16:10:06 ----D---- C:\Windows\Temp
  2009-04-30 16:04:53 ----D---- C:\Users\Nadia\AppData\Roaming\DNA
  2009-04-30 16:00:06 ----D---- C:\Program Files\Everest Poker
  2009-04-30 13:45:47 ----D---- C:\Windows\winsxs
  2009-04-30 13:45:36 ----SHD---- C:\System Volume Information
  2009-04-30 03:01:23 ----SHD---- C:\Windows\Installer
  2009-04-30 03:01:17 ----D---- C:\ProgramData\Microsoft Help
  2009-04-29 18:53:48 ----D---- C:\Windows\system32\catroot
  2009-04-29 00:23:35 ----D---- C:\Program Files\Everest Casino
  2009-04-28 14:16:48 ----D---- C:\Users\Nadia\AppData\Roaming\BitTorrent
  2009-04-27 10:14:14 ----D---- C:\Windows\system32\Tasks
  2009-04-27 09:20:38 ----D---- C:\Windows\System32
  2009-04-27 09:20:38 ----D---- C:\Windows\inf
  2009-04-27 09:20:38 ----A---- C:\Windows\system32\PerfStringBackup.INI
  2009-04-27 09:19:07 ----D---- C:\Windows
  2009-04-17 11:12:06 ----D---- C:\Windows\system32\drivers
  2009-04-17 11:10:33 ----D---- C:\Windows\Stand O Food 2
  2009-04-17 11:10:33 ----D---- C:\Windows\Ranch Rush
  2009-04-17 11:10:33 ----D---- C:\Windows\Puzzle Hero
  2009-04-17 11:10:33 ----D---- C:\Windows\Jojos Fashion Show 2 Las Cruces
  2009-04-17 11:10:33 ----D---- C:\Windows\Farm Frenzy 2
  2009-04-17 09:36:12 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
  2009-04-17 09:34:29 ----D---- C:\Program Files\Spybot - Search & Destroy
  2009-04-17 09:25:51 ----D---- C:\Windows\system32\catroot2
  2009-04-17 09:22:41 ----D---- C:\Windows\system32\wbem
  2009-04-17 09:22:41 ----D---- C:\Program Files\Windows Mail
  2009-04-17 09:22:38 ----D---- C:\Windows\system32\manifeststore
  2009-04-17 09:22:38 ----D---- C:\Windows\AppPatch
  2009-04-17 09:22:37 ----D---- C:\Program Files\Internet Explorer
  2009-04-17 02:01:26 ----D---- C:\Windows\Debug
  2009-04-14 15:02:25 ----RD---- C:\Program Files
  2009-04-14 12:05:41 ----D---- C:\Program Files\Java
  2009-04-12 16:15:37 ----D---- C:\ProgramData\Spybot - Search & Destroy
  2009-04-12 16:09:17 ----D---- C:\Program Files\CENEGA
  2009-04-11 10:58:41 ----D---- C:\Program Files\Games
  2009-04-11 10:36:56 ----HD---- C:\ProgramData
  2009-04-09 13:35:14 ----D---- C:\Users\Nadia\AppData\Roaming\dvdcss
  2009-04-06 16:57:24 ----A---- C:\Windows\system32\mrt.exe
  2009-04-06 15:57:48 ----A---- C:\Windows\system.ini
  2009-04-04 17:37:40 ----D---- C:\Windows\Tasks
  2009-04-04 14:11:07 ----D---- C:\Program Files\Windows Media Player
  2009-04-04 14:11:06 ----D---- C:\Windows\Help
  2009-04-04 14:00:32 ----D---- C:\Users\Nadia\AppData\Roaming\Zylom
  2009-04-04 14:00:32 ----D---- C:\Users\Nadia\AppData\Roaming\Identities
  2009-03-31 22:17:52 ----D---- C:\Windows\system32\WDI
  
  ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R1 ASPI32;ASPI32; C:\Windows\system32\drivers\ASPI32.sys [1999-09-10 25244]
  R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2009-02-05 23152]
  R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2009-02-05 114768]
  R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2009-02-05 51376]
  R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
  R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2009-02-05 51792]
  R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-02-26 3520512]
  R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-07-03 2152088]
  R3 PAC207;PC Camera; C:\Windows\system32\DRIVERS\PFC027.SYS [2007-10-25 616064]
  R3 PCASp50;PCASp50 NDIS Protocol Driver; C:\Windows\System32\Drivers\PCASp50.sys [2006-11-28 27072]
  R3 Ps2;PS2; C:\Windows\system32\DRIVERS\PS2.sys [2005-12-12 19072]
  R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-02-14 118784]
  R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
  S3 catchme;catchme; \??\C:\Users\Nadia\AppData\Local\Temp\catchme.sys []
  S3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584]
  S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384]
  S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864]
  S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
  S3 fcdabus;fcdabus; C:\Windows\system32\DRIVERS\fcdabus.sys []
  S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
  S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
  S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
  S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
  S3 PCAMp50;PCAMp50 NDIS Protocol Driver; C:\Windows\System32\Drivers\PCAMp50.sys [2006-11-28 28224]
  S3 usbbus;LGE Mobile Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2008-09-04 13056]
  S3 UsbDiag;LGE Mobile USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2008-09-04 19968]
  S3 USBModem;LGE Mobile USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2008-09-04 24832]
  S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
  S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-21 39936]
  S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
  S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
  S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]
  
  ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
  R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-02-26 655360]
  R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
  R2 CanalPlus.VOD;CanalPlus.VOD; C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [2009-04-29 188416]
  R2 ezSharedSvc;Easybits Shared Services for Windows; C:\Windows\system32\svchost.exe [2008-01-21 21504]
  R2 FTRTSVC;France Telecom Routing Table Service; C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [2007-12-11 65536]
  R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2008-03-14 94208]
  R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-21 21504]
  R2 LightScribeService;LightScribeService Direct Disc Labeling Service; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-03-17 73728]
  R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
  R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
  R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
  R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
  R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
  R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-21 21504]
  S3 GameConsoleService;GameConsoleService; C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2007-07-24 181800]
  S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-18 138168]
  S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
  S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
  S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
  S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
  S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
  
  -----------------EOF-----------------
  
  0
5. lalyla > lalyla
  
  tu ES toujours la?
  
  0
Réponse 3 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Salut,
Pour avancer Anthony5151 que je salue au passage ;-).

Désactive le Teatimer de Spybot :
- Lance Spybot
- Va dans Mode puis Mode avancé puis Outils puis Résident et décoche la case Tea timer.
Exemple sur cette image : = = = =>>> ICI <<<= = = =

**************

Télécharges ToolBar S&D ( de Eric_71 )
= = = = >>> En cliquant ici <<< = = = =

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipulation !!
* Clique droit sur l’exécutable puis sélectionne ‘Exécuter en tant qu’administrateur’pour lancer l’outil.
* Une fois fait, tape F pour sélectionner le Français
* Choisis l’option 1 (Recherche) et tape sur Entrée.
* Une fois le scan finit, un rapport va apparaître au format .txt.
* Copie-colle l’intégralité de son contenu dans ta prochaine réponse ...
Note :
Le rapport est sauvegardé ici : C:\TB.txt
Tuto si besoin ICI
0
1. lalyla
  
  merci beaucoup pour avoir pris le relais!
  voila ce que j ai
  
  Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
  X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz )
  BIOS : Phoenix - AwardBIOS v6.00PG
  USER : Nadia ( Administrator )
  BOOT : Normal boot
  Antivirus : avast! antivirus 4.8.1169 [VPS 081202-0] 4.8.1169 (Activated)
  C:\ (Local Disk) - NTFS - Total:287 Go (Free:179 Go)
  D:\ (Local Disk) - NTFS - Total:10 Go (Free:0 Go)
  E:\ (CD or DVD)
  F:\ (USB)
  H:\ (USB)
  I:\ (USB)
  J:\ (USB)
  
  "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
  Option : [1] ( 30/04/2009|17:13 )
  
  [ UAC => 1 ]
  
  -----------\\ Recherche de Fichiers / Dossiers ...
  
  C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dealio
  C:\Program Files\Dealio
  C:\Program Files\Dealio\DealioAU.exe
  C:\Program Files\Dealio\kb127
  C:\Program Files\Dealio\SearchSettingsKit.exe
  C:\Program Files\Dealio\kb127\Dealio Deskbar.exe
  C:\Program Files\Dealio\kb127\Dealio.dll
  C:\Program Files\Dealio\kb127\DealioRes409.dll
  C:\Program Files\Dealio\kb127\res
  C:\Program Files\Dealio\kb127\resDN
  C:\Program Files\Dealio\kb127\rules
  C:\Program Files\Dealio\kb127\temp
  C:\Program Files\Dealio\kb127\res\alerts.gif
  C:\Program Files\Dealio\kb127\res\alerts_over.gif
  C:\Program Files\Dealio\kb127\res\alerts_rec.gif
  C:\Program Files\Dealio\kb127\res\alerts_rec_over.gif
  C:\Program Files\Dealio\kb127\res\chevron-small.gif
  C:\Program Files\Dealio\kb127\res\DealioSearch.html
  C:\Program Files\Dealio\kb127\res\deals-leftcap.gif
  C:\Program Files\Dealio\kb127\res\deal_report.jpg
  C:\Program Files\Dealio\kb127\res\ebay_login.jpg
  C:\Program Files\Dealio\kb127\res\err_mainwindow.html
  C:\Program Files\Dealio\kb127\res\err_toolbar.html
  C:\Program Files\Dealio\kb127\res\global_scripts.js
  C:\Program Files\Dealio\kb127\res\headerbgthin.jpg
  C:\Program Files\Dealio\kb127\res\highlight-bg.png
  C:\Program Files\Dealio\kb127\res\logo.gif
  C:\Program Files\Dealio\kb127\res\logo_over.gif
  C:\Program Files\Dealio\kb127\res\man_toolbar.css
  C:\Program Files\Dealio\kb127\res\man_toolbar.html
  C:\Program Files\Dealio\kb127\res\man_toolbar.js
  C:\Program Files\Dealio\kb127\res\man_toolbarl.js
  C:\Program Files\Dealio\kb127\res\post-this-deal.gif
  C:\Program Files\Dealio\kb127\res\post-this-deal_over.gif
  C:\Program Files\Dealio\kb127\res\scripts.js
  C:\Program Files\Dealio\kb127\res\scroller.js
  C:\Program Files\Dealio\kb127\res\search-chevron.gif
  C:\Program Files\Dealio\kb127\res\search-chevron_over.gif
  C:\Program Files\Dealio\kb127\res\search_bg_blink.gif
  C:\Program Files\Dealio\kb127\res\separator.gif
  C:\Program Files\Dealio\kb127\res\settings.gif
  C:\Program Files\Dealio\kb127\res\settings_over.gif
  C:\Program Files\Dealio\kb127\res\yahoo-search.png
  C:\Program Files\Dealio\kb127\resDN\bottom.gif
  C:\Program Files\Dealio\kb127\resDN\chevron_down.gif
  C:\Program Files\Dealio\kb127\resDN\chevron_up.gif
  C:\Program Files\Dealio\kb127\resDN\close.gif
  C:\Program Files\Dealio\kb127\resDN\deskbar.css
  C:\Program Files\Dealio\kb127\resDN\deskbar.js
  C:\Program Files\Dealio\kb127\resDN\dispatch_helper.js
  C:\Program Files\Dealio\kb127\resDN\ebay_compatible.jpg
  C:\Program Files\Dealio\kb127\resDN\logo.gif
  C:\Program Files\Dealio\kb127\resDN\logo_chevron_bkg.gif
  C:\Program Files\Dealio\kb127\resDN\losing.gif
  C:\Program Files\Dealio\kb127\resDN\lost.gif
  C:\Program Files\Dealio\kb127\resDN\man_deskbar.html
  C:\Program Files\Dealio\kb127\resDN\menu_arrow.gif
  C:\Program Files\Dealio\kb127\resDN\menu_check.gif
  C:\Program Files\Dealio\kb127\resDN\no_image.gif
  C:\Program Files\Dealio\kb127\resDN\prod_img.gif
  C:\Program Files\Dealio\kb127\resDN\search_chevron.gif
  C:\Program Files\Dealio\kb127\resDN\spacer.gif
  C:\Program Files\Dealio\kb127\resDN\textfield_bkg.gif
  C:\Program Files\Dealio\kb127\resDN\top.gif
  C:\Program Files\Dealio\kb127\resDN\unknown.gif
  C:\Program Files\Dealio\kb127\resDN\winning.gif
  C:\Program Files\Dealio\kb127\resDN\won.gif
  C:\Program Files\Dealio\kb127\rules\index.76.35
  C:\Program Files\Dealio\kb127\rules\rules.1.10.76
  C:\Program Files\Dealio\kb127\rules\rules.1.109.43
  C:\Program Files\Dealio\kb127\rules\rules.1.110.43
  C:\Program Files\Dealio\kb127\rules\rules.1.12.52
  C:\Program Files\Dealio\kb127\rules\rules.1.13.58
  C:\Program Files\Dealio\kb127\rules\rules.1.130.58
  C:\Program Files\Dealio\kb127\rules\rules.1.135.50
  C:\Program Files\Dealio\kb127\rules\rules.1.153.44
  C:\Program Files\Dealio\kb127\rules\rules.1.155.43
  C:\Program Files\Dealio\kb127\rules\rules.1.156.49
  C:\Program Files\Dealio\kb127\rules\rules.1.16.60
  C:\Program Files\Dealio\kb127\rules\rules.1.161.52
  C:\Program Files\Dealio\kb127\rules\rules.1.178.66
  C:\Program Files\Dealio\kb127\rules\rules.1.184.55
  C:\Program Files\Dealio\kb127\rules\rules.1.188.52
  C:\Program Files\Dealio\kb127\rules\rules.1.189.45
  C:\Program Files\Dealio\kb127\rules\rules.1.196.43
  C:\Program Files\Dealio\kb127\rules\rules.1.198.56
  C:\Program Files\Dealio\kb127\rules\rules.1.199.43
  C:\Program Files\Dealio\kb127\rules\rules.1.200.53
  C:\Program Files\Dealio\kb127\rules\rules.1.201.43
  C:\Program Files\Dealio\kb127\rules\rules.1.202.43
  C:\Program Files\Dealio\kb127\rules\rules.1.203.71
  C:\Program Files\Dealio\kb127\rules\rules.1.205.62
  C:\Program Files\Dealio\kb127\rules\rules.1.213.71
  C:\Program Files\Dealio\kb127\rules\rules.1.214.49
  C:\Program Files\Dealio\kb127\rules\rules.1.215.43
  C:\Program Files\Dealio\kb127\rules\rules.1.216.67
  C:\Program Files\Dealio\kb127\rules\rules.1.217.67
  C:\Program Files\Dealio\kb127\rules\rules.1.218.52
  C:\Program Files\Dealio\kb127\rules\rules.1.219.43
  C:\Program Files\Dealio\kb127\rules\rules.1.220.43
  C:\Program Files\Dealio\kb127\rules\rules.1.221.57
  C:\Program Files\Dealio\kb127\rules\rules.1.222.43
  C:\Program Files\Dealio\kb127\rules\rules.1.223.68
  C:\Program Files\Dealio\kb127\rules\rules.1.226.68
  C:\Program Files\Dealio\kb127\rules\rules.1.227.43
  C:\Program Files\Dealio\kb127\rules\rules.1.228.62
  C:\Program Files\Dealio\kb127\rules\rules.1.229.76
  C:\Program Files\Dealio\kb127\rules\rules.1.23.63
  C:\Program Files\Dealio\kb127\rules\rules.1.239.43
  C:\Program Files\Dealio\kb127\rules\rules.1.24.43
  C:\Program Files\Dealio\kb127\rules\rules.1.240.43
  C:\Program Files\Dealio\kb127\rules\rules.1.241.43
  C:\Program Files\Dealio\kb127\rules\rules.1.242.43
  C:\Program Files\Dealio\kb127\rules\rules.1.243.43
  C:\Program Files\Dealio\kb127\rules\rules.1.244.63
  C:\Program Files\Dealio\kb127\rules\rules.1.245.43
  C:\Program Files\Dealio\kb127\rules\rules.1.247.43
  C:\Program Files\Dealio\kb127\rules\rules.1.248.43
  C:\Program Files\Dealio\kb127\rules\rules.1.249.43
  C:\Program Files\Dealio\kb127\rules\rules.1.250.43
  C:\Program Files\Dealio\kb127\rules\rules.1.251.43
  C:\Program Files\Dealio\kb127\rules\rules.1.252.43
  C:\Program Files\Dealio\kb127\rules\rules.1.253.43
  C:\Program Files\Dealio\kb127\rules\rules.1.254.43
  C:\Program Files\Dealio\kb127\rules\rules.1.255.43
  C:\Program Files\Dealio\kb127\rules\rules.1.256.43
  C:\Program Files\Dealio\kb127\rules\rules.1.257.43
  C:\Program Files\Dealio\kb127\rules\rules.1.279.43
  C:\Program Files\Dealio\kb127\rules\rules.1.28.58
  C:\Program Files\Dealio\kb127\rules\rules.1.282.75
  C:\Program Files\Dealio\kb127\rules\rules.1.283.43
  C:\Program Files\Dealio\kb127\rules\rules.1.284.43
  C:\Program Files\Dealio\kb127\rules\rules.1.289.67
  C:\Program Files\Dealio\kb127\rules\rules.1.290.62
  C:\Program Files\Dealio\kb127\rules\rules.1.291.61
  C:\Program Files\Dealio\kb127\rules\rules.1.296.43
  C:\Program Files\Dealio\kb127\rules\rules.1.297.43
  C:\Program Files\Dealio\kb127\rules\rules.1.304.43
  C:\Program Files\Dealio\kb127\rules\rules.1.307.43
  C:\Program Files\Dealio\kb127\rules\rules.1.308.75
  C:\Program Files\Dealio\kb127\rules\rules.1.31.47
  C:\Program Files\Dealio\kb127\rules\rules.1.310.46
  C:\Program Files\Dealio\kb127\rules\rules.1.311.43
  C:\Program Files\Dealio\kb127\rules\rules.1.315.43
  C:\Program Files\Dealio\kb127\rules\rules.1.316.43
  C:\Program Files\Dealio\kb127\rules\rules.1.317.43
  C:\Program Files\Dealio\kb127\rules\rules.1.318.43
  C:\Program Files\Dealio\kb127\rules\rules.1.319.49
  C:\Program Files\Dealio\kb127\rules\rules.1.32.48
  C:\Program Files\Dealio\kb127\rules\rules.1.334.44
  C:\Program Files\Dealio\kb127\rules\rules.1.335.60
  C:\Program Files\Dealio\kb127\rules\rules.1.336.44
  C:\Program Files\Dealio\kb127\rules\rules.1.337.44
  C:\Program Files\Dealio\kb127\rules\rules.1.338.75
  C:\Program Files\Dealio\kb127\rules\rules.1.339.47
  C:\Program Files\Dealio\kb127\rules\rules.1.34.43
  C:\Program Files\Dealio\kb127\rules\rules.1.340.47
  C:\Program Files\Dealio\kb127\rules\rules.1.341.47
  C:\Program Files\Dealio\kb127\rules\rules.1.349.50
  C:\Program Files\Dealio\kb127\rules\rules.1.35.48
  C:\Program Files\Dealio\kb127\rules\rules.1.350.50
  C:\Program Files\Dealio\kb127\rules\rules.1.351.51
  C:\Program Files\Dealio\kb127\rules\rules.1.352.54
  C:\Program Files\Dealio\kb127\rules\rules.1.353.51
  C:\Program Files\Dealio\kb127\rules\rules.1.354.51
  C:\Program Files\Dealio\kb127\rules\rules.1.357.62
  C:\Program Files\Dealio\kb127\rules\rules.1.358.52
  C:\Program Files\Dealio\kb127\rules\rules.1.359.52
  C:\Program Files\Dealio\kb127\rules\rules.1.360.53
  C:\Program Files\Dealio\kb127\rules\rules.1.361.54
  C:\Program Files\Dealio\kb127\rules\rules.1.362.68
  C:\Program Files\Dealio\kb127\rules\rules.1.363.58
  C:\Program Files\Dealio\kb127\rules\rules.1.364.54
  C:\Program Files\Dealio\kb127\rules\rules.1.365.53
  C:\Program Files\Dealio\kb127\rules\rules.1.367.56
  C:\Program Files\Dealio\kb127\rules\rules.1.368.58
  C:\Program Files\Dealio\kb127\rules\rules.1.369.55
  C:\Program Files\Dealio\kb127\rules\rules.1.370.56
  C:\Program Files\Dealio\kb127\rules\rules.1.371.56
  C:\Program Files\Dealio\kb127\rules\rules.1.372.57
  C:\Program Files\Dealio\kb127\rules\rules.1.373.55
  C:\Program Files\Dealio\kb127\rules\rules.1.375.56
  C:\Program Files\Dealio\kb127\rules\rules.1.376.57
  C:\Program Files\Dealio\kb127\rules\rules.1.377.55
  C:\Program Files\Dealio\kb127\rules\rules.1.378.65
  C:\Program Files\Dealio\kb127\rules\rules.1.384.58
  C:\Program Files\Dealio\kb127\rules\rules.1.386.71
  C:\Program Files\Dealio\kb127\rules\rules.1.387.59
  C:\Program Files\Dealio\kb127\rules\rules.1.388.59
  C:\Program Files\Dealio\kb127\rules\rules.1.389.59
  C:\Program Files\Dealio\kb127\rules\rules.1.390.60
  C:\Program Files\Dealio\kb127\rules\rules.1.391.60
  C:\Program Files\Dealio\kb127\rules\rules.1.392.60
  C:\Program Files\Dealio\kb127\rules\rules.1.393.60
  C:\Program Files\Dealio\kb127\rules\rules.1.394.60
  C:\Program Files\Dealio\kb127\rules\rules.1.396.61
  C:\Program Files\Dealio\kb127\rules\rules.1.397.61
  C:\Program Files\Dealio\kb127\rules\rules.1.398.60
  C:\Program Files\Dealio\kb127\rules\rules.1.399.60
  C:\Program Files\Dealio\kb127\rules\rules.1.403.61
  C:\Program Files\Dealio\kb127\rules\rules.1.404.63
  C:\Program Files\Dealio\kb127\rules\rules.1.405.61
  C:\Program Files\Dealio\kb127\rules\rules.1.406.61
  C:\Program Files\Dealio\kb127\rules\rules.1.407.76
  C:\Program Files\Dealio\kb127\rules\rules.1.408.63
  C:\Program Files\Dealio\kb127\rules\rules.1.409.61
  C:\Program Files\Dealio\kb127\rules\rules.1.412.62
  C:\Program Files\Dealio\kb127\rules\rules.1.413.62
  C:\Program Files\Dealio\kb127\rules\rules.1.414.62
  C:\Program Files\Dealio\kb127\rules\rules.1.415.62
  C:\Program Files\Dealio\kb127\rules\rules.1.416.62
  C:\Program Files\Dealio\kb127\rules\rules.1.417.62
  C:\Program Files\Dealio\kb127\rules\rules.1.418.62
  C:\Program Files\Dealio\kb127\rules\rules.1.419.62
  C:\Program Files\Dealio\kb127\rules\rules.1.420.62
  C:\Program Files\Dealio\kb127\rules\rules.1.421.62
  C:\Program Files\Dealio\kb127\rules\rules.1.423.63
  C:\Program Files\Dealio\kb127\rules\rules.1.424.63
  C:\Program Files\Dealio\kb127\rules\rules.1.425.63
  C:\Program Files\Dealio\kb127\rules\rules.1.426.63
  C:\Program Files\Dealio\kb127\rules\rules.1.427.63
  C:\Program Files\Dealio\kb127\rules\rules.1.428.65
  C:\Program Files\Dealio\kb127\rules\rules.1.429.63
  C:\Program Files\Dealio\kb127\rules\rules.1.430.63
  C:\Program Files\Dealio\kb127\rules\rules.1.432.65
  C:\Program Files\Dealio\kb127\rules\rules.1.433.64
  C:\Program Files\Dealio\kb127\rules\rules.1.434.65
  C:\Program Files\Dealio\kb127\rules\rules.1.435.64
  C:\Program Files\Dealio\kb127\rules\rules.1.436.76
  C:\Program Files\Dealio\kb127\rules\rules.1.437.64
  C:\Program Files\Dealio\kb127\rules\rules.1.438.71
  C:\Program Files\Dealio\kb127\rules\rules.1.439.71
  C:\Program Files\Dealio\kb127\rules\rules.1.440.75
  C:\Program Files\Dealio\kb127\rules\rules.1.442.73
  C:\Program Files\Dealio\kb127\rules\rules.1.443.73
  C:\Program Files\Dealio\kb127\rules\rules.1.444.73
  C:\Program Files\Dealio\kb127\rules\rules.1.445.68
  C:\Program Files\Dealio\kb127\rules\rules.1.446.69
  C:\Program Files\Dealio\kb127\rules\rules.1.450.67
  C:\Program Files\Dealio\kb127\rules\rules.1.451.67
  C:\Program Files\Dealio\kb127\rules\rules.1.452.68
  C:\Program Files\Dealio\kb127\rules\rules.1.453.68
  C:\Program Files\Dealio\kb127\rules\rules.1.454.69
  C:\Program Files\Dealio\kb127\rules\rules.1.456.69
  C:\Program Files\Dealio\kb127\rules\rules.1.457.75
  C:\Program Files\Dealio\kb127\rules\rules.1.458.70
  C:\Program Files\Dealio\kb127\rules\rules.1.459.70
  C:\Program Files\Dealio\kb127\rules\rules.1.460.69
  C:\Program Files\Dealio\kb127\rules\rules.1.462.74
  C:\Program Files\Dealio\kb127\rules\rules.1.463.69
  C:\Program Files\Dealio\kb127\rules\rules.1.464.70
  C:\Program Files\Dealio\kb127\rules\rules.1.465.68
  C:\Program Files\Dealio\kb127\rules\rules.1.468.70
  C:\Program Files\Dealio\kb127\rules\rules.1.469.70
  C:\Program Files\Dealio\kb127\rules\rules.1.470.70
  C:\Program Files\Dealio\kb127\rules\rules.1.471.73
  C:\Program Files\Dealio\kb127\rules\rules.1.472.70
  C:\Program Files\Dealio\kb127\rules\rules.1.478.74
  C:\Program Files\Dealio\kb127\rules\rules.1.479.73
  C:\Program Files\Dealio\kb127\rules\rules.1.480.68
  C:\Program Files\Dealio\kb127\rules\rules.1.481.71
  C:\Program Files\Dealio\kb127\rules\rules.1.482.74
  C:\Program Files\Dealio\kb127\rules\rules.1.49.67
  C:\Program Files\Dealio\kb127\rules\rules.1.50.43
  C:\Program Files\Dealio\kb127\rules\rules.1.500.71
  C:\Program Files\Dealio\kb127\rules\rules.1.501.74
  C:\Program Files\Dealio\kb127\rules\rules.1.502.71
  C:\Program Files\Dealio\kb127\rules\rules.1.51.69
  C:\Program Files\Dealio\kb127\rules\rules.1.52.72
  C:\Program Files\Dealio\kb127\rules\rules.1.520.76
  C:\Program Files\Dealio\kb127\rules\rules.1.521.76
  C:\Program Files\Dealio\kb127\rules\rules.1.522.76
  C:\Program Files\Dealio\kb127\rules\rules.1.53.51
  C:\Program Files\Dealio\kb127\rules\rules.1.531.76
  C:\Program Files\Dealio\kb127\rules\rules.1.532.75
  C:\Program Files\Dealio\kb127\rules\rules.1.534.75
  C:\Program Files\Dealio\kb127\rules\rules.1.54.47
  C:\Program Files\Dealio\kb127\rules\rules.1.55.45
  C:\Program Files\Dealio\kb127\rules\rules.1.56.69
  C:\Program Files\Dealio\kb127\rules\rules.1.57.43
  C:\Program Files\Dealio\kb127\rules\rules.1.58.47
  C:\Program Files\Dealio\kb127\rules\rules.1.593.76
  C:\Program Files\Dealio\kb127\rules\rules.1.595.76
  C:\Program Files\Dealio\kb127\rules\rules.1.63.57
  C:\Program Files\Dealio\kb127\rules\rules.1.66.47
  C:\Program Files\Dealio\kb127\rules\rules.1.70.75
  C:\Program Files\Dealio\kb127\rules\rules.1.71.43
  C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Hotbar
  C:\ProgramData\HotbarSA
  C:\ProgramData\HotbarSA\HotbarSA.dat
  C:\ProgramData\HotbarSA\HotbarSAAbout.mht
  C:\ProgramData\HotbarSA\HotbarSAau.dat
  C:\ProgramData\HotbarSA\HotbarSAEULA.mht
  C:\ProgramData\HotbarSA\HotbarSA_kyf_update.dat
  C:\Program Files\Search Settings
  C:\Program Files\Search Settings\kb127
  C:\Program Files\Search Settings\SearchSettings.exe
  C:\Program Files\Search Settings\kb127\res
  C:\Program Files\Search Settings\kb127\SearchSettings.dll
  C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
  C:\Program Files\Search Settings\kb127\temp
  C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\SmartShopper
  C:\Program Files\SmartShopper
  C:\Program Files\SmartShopper\Bin
  C:\Program Files\SmartShopper\cs
  C:\Program Files\SmartShopper\Bin\2.5.0
  C:\Program Files\SmartShopper\cs\antiphishing
  C:\Program Files\SmartShopper\cs\antiphishing\antiphishing.html
  C:\Program Files\SmartShopper\cs\antiphishing\phishAlert.gif
  C:\Program Files\SmartShopper\cs\antiphishing\x.gif
  C:\Program Files\SmartShopper\cs\antiphishing\xActive.gif
  
  -----------\\ [..\Internet Explorer\Main]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
  "Local Page"="C:\\Windows\\system32\\blank.htm"
  "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
  "Start Page"="http://lo.st#home"
  "Default_Page_URL"="https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF"
  "Url"="http://www.microsoft.com/athome/community/rss.xml"
  "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
  "Url"="http://www.microsoft.com/atwork/community/rss.xml"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
  "Start Page"="https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF"
  "Default_Page_URL"="https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF"
  "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
  "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
  
  --------------------\\ Recherche d'autres infections
  
  --------------------\\ Cracks & Keygens ..
  
  C:\Users\Nadia\AppData\Local\Zylom Games\Insaniquarium Deluxe\images\EggCrack1.gif
  C:\Users\Nadia\AppData\Local\Zylom Games\Insaniquarium Deluxe\images\EggCrack2.gif
  C:\Users\Nadia\AppData\Local\Zylom Games\Insaniquarium Deluxe\images\_EggCrack1.gif
  C:\Users\Nadia\AppData\Local\Zylom Games\Insaniquarium Deluxe\images\_EggCrack2.gif
  C:\Users\Nadia\AppData\Roaming\BitTorrent\Monopoly (2008) PC Game -No Crack Needed-.rar.torrent
  C:\Users\Nadia\Documents\Documentation\Crack
  C:\Users\Nadia\Documents\Documentation\Crack\Sims2EP7.exe
  C:\PROGRA~2\Fugazo\Cooking Academy\cached\sounds\eggcrack.wav
  
  [ UAC => 1 ]
  
  1 - "C:\ToolBar SD\TB_1.txt" - 30/04/2009|17:13 - Option : [1]
  
  -----------\\ Fin du rapport a 17:13:28,62
  
  0
2. lalyla
  
  si tu ve on continuera demain et merci pour tout
  
  0
3. lalyla
  
  pour continuer est ce que je dois reésactiver les comptes utilisateurs?
  
  0
Réponse 4 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

- Évite les cracks (vecteurs d'infection !)
- Je te déconseille d’installer des toolbars (barres d’outils sur ton navigateur).
Regarde cet article qui explique pourquoi les toolbars, c’est pas obligatoire :
https://forum.malekal.com/viewtopic.php?f=45&t=6173
Merci à Malekal pour cet article.
Si tu lis bien, tu verras que souvent elles sont infectieuses car elles t’espionnent sur le net …

*********

Désactive l’UAC (User Account Control) le temps de la désinfection.
Démarrer > Panneau de configuration > Comptes d’utilisateurs > Désactiver le contrôle des comptes d’utilisateur.
(Manipulation inverse pour le remettre en fin de désinfection).
(Cela va permettre aux outils de désinfection de travailler correctement).

********

Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipulation !!

Relance Toolbar-S&D en cliquant droit sur le raccourci puis en sélectionnant ‘Exécuter en tant qu’administrateur’.
* Tape l’option 2 (Nettoyage) puis tapes sur Entrée.
Notes :
Ne touche à rien lors de la suppression !
Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
0
1. lalyla
  
  Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
  X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz )
  BIOS : Phoenix - AwardBIOS v6.00PG
  USER : Nadia ( Administrator )
  BOOT : Normal boot
  Antivirus : avast! antivirus 4.8.1169 [VPS 081202-0] 4.8.1169 (Activated)
  C:\ (Local Disk) - NTFS - Total:287 Go (Free:179 Go)
  D:\ (Local Disk) - NTFS - Total:10 Go (Free:1 Go)
  E:\ (CD or DVD)
  F:\ (USB)
  H:\ (USB)
  I:\ (USB)
  J:\ (USB)
  
  "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
  Option : [2] ( 30/04/2009|17:30 )
  
  [ UAC => 0 ]
  
  -----------\\ SUPPRESSION
  
  Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Dealio
  Supprime! - C:\Program Files\Dealio\DealioAU.exe
  Supprime! - C:\Program Files\Dealio\kb127
  Supprime! - C:\Program Files\Dealio\SearchSettingsKit.exe
  Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Hotbar
  Supprime! - C:\ProgramData\HotbarSA\HotbarSA.dat
  Supprime! - C:\ProgramData\HotbarSA\HotbarSAAbout.mht
  Supprime! - C:\ProgramData\HotbarSA\HotbarSAau.dat
  Supprime! - C:\ProgramData\HotbarSA\HotbarSAEULA.mht
  Supprime! - C:\ProgramData\HotbarSA\HotbarSA_kyf_update.dat
  Supprime! - C:\Program Files\Search Settings\kb127
  Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
  Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\SmartShopper
  Supprime! - C:\Program Files\SmartShopper\Bin
  Supprime! - C:\Program Files\SmartShopper\cs
  Supprime! - C:\Program Files\Dealio
  Supprime! - C:\ProgramData\HotbarSA
  Supprime! - C:\Program Files\Search Settings
  Supprime! - C:\Program Files\SmartShopper
  
  -----------\\ Recherche de Fichiers / Dossiers ...
  
  -----------\\ [..\Internet Explorer\Main]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
  "Local Page"="C:\\Windows\\system32\\blank.htm"
  "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
  "Start Page"="http://lo.st#home"
  "Default_Page_URL"="https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF"
  "Url"="http://www.microsoft.com/athome/community/rss.xml"
  "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
  "Url"="http://www.microsoft.com/atwork/community/rss.xml"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
  "Start Page"="https://www.msn.com/fr-fr/"
  "Default_Page_URL"="https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF"
  "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
  "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
  
  --------------------\\ Recherche d'autres infections
  
  --------------------\\ Cracks & Keygens ..
  
  C:\Users\Nadia\AppData\Local\Zylom Games\Insaniquarium Deluxe\images\EggCrack1.gif
  C:\Users\Nadia\AppData\Local\Zylom Games\Insaniquarium Deluxe\images\EggCrack2.gif
  C:\Users\Nadia\AppData\Local\Zylom Games\Insaniquarium Deluxe\images\_EggCrack1.gif
  C:\Users\Nadia\AppData\Local\Zylom Games\Insaniquarium Deluxe\images\_EggCrack2.gif
  C:\Users\Nadia\AppData\Roaming\BitTorrent\Monopoly (2008) PC Game -No Crack Needed-.rar.torrent
  C:\Users\Nadia\Documents\Documentation\Crack
  C:\Users\Nadia\Documents\Documentation\Crack\Sims2EP7.exe
  C:\PROGRA~2\Fugazo\Cooking Academy\cached\sounds\eggcrack.wav
  
  [ UAC => 1 ]
  
  1 - "C:\ToolBar SD\TB_1.txt" - 30/04/2009|17:13 - Option : [1]
  2 - "C:\ToolBar SD\TB_2.txt" - 30/04/2009|17:31 - Option : [2]
  
  -----------\\ Fin du rapport a 17:31:40,05
  
  0
2. lalyla
  
  bonjour me revoila!Quand tu est pret je suis prete car ca ne va pas mieux!
  
  0
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Réponse 5 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Télécharges Ad-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :
= = = =>>> En cliquant ici <<<= = = =

/!\ Déconnectes toi et fermes toutes applications en cours, désactive ton antivirus le temps de la manipulation/!\

* Double clique sur le programme d'installation, et installe le dans son emplacement par défaut. (C:\Program files)
* Clique droit sur l'icône Ad-remover située sur ton bureau puis sélectionne "Exécuter en tant qu’administrateur".
* Au menu principal choisi l'option "A".
* Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report(date).log )
(CTRL+A Pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note :

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
0
1. lalyla
  
  ON ME DIT QUE LE CONTROLE DES COMPTES EST Activé et que je doit le dire a celui qui m aide
  
  0
Réponse 6 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Fais la manipulation "Désactiver l'UAC".
0
1. lalyla
  
  Updated by C_XX on 29/04/2009 at 11:50
  Contact: AdRemover.contact@gmail.com
  Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
  
  Start at: 17:56:56, 30/04/2009 | Boot mode: Normal Boot
  Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
  Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
  Computer Name: PC-DE-NADIA
  Current User: Nadia - Administrator
  Drive(s):
  - C:\ (File System: NTFS)
  - D:\ (File System: NTFS)
  
  ============ Known Adwares Found ============
  
  .
  HKCU\Software\Grand Virtual
  HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Casino
  HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
  HKLM\Software\Trymedia Systems
  .
  C:\Program Files\Everest Casino
  C:\Program Files\Everest Poker
  C:\ProgramData\Trymedia
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Startm~1\Programs\Casino770
  C:\ProgramData\Microsoft\Windows\Startm~1\Programs\Everest Casino
  C:\ProgramData\Microsoft\Windows\Startm~1\Programs\Everest Poker
  C:\Users\Public\Desktop\Everest Casino.lnk
  C:\Users\Public\Desktop\Everest Poker.lnk
  C:\Windows\Prefetch\CSTART.EXE-1CF559E5.pf
  C:\Windows\Prefetch\CSTART.EXE-2FD469B1.pf
  C:\Windows\Prefetch\EVEREST CASINO.EXE-464E0107.pf
  C:\Windows\Prefetch\EVEREST POKER.EXE-8A933597.pf
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Cookies\nadia@atdmt[1].txt
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Cookies\nadia@atdmt[2].txt
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Cookies\nadia@bs.serving-sys[2].txt
  
  +-----------------| Eorezo Elements Found:
  
  HKCR\EoRezoBHO.EoBho
  HKCR\EoRezoBHO.EoBho.1
  HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
  HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
  HKCU\Software\EoRezo
  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
  HKLM\Software\Classes\EoRezoBHO.EoBho
  HKLM\Software\Classes\EoRezoBHO.EoBho.1
  HKLM\Software\Classes\TypeLib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
  HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
  .
  C:\Users\Nadia\AppData\Roaming\EoRezo
  
  +-----------------| It's TV Elements Found:
  
  .
  
  +-----------------| Sweetim Elements Found:
  
  .
  
  +-----------------| Added Scan:
  
  ---- Mozilla FireFox Version 2.0 ----
  
  ProfilePath: ibov53do.default (Nadia)
  .
  Prefs.js: Browser.Search.DefaultEngineName: "Google"
  Prefs.js: Browser.Search.SelectedEngine: "Google"
  Prefs.js: Browser.Search.DefaultUrl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
  .
  (Prefs.js) FOUND: user_pref("browser.startup.homepage", "http://lo.st#home");
  .
  .
  .
  .
  
  ---- Internet Explorer Version 7.0.6001.18000 ----
  
  [HKEY_CURRENT_USER\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Pavilion&pf=cndt
  Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
  Start page: hxxp://lo.st#home
  
  [HKEY_USERS\S-1-5-21-2806364784-3178933694-1430288425-1000\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Pavilion&pf=cndt
  Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
  Start page: hxxp://lo.st#home
  
  [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=83&bd=Pavilion&pf=cndt
  Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
  Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
  Start page: hxxp://www.msn.com/
  
  [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
  
  Tabs: hxxp://ieframe.dll/tabswelcome.htm
  
  +---------------------------------------------------------------------------+
  
  4026 Byte(s) - C:\Ad-Report-Scan-30.04.2009.log
  
  1 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
  0 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE
  
  End at: 18:04:48 | 30/04/2009
  .
  +-----------------| E.O.F
  .
  
  0
2. lalyla
  
  y a t il quelqu un? Ne me laisser pas tomber maintenant! PLEASE
  
  0
Réponse 7 / 64
anthony5151 Messages postés 10927 Statut Contributeur sécurité 790

Salut à tous,

Je te laisse finir crapoulou ;)
0
Réponse 8 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Merci afideg pour ton intervention et comme tu veux anthony ... c'est ton post quand même ;-).

Everest Casino
ET
Everest Poker
ET
Trymedia

Ce sont des logiciels qui infectent ton PC dans la mesure pù ils récoltent éventuellement des infos sur ta navigation sur la toile et te balancent probablement des pages de pub...
Veux-tu que je te donne la procédure pour te débarrasser de ces cochonneries ?!
0
Réponse 9 / 64
afideg Messages postés 10466 Date d'inscription Statut Contributeur sécurité Dernière intervention 602

Salut crapoulou,

De rien, c'est avec plaisir et amitié.

Cit. «Ce sont des logiciels qui infectent ton PC dans la mesure où ils récoltent éventuellement des infos sur ta navigation sur la toile et te balancent probablement des pages de pub...
Veux-tu que je te donne la procédure pour te débarrasser de ces cochonneries ?!»
==> Que de précaution et de respect; mais c'est ainsi que je préfère.
Mais alors, j'ajouterais: «Si tu tiens à ces saletés, hésite à venir t'en plaindre prochainement».
Qu'en penses-tu ? ==> oui, je devine que c'est à la limite du "service d'entraide". ;)
Mais il semble qu'il faille parfois bousculer certains internautes aventuriers ou audacieux.

Ouf! J'ai osé en parler.
Merci

Al.
0
Réponse 10 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Je la ferais volontiers l'option 2 mais je préviens l'internaute qu'on va le faire.
Si c'était pas clair : on VA le virer, mais je te préviens. T'as pas le choix de le garder ou non :D
0
1. lalyla
  
  salut c est moi! alors qu est ce que je dois faire? J y comprend rien!
  
  0
Réponse 11 / 64
afideg Messages postés 10466 Date d'inscription Statut Contributeur sécurité Dernière intervention 602

Hi,hi.
Oui c'est clair.
Option 3: «Je supprime, et tu retélécharges à ta guise si tu ne peux t'en passer. Donne-moi ton accord sur ce que tu acceptes de voir supprimer dans l'immédiat.»
Je me teste. ;)
Al.
0
Réponse 12 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

On va virer Everest poker et Everest casino :

Nettoyage avec Ad-Remover :

* /!\ Déconnecte toi et fermes toutes applications en cours /!\

* Relance "Ad-remover" : au menu principal choisi l'option "B".
= = = =>>> Comme sur cette image <<<= = = =

* Ensuite coche :

Knowm adwares
Eorezo
Pour ‘cocher’, tape chaque numéro correspondant puis entrée pour valider.

* Puis tape S
* Le programme va travailler ...
* Poste le rapport qui apparaît à la fin + un nouveau rapport Hijackthis pour analyse.

(Le rapport est sauvegardé aussi sous C:\Ad-report.log.)

/!\ Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide) /!\
0
1. lalyla
  
  tu crois qu il faut absolument les virer? si oui ok !
  
  0
  1. lalyla > lalyla
    
    j avais ce probleme avant de les installer alors je sais pas!
    
    0
Réponse 13 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Il sont infectieux quoi qu'il en soit.
0
1. lalyla
  
  VOILA LE RAPPORT
  c est la galere j espere qu on va y arriver!
  
  Updated by C_XX on 29/04/2009 at 11:50
  Contact: AdRemover.contact@gmail.com
  Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
  
  **** LIMITED TO ****
  
  Known Adwares
  Eorezo
  
  ********************
  
  Start at: 23:55:33, 30/04/2009 | Boot mode: Normal Boot
  Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
  Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
  Computer Name: PC-DE-NADIA
  Current User: Nadia - Administrator
  Drive(s):
  - C:\ (File System: NTFS)
  - D:\ (File System: NTFS)
  
  (!) ---- IE start pages/Tabs reset
  
  ============ Known Adwares Deleted ============
  
  .
  HKCU\Software\Grand Virtual
  HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Casino
  HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
  HKLM\Software\Trymedia Systems
  .
  C:\Program Files\Everest Casino
  C:\Program Files\Everest Poker
  C:\ProgramData\Trymedia
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Startm~1\Programs\Casino770
  C:\ProgramData\Microsoft\Windows\Startm~1\Programs\Everest Casino
  C:\ProgramData\Microsoft\Windows\Startm~1\Programs\Everest Poker
  C:\Users\Public\Desktop\Everest Casino.lnk
  C:\Users\Public\Desktop\Everest Poker.lnk
  C:\Windows\Prefetch\CSTART.EXE-1CF559E5.pf
  C:\Windows\Prefetch\CSTART.EXE-2FD469B1.pf
  C:\Windows\Prefetch\EVEREST CASINO.EXE-464E0107.pf
  C:\Windows\Prefetch\EVEREST POKER.EXE-8A933597.pf
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Cookies\nadia@atdmt[1].txt
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Cookies\nadia@atdmt[2].txt
  C:\Users\Nadia\AppData\Roaming\Microsoft\Windows\Cookies\nadia@bs.serving-sys[2].txt
  
  +-----------------| Eorezo Elements Deleted :
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Eoengine
  HKCR\EoRezoBHO.EoBho
  HKCR\EoRezoBHO.EoBho.1
  HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
  HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
  HKCU\Software\EoRezo
  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
  .
  C:\Users\Nadia\AppData\Roaming\EoRezo
  
  (!) ---- Temp files deleted.
  (!) ---- Recycle bin emptied in all drives.
  
  +-----------------| Added Scan :
  
  ---- Mozilla FireFox Version 2.0 ----
  
  ProfilePath: ibov53do.default (Nadia)
  .
  Prefs.js: Browser.Search.DefaultEngineName: "Google"
  Prefs.js: Browser.Search.SelectedEngine: "Google"
  Prefs.js: Browser.Search.DefaultUrl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
  .
  (Prefs.js) REMOVED: user_pref("browser.startup.homepage", "http://lo.st#home");
  .
  .
  .
  .
  
  ---- Internet Explorer Version 7.0.6001.18000 ----
  
  [HKEY_CURRENT_USER\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
  Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
  Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  
  [HKEY_USERS\S-1-5-21-2806364784-3178933694-1430288425-1000\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
  Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
  Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  
  [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
  
  Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  Search bar: hxxp://search.msn.com/spbasic.htm
  Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  Start page: hxxp://fr.msn.com/
  
  [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
  
  Tabs: hxxp://ieframe.dll/tabswelcome.htm
  
  +---------------------------------------------------------------------------+
  
  4282 Byte(s) - C:\Ad-Report-Clean-30.04.2009.log
  4255 Byte(s) - C:\Ad-Report-Scan-30.04.2009.log
  
  21 File(s) - C:\Program Files\Ad-remover\TOOLS\BACKUP
  9 File(s) - C:\Program Files\Ad-remover\TOOLS\QUARANTINE
  
  End at: 0:04:10 | 01/05/2009
  .
  +-----------------| E.O.F
  .
  
  0
Réponse 14 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Télécharge et installe UsbFix de C_XX & Chiquitine29 :
= = = = >>> En cliquant ici <<< = = = =

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d avoir été infectés sans les ouvrir !

* Double clique sur le raccourci UsbFix présent sur ton bureau.
* Choisis l’option 1 (Recherche)
* Laisse travailler l’outil.
* Ensuite poste l’intégralité du rapport UsbFix.txt qui apparaîtra.

Notes :
- Le rapport UsbFix.txt est sauvegardé a la racine du disque. (C:\UsbFix.txt)
(CTRL+A Pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller sur le forum).
- "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
0
1. lalyla
  
  # User : Nadia (Administrateurs) # PC-DE-NADIA
  # Update on 30/04/09 by Chiquitine29, C_XX & Chimay8
  # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
  # Start at: 00:13:51 | 01/05/2009
  
  # Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz
  # Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
  # Internet Explorer 7.0.6001.18000
  # Windows Firewall Status : Disabled
  # AV : avast! antivirus 4.8.1169 [VPS 081202-0] 4.8.1169 [ Enabled | Updated ]
  
  # C:\ # Disque fixe local # 287,46 Go (179,35 Go free) [HP] # NTFS
  # D:\ # Disque fixe local # 10,63 Go (1,1 Go free) [FACTORY_IMAGE] # NTFS
  # E:\ # Disque CD-ROM
  # F:\ # Disque amovible
  # H:\ # Disque amovible
  # I:\ # Disque amovible
  # J:\ # Disque amovible
  
  ############################## [ Processus actifs ]
  
  C:\Windows\System32\smss.exe
  C:\Windows\system32\csrss.exe
  C:\WINDOWS\SYSTEM32\wininit.exe
  C:\Windows\system32\csrss.exe
  C:\Windows\system32\services.exe
  C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsm.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\Ati2evxx.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\SLsvc.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\Ati2evxx.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\Windows\System32\spoolsv.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\Dwm.exe
  C:\WINDOWS\SYSTEM32\taskeng.exe
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\WINDOWS\SYSTEM32\taskeng.exe
  C:\Windows\RtHDVCpl.exe
  C:\hp\support\hpsysdrv.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
  C:\Program Files\Alwil Software\Avast4\ashDisp.exe
  c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
  C:\Windows\PixArt\PAC207\Monitor.exe
  C:\Program Files\Unlocker\UnlockerAssistant.exe
  C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
  C:\Windows\ehome\ehtray.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Windows\ehome\ehmsas.exe
  C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
  C:\Windows\system32\svchost.exe
  c:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\SearchIndexer.exe
  C:\Windows\system32\WUDFHost.exe
  C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
  C:\Program Files\DNA\btdna.exe
  C:\Program Files\OrangeHSS\Launcher\Launcher.exe
  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
  C:\Program Files\Canal\Canal Widget\CANAL+ CANALSAT A LA DEMANDE.EXE
  C:\Program Files\OrangeHSS\systray\systrayapp.exe
  C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
  C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
  C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
  C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
  C:\hp\kbd\kbd.exe
  c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
  C:\Windows\system32\sdclt.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\conime.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Windows\system32\SearchProtocolHost.exe
  C:\Windows\system32\SearchFilterHost.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  
  ################## [ Registre # Startup ]
  
  HKCU_Main: "Local Page"="C:\\Windows\\system32\\blank.htm"
  HKCU_Main: "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
  HKCU_Main: "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
  HKCU_Main: "Window Title"=""
  HKLM_logon: "Userinit"="C:\\Windows\\system32\\userinit.exe,"
  HKLM_logon: "Windows Shell (ezShellStart)"="C:\\Windows\\system32\\userinit.exe,"
  HKLM_logon: "LegalNoticeCaption"=""
  HKLM_logon: "LegalNoticeText"=""
  HKLM_Run: Windows Defender=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
  HKLM_Run: RtHDVCpl=RtHDVCpl.exe
  HKLM_Run: hpsysdrv=c:\hp\support\hpsysdrv.exe
  HKLM_Run: KBD=C:\HP\KBD\KbdStub.EXE
  HKLM_Run: StartCCC="c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
  HKLM_Run: HP Health Check Scheduler=c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
  HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
  HKLM_Run: HP Software Update=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  HKLM_Run: hpqSRMon=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
  HKLM_Run: ORAHSSSessionManager=C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
  HKLM_Run: avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  HKLM_Run: Canal Widget="C:\Program Files\Canal\Canal Widget\Launcher.exe"
  HKLM_Run: PAC207_Monitor=C:\Windows\PixArt\PAC207\Monitor.exe
  HKLM_Run: Monitor=C:\Windows\PixArt\PAC207\Monitor.exe
  HKLM_Run: UnlockerAssistant="C:\Program Files\Unlocker\UnlockerAssistant.exe"
  HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
  HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
  HKCU_Run: Sidebar=C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  HKCU_Run: HPAdvisor=C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
  HKCU_Run: ehTray.exe=C:\Windows\ehome\ehTray.exe
  HKCU_Run: BitTorrent DNA="C:\Program Files\DNA\btdna.exe"
  HKCU_Run: MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  
  ################## [ Informations ]
  
  ################## [ Fichiers # Dossiers infectieux ]
  
  ################## [ Registre # Clés Run infectieuses ]
  
  Found ! HKLM\software\microsoft\security center\\ "UacDisableNotify"
  # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
  
  ################## [ Registre # Mountpoints2 ]
  
  HKCU\Software\Microsoft\....\MountPoints2\{402d8454-a66f-11dd-a22f-001d92f67b16}\Shell\AutoRun\command
  HKCU\Software\Microsoft\....\MountPoints2\{e8019d21-e077-11dd-8652-001d92f67b16}\Shell\AutoRun\command
  
  ################## [ ! Fin du rapport # UsbFix V3.015 ! ]
  
  0
Réponse 15 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Nettoyage avec UsbFix :

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir !

*Double clique sur le raccourci UsbFix présent sur ton bureau.
* Choisis l’option 2 (Suppression)
* Ton bureau disparaîtra et le PC redémarrera.
* Au redémarrage, UsbFix scannera ton PC. Laisse travailler l’outil.
* Ensuite poste l’intégralité du rapport UsbFix.txt qui apparaitra avec le bureau .

Note :
Le rapport UsbFix.txt est sauvegardé a la racine du disque. (C:\UsbFix.txt)
0
1. lalyla
  
  ma page d acceuil a change et je n ai plus le logo d avast qui tourne mais bon voila le rap
  # User : Nadia (Administrateurs) # PC-DE-NADIA
  # Update on 30/04/09 by Chiquitine29, C_XX & Chimay8
  # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
  # Start at: 00:22:37 | 01/05/2009
  
  # Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz
  # Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
  # Internet Explorer 7.0.6001.18000
  # Windows Firewall Status : Disabled
  # AV : avast! antivirus 4.8.1169 [VPS 081202-0] 4.8.1169 [ Enabled | Updated ]
  
  # C:\ # Disque fixe local # 287,46 Go (179,38 Go free) [HP] # NTFS
  # D:\ # Disque fixe local # 10,63 Go (1,1 Go free) [FACTORY_IMAGE] # NTFS
  # E:\ # Disque CD-ROM
  # F:\ # Disque amovible
  # H:\ # Disque amovible
  # I:\ # Disque amovible
  # J:\ # Disque amovible
  
  ############################## [ Processus actifs ]
  
  C:\Windows\System32\smss.exe
  C:\Windows\system32\csrss.exe
  C:\WINDOWS\SYSTEM32\wininit.exe
  C:\Windows\system32\csrss.exe
  C:\Windows\system32\services.exe
  C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsm.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\Ati2evxx.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\SLsvc.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\Ati2evxx.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\Windows\System32\spoolsv.exe
  C:\Windows\system32\svchost.exe
  C:\Program Files\Alwil Software\Avast4\setup\avast.setup
  C:\Windows\system32\Dwm.exe
  C:\WINDOWS\SYSTEM32\taskeng.exe
  C:\Windows\Explorer.EXE
  C:\Windows\system32\runonce.exe
  C:\Windows\system32\conime.exe
  C:\WINDOWS\SYSTEM32\taskeng.exe
  C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
  C:\Windows\system32\svchost.exe
  c:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  C:\Windows\System32\svchost.exe
  C:\Windows\system32\SearchIndexer.exe
  C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
  C:\Windows\system32\WUDFHost.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\WerCon.exe
  
  ################## [ Fichiers # Dossiers infectieux ]
  
  ################## [ Registre # Clés Run infectieuses ]
  
  # HKLM\software\microsoft\security center\\ "UacDisableNotify"
  # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
  
  ################## [ Registre # Mountpoints2 ]
  
  # -> Not Found !
  
  ################## [ Listing des fichiers présent ]
  
  [09/12/2008 20:44|--a------|865] - C:\A2Output2.xml
  [09/12/2008 20:44|--a------|865] - C:\A2Output6.xml
  [01/05/2009 00:04|--a------|4562] - C:\Ad-Report-Clean-30.04.2009.log
  [30/04/2009 18:04|--a------|4255] - C:\Ad-Report-Scan-30.04.2009.log
  [04/06/2008 00:25|--a------|74] - C:\autoexec.bat
  [21/01/2008 04:24|-rahs----|333203] - C:\bootmgr
  [04/06/2008 09:53|-ra-s----|8192] - C:\BOOTSECT.BAK
  [30/01/2009 12:15|--a------|3033] - C:\cleannavi.txt
  [18/09/2006 23:43|--a------|10] - C:\config.sys
  [30/04/2009 17:25|--a------|1197] - C:\DealioAu.log
  [10/11/2008 11:09|--a------|1062] - C:\error.log
  [30/01/2009 12:11|--a------|3027] - C:\fixnavi.txt
  [?|?|?] - C:\hiberfil.sys
  [30/10/2008 12:54|-rahs----|0] - C:\IO.SYS
  [30/01/2009 11:41|--a------|14140] - C:\lopR.txt
  [30/10/2008 12:54|-rahs----|0] - C:\MSDOS.SYS
  [04/09/2008 02:11|--a------|54600] - C:\npbittorrent.dll
  [04/03/2009 21:10|--a------|230432] - C:\PA207.DAT
  [?|?|?] - C:\pagefile.sys
  [20/10/2008 19:24|--a------|574] - C:\RHDSetup.log
  [30/10/2008 01:54|--ah-----|268] - C:\sqmdata00.sqm
  [30/01/2009 11:22|--ah-----|268] - C:\sqmdata01.sqm
  [30/01/2009 11:48|--ah-----|268] - C:\sqmdata02.sqm
  [30/10/2008 01:54|--ah-----|244] - C:\sqmnoopt00.sqm
  [30/01/2009 11:22|--ah-----|244] - C:\sqmnoopt01.sqm
  [30/01/2009 11:48|--ah-----|244] - C:\sqmnoopt02.sqm
  [30/04/2009 17:31|--a------|3719] - C:\TB.txt
  [20/10/2008 19:31|--a------|594] - C:\updatedatfix.log
  [01/05/2009 00:23|--a------|4430] - C:\UsbFix.txt
  [22/06/2007 17:44|---hs----|438328] - D:\boo.mgr
  [19/01/2008 00:45|---hs----|333203] - D:\bootmgr
  [29/10/2007 19:25|---hs----|1237] - D:\Desktop.ini
  [10/11/2008 11:16|--ahs----|22] - D:\HPCD.sys
  [10/11/2008 11:07|--ahs----|233] - D:\MASTER.LOG
  [13/09/2008 16:45|---hs----|428] - D:\pcdr.ini
  [19/06/2007 16:22|---hs----|182323] - D:\protect.arabic
  [05/07/2007 11:44|---hs----|182298] - D:\protect.bulgarian
  [19/06/2007 16:22|---hs----|181572] - D:\protect.catalan
  [19/06/2007 16:22|---hs----|181898] - D:\protect.chinese hong kong
  [19/06/2007 16:22|---hs----|181916] - D:\protect.chinese simplified
  [19/06/2007 16:22|---hs----|181898] - D:\protect.chinese traditional
  [05/07/2007 11:33|---hs----|181936] - D:\protect.croatian
  [04/07/2007 12:31|---hs----|181735] - D:\protect.czech
  [19/06/2007 16:22|---hs----|181680] - D:\protect.danish
  [19/06/2007 16:22|---hs----|181605] - D:\protect.dutch
  [19/06/2007 16:22|---hs----|181648] - D:\protect.ed
  [19/06/2007 16:22|---hs----|181648] - D:\protect.english
  [05/07/2007 10:37|---hs----|183351] - D:\protect.estonian
  [19/06/2007 16:22|---hs----|181648] - D:\protect.finnish
  [19/06/2007 16:22|---hs----|181616] - D:\protect.french
  [19/06/2007 16:22|---hs----|181650] - D:\protect.german
  [04/07/2007 12:33|---hs----|182717] - D:\protect.greek
  [04/07/2007 12:36|---hs----|182626] - D:\protect.hebrew
  [04/07/2007 12:37|---hs----|181696] - D:\protect.hungarian
  [19/06/2007 16:22|---hs----|181535] - D:\protect.italian
  [19/06/2007 16:22|---hs----|182351] - D:\protect.japanese
  [19/06/2007 16:22|---hs----|182043] - D:\protect.korean
  [05/07/2007 18:37|---hs----|182105] - D:\protect.latvian
  [05/07/2007 12:04|---hs----|181932] - D:\protect.lithuanian
  [04/07/2007 12:39|---hs----|181562] - D:\protect.norwegian
  [04/07/2007 12:39|---hs----|181741] - D:\protect.polish
  [04/07/2007 12:40|---hs----|181617] - D:\protect.portuguese
  [04/07/2007 12:40|---hs----|181866] - D:\protect.portuguese brazilian
  [04/07/2007 16:14|---hs----|182016] - D:\protect.romanian
  [19/06/2007 16:22|---hs----|211936] - D:\protect.russian
  [05/07/2007 11:32|---hs----|181959] - D:\protect.serbian latin
  [04/07/2007 12:46|---hs----|181954] - D:\protect.slovak
  [04/07/2007 12:47|---hs----|181936] - D:\protect.slovenian
  [19/06/2007 16:22|---hs----|181572] - D:\protect.spanish
  [04/07/2007 12:43|---hs----|181605] - D:\protect.swedish
  [04/07/2007 12:44|---hs----|182576] - D:\protect.thai
  [04/07/2007 12:44|---hs----|181829] - D:\protect.turkish
  [19/06/2007 16:22|---hs----|181648] - D:\protect.ukranian
  [10/11/2008 10:12|-r-hs----|26] - D:\RCBoot.sys
  [04/06/2008 11:35|---hs----|44] - D:\RESTORE.INI
  
  ################## [ Vaccination ]
  
  # C:\autorun.inf -> Folder created by UsbFix.
  # D:\autorun.inf -> Folder created by UsbFix.
  
  ################## [ Cracks / Keygens / Serials ]
  
  C:\Users\Nadia\Desktop\Mes documents\jeux popo\Babysitting Mania-BigFish-PreCracked-HIVBABY.rar
  C:\Users\Nadia\Desktop\Mes documents\jeux popo\Flower Shop-Big City Break-BigFish-ReFlexive-PreCracked-HIVBABY.rar
  C:\Users\Nadia\Documents\Documentation\Crack\Sims2EP7.exe
  
  ################## [ ! Fin du rapport # UsbFix V3.015 ! ]
  
  port
  
  0
  1. lalyla > lalyla
    
    j ai peur que avast ne marche plus
    
    0
Réponse 16 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Vire tous tes cracks vecteurs d'infections:

C:\Users\Nadia\Desktop\Mes documents\jeux popo\Babysitting Mania-BigFish-PreCracked-HIVBABY.rar
C:\Users\Nadia\Desktop\Mes documents\jeux popo\Flower Shop-Big City Break-BigFish-ReFlexive-PreCracked-HIVBABY.rar
C:\Users\Nadia\Documents\Documentation\Crack\Sims2EP7.exe

**********

Supprime ces fichiers manuellement :

C:\A2Output2.xml
C:\A2Output6.xml
C:\Ad-Report-Clean-30.04.2009.log
C:\Ad-Report-Scan-30.04.2009.log
C:\UsbFix.txt

Préviens moi si tu as un souci pour en supprimer un.
Poste un nouveau rapport RSIT stp.
0
1. lalyla
  
  Run by Nadia at 2009-05-01 01:06:30
  Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
  System drive C: has 184 GB (62%) free of 294 GB
  Total RAM: 3069 MB (66% free)
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 01:06:41, on 01/05/2009
  Platform: Windows Vista SP1 (WinNT 6.00.1905)
  MSIE: Internet Explorer v7.00 (7.00.6001.18226)
  Boot mode: Normal
  
  Running processes:
  C:\Windows\system32\Dwm.exe
  C:\WINDOWS\SYSTEM32\taskeng.exe
  C:\Windows\Explorer.EXE
  C:\Program Files\Windows Defender\MSASCui.exe
  C:\Windows\RtHDVCpl.exe
  C:\hp\support\hpsysdrv.exe
  C:\Program Files\Java\jre6\bin\jusched.exe
  C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
  C:\Program Files\Alwil Software\Avast4\ashDisp.exe
  C:\Windows\PixArt\PAC207\Monitor.exe
  C:\Program Files\Unlocker\UnlockerAssistant.exe
  C:\Program Files\Windows Sidebar\sidebar.exe
  C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
  C:\Windows\ehome\ehtray.exe
  C:\Program Files\DNA\btdna.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
  C:\Windows\ehome\ehmsas.exe
  C:\Program Files\Canal\Canal Widget\CANAL+ CANALSAT A LA DEMANDE.EXE
  C:\Program Files\OrangeHSS\Launcher\Launcher.exe
  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
  C:\Program Files\OrangeHSS\systray\systrayapp.exe
  C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
  C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
  C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
  C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\hp\kbd\kbd.exe
  C:\Users\Nadia\Desktop\RSIT.exe
  C:\Program Files\Trend Micro\HijackThis\Nadia.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
  O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
  O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
  O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
  O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
  O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
  O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKLM\..\Run: [Canal Widget] "C:\Program Files\Canal\Canal Widget\Launcher.exe"
  O4 - HKLM\..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
  O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
  O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
  O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
  O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
  O4 - Startup: Worldnet.lnk = C:\Windows\System32\Worldnet.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
  O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
  O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
  O13 - Gopher Prefix:
  O15 - Trusted Zone: http://*.mappy.com
  O15 - Trusted Zone: http://*.orange.fr
  O15 - Trusted Zone: http://rw.search.ke.voila.fr
  O15 - Trusted Zone: http://orange.weborama.fr
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
  O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
  
  0
Réponse 17 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Je voulais éviter de te faire utiliser un outil mais on en a quand même besoin :

/!\ Procédure réservée à ????????. Ne tentez pas de la reproduire si vous avez un problème similaire sous peine de planter votre machine /!\
Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau.
= = = = >>> En cliquant ici <<< = = = =
Une fois installé sur le bureau, clique droit sur OTMoveIt.exe puis ‘Exécuter en tant qu’administrateur’pour le lancer.
Assure toi que la case Unregister Dll’s and Ocx’s soit bien cochée
Copie la liste qui se trouve en gras ci-dessous, et colle-la dans le cadre de gauche de OTMoveIt :
Paste Instructions for Items to be moved.

:Processes
explorer.exe

:Files
C:\A2Output2.xml
C:\A2Output6.xml
C:\Ad-Report-Clean-30.04.2009.log
C:\Ad-Report-Scan-30.04.2009.log
C:\UsbFix.txt

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{402d8454-a66f-11dd-a22f-001d92f67b16}]

:Commands
[purity]
[emptytemp]
[Reboot]

Clique sur MoveIt! pour lancer la suppression.
Après avoir fait Moveit!, une fenêtre s'affiche :
"The system requires a reboot to finish removing files. Do you want to reboot now ?"
Réponds Yes.
Le résultat apparaîtra dans le cadre "Results".
Clique sur Exit pour fermer.
Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
0
1. lalyla
  
  File/Folder C:\A2Output2.xml not found.
  File/Folder C:\A2Output6.xml not found.
  File/Folder C:\Ad-Report-Clean-30.04.2009.log not found.
  File/Folder C:\Ad-Report-Scan-30.04.2009.log not found.
  File/Folder C:\UsbFix.txt not found.
  ========== REGISTRY ==========
  Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer\\ not found.
  Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{402d8454-a66f-11dd-a22f-001d92f67b16}\\ not found.
  ========== COMMANDS ==========
  File delete failed. C:\Users\Nadia\AppData\Local\Temp\JET340A.tmp scheduled to be deleted on reboot.
  File delete failed. C:\Users\Nadia\AppData\Local\Temp\MainFrame.Log.txt scheduled to be deleted on reboot.
  File delete failed. C:\Users\Nadia\AppData\Local\Temp\~DF7D4E.tmp scheduled to be deleted on reboot.
  File delete failed. C:\Users\Nadia\AppData\Local\Temp\~DF7D58.tmp scheduled to be deleted on reboot.
  File delete failed. C:\Users\Nadia\AppData\Local\Temp\~DFB2D2.tmp scheduled to be deleted on reboot.
  File delete failed. C:\Users\Nadia\AppData\Local\Temp\~DFB2DC.tmp scheduled to be deleted on reboot.
  File delete failed. C:\Users\Nadia\AppData\Local\Temp\~DFCB03.tmp scheduled to be deleted on reboot.
  User's Temp folder emptied.
  User's Internet Explorer cache folder emptied.
  File delete failed. C:\Windows\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
  Windows Temp folder emptied.
  FireFox cache emptied.
  Temp folders emptied.
  
  OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05012009_011930
  
  Files moved on Reboot...
  File C:\Users\Nadia\AppData\Local\Temp\JET340A.tmp not found!
  C:\Users\Nadia\AppData\Local\Temp\MainFrame.Log.txt moved successfully.
  File C:\Users\Nadia\AppData\Local\Temp\~DF7D4E.tmp not found!
  File C:\Users\Nadia\AppData\Local\Temp\~DF7D58.tmp not found!
  File C:\Users\Nadia\AppData\Local\Temp\~DFB2D2.tmp not found!
  File C:\Users\Nadia\AppData\Local\Temp\~DFB2DC.tmp not found!
  C:\Users\Nadia\AppData\Local\Temp\~DFCB03.tmp moved successfully.
  File C:\Windows\temp\_avast4_\Webshlock.txt not found!
  
  0
  1. lalyla > lalyla
    
    tu es peut etre aller te coucher il est tard! désolé
    
    0
  2. lalyla > lalyla
    
    BONJOUR! Je suis prete a continuer si toi tu pe! car ce n est toujours pas mieux! merci
    Et avant est ce que je dois redésactiver les comptes utilisateurs?
    
    0
  3. lalyla > lalyla
    
    EN ATTENDANT est ce que je dois limiter mon utilisation de l ordi?
    
    0
Réponse 18 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Poste un nouveau rapport RSIT.
A ce soir.
Tu peux utiliser ton PC ;-).
Laisse l'UAC comme ça, pas de soucis.
En attendant, fais une analyse complète de ton système avec ton antivirus. Poste le rapport.
0
1. lalyla
  
  voila c est fait mais pour avast je sais pas si c est ca que tu voulais?
  
  Nombre de dossiers parcourus : 26008
  Nombre de fichiers analysés : 205951
  Nombre de fichiers infectés : 0
  
  01/05/2009 01:25:04 1241133904 SYSTEM 1656 Sign of "HTML:Iframe-inf" has been found in "C:\Users\Nadia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H88LCQO9\gga[1].htm" file.
  01/05/2009 16:30:11 1241188211 SYSTEM 1764 Sign of "HTML:Iframe-inf" has been found in "C:\Users\Nadia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I11BJA07\gga[1].htm" file.
  
  0
  1. lalyla > lalyla
    
    Et voila pour le rapport RSIT
    
    Run by Nadia at 2009-05-01 17:21:47
    Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
    System drive C: has 186 GB (63%) free of 294 GB
    Total RAM: 3069 MB (62% free)
    
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:21:49, on 01/05/2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18226)
    Boot mode: Normal
    
    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\WINDOWS\SYSTEM32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\hp\support\hpsysdrv.exe
    c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Windows\PixArt\PAC207\Monitor.exe
    C:\Program Files\OrangeHSS\Launcher\Launcher.exe
    C:\Program Files\Unlocker\UnlockerAssistant.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Canal\Canal Widget\CANAL+ CANALSAT A LA DEMANDE.EXE
    C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
    C:\Windows\ehome\ehtray.exe
    C:\Users\Nadia\Program Files\DNA\btdna.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\OrangeHSS\systray\systrayapp.exe
    C:\Program Files\OrangeHSS\Deskboard\deskboard.exe
    C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe
    C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe
    C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    C:\hp\kbd\kbd.exe
    C:\Program Files\Microsoft Games\Hearts\Hearts.exe
    C:\Program Files\Internet Explorer\ieuser.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
    C:\Users\Nadia\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Nadia.exe
    
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
    O4 - HKLM\..\Run: [StartCCC] "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
    O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Canal Widget] "C:\Program Files\Canal\Canal Widget\Launcher.exe"
    O4 - HKLM\..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
    O4 - HKLM\..\Run: [Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Nadia\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - Startup: Worldnet.lnk = C:\Windows\System32\Worldnet.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
    O13 - Gopher Prefix:
    O15 - Trusted Zone: http://*.mappy.com
    O15 - Trusted Zone: http://*.orange.fr
    O15 - Trusted Zone: http://rw.search.ke.voila.fr
    O15 - Trusted Zone: http://orange.weborama.fr
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
    O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    
    0
Réponse 19 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046
Analyse ce fichier :
```
C:\Windows\System32\Worldnet.exe
```
Sur le site de Virustotal :
https://www.virustotal.com/gui/

Parcourir > Sélectionne ton fichier > Analyser, patiente que l’analyse soit terminée.

Poste bien le rapport.

(Si VirusTotal indique que le fichier a déjà été analysé, clique sur le bouton Ré-analyse le fichier maintenant).
0
1. lalyla
  
  MD5...: 50a1e851781555b69d407c1cb22d9787
  SHA1..: 9a06b0bf6dba840dab817611a7a3869930d1d40f
  SHA256: 1017524336a46dc77cf49a920bebcf24c771feb55c1a2761deacefe9a5bc2a9a
  SHA512: 44062fd098fce0279836d0456d89d3c4372c80e2e18099316b4ae1d5b47f3036
  d795154d55f31373b0827d13699321ccbde040634fce71472713db8b6412bbb0
  ssdeep: 768:yVY+gap/6/FlPAVHM3NKEMFjGjAnTAbVsrvSLrFVesUX0ieZrt557AP72rPh
  uJO1:yW+HZ6/TkNoj/Tu+HZ
  
  PEiD..: -
  TrID..: File type identification
  Win32 Dynamic Link Library (generic) (65.4%)
  Generic Win/DOS Executable (17.2%)
  DOS Executable Generic (17.2%)
  Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
  PEInfo: PE Structure information
  
  ( base data )
  entrypointaddress.: 0x17b0
  timedatestamp.....: 0x494448c3 (Sat Dec 13 23:44:03 2008)
  machinetype.......: 0x14c (I386)
  
  ( 3 sections )
  name viradd virsiz rawdsiz ntrpy md5
  .text 0x1000 0xe24c 0xf000 5.70 f4f62a1651b17c25fcb4d58e058fc633
  .data 0x10000 0x1198 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
  .rsrc 0x12000 0x5bbc 0x6000 5.80 31cf15957fd6c6e019eaa809ebd9c9f6
  
  ( 1 imports )
  > MSVBVM60.DLL: _CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaLateIdCall, __vbaEnd, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, -, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, -, EVENT_SINK_QueryInterface, __vbaExceptHandler, -, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaR8Str, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, -, __vbaVarAdd, __vbaStrToAnsi, _CIatan, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj
  
  ( 0 exports )
  
  PDFiD.: -
  RDS...: NSRL Reference Data Set
  -
  ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=50a1e851781555b69d407c1cb22d9787' target='_blank'>https://www.symantec.com?md5=50a1e851781555b69d407c1cb22d9787
  
  0
2. lalyla
  
  Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
  
  Résultat: 1/40 (2.5%)
  en train de charger les informations du serveur...
  Votre fichier est dans la file d'attente, en position: ___.
  L'heure estimée de démarrage est entre ___ et ___ .
  Ne fermez pas la fenêtre avant la fin de l'analyse.
  L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
  Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
  Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
  les résultats seront affichés au fur et à mesure de leur génération.
  Formaté Impression des résultats
  Votre fichier a expiré ou n'existe pas.
  Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.
  
  Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
  Email:
  
  Antivirus Version Dernière mise à jour Résultat
  a-squared 4.0.0.101 2009.05.01 -
  AhnLab-V3 5.0.0.2 2009.05.01 -
  AntiVir 7.9.0.160 2009.04.30 -
  Antiy-AVL 2.0.3.1 2009.04.30 -
  Authentium 5.1.2.4 2009.04.30 -
  Avast 4.8.1335.0 2009.04.30 -
  AVG 8.5.0.327 2009.05.01 Clicker.WCI
  BitDefender 7.2 2009.05.01 -
  CAT-QuickHeal 10.00 2009.04.30 -
  ClamAV 0.94.1 2009.05.01 -
  Comodo 1141 2009.04.29 -
  DrWeb 4.44.0.09170 2009.05.01 -
  eSafe 7.0.17.0 2009.04.30 -
  eTrust-Vet 31.6.6486 2009.05.01 -
  F-Prot 4.4.4.56 2009.04.30 -
  F-Secure 8.0.14470.0 2009.05.01 -
  Fortinet 3.117.0.0 2009.05.01 -
  GData 19 2009.05.01 -
  Ikarus T3.1.1.49.0 2009.05.01 -
  K7AntiVirus 7.10.721 2009.05.01 -
  Kaspersky 7.0.0.125 2009.05.01 -
  McAfee 5601 2009.04.30 -
  McAfee+Artemis 5601 2009.04.30 -
  McAfee-GW-Edition 6.7.6 2009.04.30 -
  Microsoft 1.4602 2009.05.01 -
  NOD32 4048 2009.05.01 -
  Norman 6.01.05 2009.04.30 -
  nProtect 2009.1.8.0 2009.05.01 -
  Panda 10.0.0.14 2009.05.01 -
  PCTools 4.4.2.0 2009.05.01 -
  Prevx1 3.0 2009.05.01 -
  Rising 21.27.41.00 2009.05.01 -
  Sophos 4.41.0 2009.05.01 -
  Sunbelt 3.2.1858.2 2009.05.01 -
  Symantec 1.4.4.12 2009.05.01 -
  TheHacker 6.3.4.1.317 2009.05.01 -
  TrendMicro 8.950.0.1092 2009.05.01 -
  VBA32 3.12.10.4 2009.05.01 -
  ViRobot 2009.5.1.1717 2009.05.01 -
  VirusBuster 4.6.5.0 2009.05.01 -
  Information additionnelle
  File size: 94208 bytes
  MD5...: 50a1e851781555b69d407c1cb22d9787
  SHA1..: 9a06b0bf6dba840dab817611a7a3869930d1d40f
  SHA256: 1017524336a46dc77cf49a920bebcf24c771feb55c1a2761deacefe9a5bc2a9a
  SHA512: 44062fd098fce0279836d0456d89d3c4372c80e2e18099316b4ae1d5b47f3036
  d795154d55f31373b0827d13699321ccbde040634fce71472713db8b6412bbb0
  ssdeep: 768:yVY+gap/6/FlPAVHM3NKEMFjGjAnTAbVsrvSLrFVesUX0ieZrt557AP72rPh
  uJO1:yW+HZ6/TkNoj/Tu+HZ
  
  PEiD..: -
  TrID..: File type identification
  Win32 Dynamic Link Library (generic) (65.4%)
  Generic Win/DOS Executable (17.2%)
  DOS Executable Generic (17.2%)
  Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
  PEInfo: PE Structure information
  
  ( base data )
  entrypointaddress.: 0x17b0
  timedatestamp.....: 0x494448c3 (Sat Dec 13 23:44:03 2008)
  machinetype.......: 0x14c (I386)
  
  ( 3 sections )
  name viradd virsiz rawdsiz ntrpy md5
  .text 0x1000 0xe24c 0xf000 5.70 f4f62a1651b17c25fcb4d58e058fc633
  .data 0x10000 0x1198 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
  .rsrc 0x12000 0x5bbc 0x6000 5.80 31cf15957fd6c6e019eaa809ebd9c9f6
  
  ( 1 imports )
  > MSVBVM60.DLL: _CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaLateIdCall, __vbaEnd, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, -, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, -, EVENT_SINK_QueryInterface, __vbaExceptHandler, -, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaR8Str, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, -, __vbaVarAdd, __vbaStrToAnsi, _CIatan, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj
  
  ( 0 exports )
  
  PDFiD.: -
  RDS...: NSRL Reference Data Set
  -
  ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=50a1e851781555b69d407c1cb22d9787' target='_blank'>https://www.symantec.com?md5=50a1e851781555b69d407c1cb22d9787</a>
  
  0
  1. lalyla > lalyla
    
    "HideFastUserSwitching"=0
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoLogoff"=0
    "NoClose"=0
    "NoFind"=
    "NoFolderOptions"=
    "NoRun"=
    "NoDrives"=0
    "NoViewContextMenu"=0
    "NoWinKeys"=0
    "NoDriveAutoRun"=FFFFFFFF
    "NoDriveTypeAutoRun"=36
    
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoLogOff"=
    
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe"="C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS"
    "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
    
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8019d21-e077-11dd-8652-001d92f67b16}]
    shell\AutoRun\command - G:\start.exe
    
    ======List of files/folders created in the last 1 months======
    
    2009-05-02 21:06:10 ----D---- C:\rsit
    2009-05-02 14:37:30 ----D---- C:\ProgramData\Avira
    2009-05-02 14:37:30 ----D---- C:\Program Files\Avira
    2009-05-01 19:51:51 ----D---- C:\Windows\BDOSCAN8
    2009-05-01 19:21:48 ----D---- C:\Windows\system32\Kaspersky Lab
    2009-05-01 18:35:09 ----A---- C:\TCleaner.txt
    2009-05-01 00:23:27 ----RASHD---- C:\autorun.inf
    2009-04-16 12:28:13 ----A---- C:\Windows\system32\winhttp.dll
    2009-04-16 12:28:10 ----A---- C:\Windows\system32\xolehlp.dll
    2009-04-16 12:28:10 ----A---- C:\Windows\system32\msdtcprx.dll
    2009-04-16 12:28:03 ----A---- C:\Windows\system32\rpcss.dll
    2009-04-16 12:28:02 ----A---- C:\Windows\system32\ntoskrnl.exe
    2009-04-16 12:28:02 ----A---- C:\Windows\system32\ntkrnlpa.exe
    2009-04-16 12:28:01 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
    2009-04-16 12:28:00 ----A---- C:\Windows\system32\sdohlp.dll
    2009-04-16 12:28:00 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
    2009-04-16 12:28:00 ----A---- C:\Windows\system32\iasrecst.dll
    2009-04-16 12:28:00 ----A---- C:\Windows\system32\iashost.exe
    2009-04-16 12:28:00 ----A---- C:\Windows\system32\iasdatastore.dll
    2009-04-16 12:28:00 ----A---- C:\Windows\system32\iasads.dll
    2009-04-16 12:27:56 ----A---- C:\Windows\system32\lsasrv.dll
    2009-04-16 12:27:56 ----A---- C:\Windows\system32\kernel32.dll
    2009-04-16 12:27:55 ----A---- C:\Windows\system32\secur32.dll
    2009-04-16 12:27:55 ----A---- C:\Windows\system32\apilogen.dll
    2009-04-16 12:27:55 ----A---- C:\Windows\system32\amxread.dll
    2009-04-16 12:27:51 ----A---- C:\Windows\system32\mshtml.dll
    2009-04-16 12:27:49 ----A---- C:\Windows\system32\ieframe.dll
    2009-04-16 12:27:48 ----A---- C:\Windows\system32\urlmon.dll
    2009-04-16 12:27:47 ----A---- C:\Windows\system32\iertutil.dll
    2009-04-16 12:27:46 ----A---- C:\Windows\system32\wininet.dll
    2009-04-16 12:27:46 ----A---- C:\Windows\system32\msfeeds.dll
    2009-04-16 12:27:46 ----A---- C:\Windows\system32\iedkcs32.dll
    2009-04-16 12:27:45 ----A---- C:\Windows\system32\occache.dll
    2009-04-16 12:27:45 ----A---- C:\Windows\system32\ieUnatt.exe
    2009-04-16 12:27:45 ----A---- C:\Windows\system32\ieencode.dll
    2009-04-16 12:27:45 ----A---- C:\Windows\system32\ieaksie.dll
    2009-04-16 12:27:44 ----A---- C:\Windows\system32\mstime.dll
    2009-04-16 12:27:43 ----A---- C:\Windows\system32\jsproxy.dll
    2009-04-14 12:06:53 ----D---- C:\Windows\Sun
    2009-04-14 12:06:07 ----A---- C:\Windows\system32\javaws.exe
    2009-04-14 12:06:07 ----A---- C:\Windows\system32\javaw.exe
    2009-04-14 12:06:07 ----A---- C:\Windows\system32\java.exe
    2009-04-14 12:06:07 ----A---- C:\Windows\system32\deploytk.dll
    2009-04-11 10:36:56 ----D---- C:\Users\Nadia\AppData\Roaming\Ludia
    2009-04-11 10:36:56 ----D---- C:\ProgramData\Ludia
    2009-04-11 10:36:41 ----D---- C:\Windows\Hell's Kitchen
    2009-04-11 10:36:41 ----D---- C:\Program Files\Hell's Kitchen
    2009-04-11 10:35:29 ----D---- C:\Windows\Home Sweet Home 2 Kitchens and Baths
    2009-04-11 10:31:08 ----D---- C:\Windows\Restaurant Rush
    2009-04-11 10:31:08 ----D---- C:\Program Files\Restaurant Rush
    
    ======List of files/folders modified in the last 1 months======
    
    2009-05-02 21:06:23 ----D---- C:\Windows\Prefetch
    2009-05-02 21:06:23 ----D---- C:\Program Files\Trend Micro
    2009-05-02 21:06:18 ----D---- C:\Windows\Temp
    2009-05-02 20:56:42 ----D---- C:\Users\Nadia\AppData\Roaming\DNA
    2009-05-02 20:48:35 ----D---- C:\Windows
    2009-05-02 14:48:35 ----SHD---- C:\System Volume Information
    2009-05-02 14:37:33 ----D---- C:\Windows\system32\drivers
    2009-05-02 14:37:30 ----RD---- C:\Program Files
    2009-05-02 14:37:30 ----HD---- C:\ProgramData
    2009-05-02 14:35:50 ----SHD---- C:\Windows\Installer
    2009-05-02 14:35:49 ----D---- C:\Windows\winsxs
    2009-05-02 14:25:36 ----D---- C:\Program Files\Alwil Software
    2009-05-02 14:22:38 ----D---- C:\Windows\System32
    2009-05-02 10:44:09 ----D---- C:\Windows\system32\Tasks
    2009-05-01 19:51:54 ----SD---- C:\Windows\Downloaded Program Files
    2009-05-01 18:50:42 ----D---- C:\ProgramData\Spybot - Search & Destroy
    2009-05-01 18:50:40 ----D---- C:\Windows\Debug
    2009-05-01 18:39:04 ----D---- C:\ProgramData\Microsoft Help
    2009-05-01 01:51:40 ----D---- C:\Windows\system32\catroot2
    2009-05-01 01:48:54 ----HD---- C:\Windows\system32\GroupPolicy
    2009-05-01 01:22:47 ----D---- C:\Program Files\DNA
    2009-04-29 18:53:48 ----D---- C:\Windows\system32\catroot
    2009-04-28 14:16:48 ----D---- C:\Users\Nadia\AppData\Roaming\BitTorrent
    2009-04-27 09:20:38 ----D---- C:\Windows\inf
    2009-04-27 09:20:38 ----A---- C:\Windows\system32\PerfStringBackup.INI
    2009-04-17 11:10:33 ----D---- C:\Windows\Stand O Food 2
    2009-04-17 11:10:33 ----D---- C:\Windows\Ranch Rush
    2009-04-17 11:10:33 ----D---- C:\Windows\Puzzle Hero
    2009-04-17 11:10:33 ----D---- C:\Windows\Jojos Fashion Show 2 Las Cruces
    2009-04-17 11:10:33 ----D---- C:\Windows\Farm Frenzy 2
    2009-04-17 09:36:12 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2009-04-17 09:34:29 ----D---- C:\Program Files\Spybot - Search & Destroy
    2009-04-17 09:22:41 ----D---- C:\Windows\system32\wbem
    2009-04-17 09:22:41 ----D---- C:\Program Files\Windows Mail
    2009-04-17 09:22:38 ----D---- C:\Windows\system32\manifeststore
    2009-04-17 09:22:38 ----D---- C:\Windows\AppPatch
    2009-04-17 09:22:37 ----D---- C:\Program Files\Internet Explorer
    2009-04-14 12:05:41 ----D---- C:\Program Files\Java
    2009-04-12 16:09:17 ----D---- C:\Program Files\CENEGA
    2009-04-11 10:58:41 ----D---- C:\Program Files\Games
    2009-04-09 13:35:14 ----D---- C:\Users\Nadia\AppData\Roaming\dvdcss
    2009-04-06 16:57:24 ----A---- C:\Windows\system32\mrt.exe
    2009-04-06 15:57:48 ----A---- C:\Windows\system.ini
    2009-04-04 17:37:40 ----D---- C:\Windows\Tasks
    2009-04-04 14:11:07 ----D---- C:\Program Files\Windows Media Player
    2009-04-04 14:11:06 ----D---- C:\Windows\Help
    2009-04-04 14:00:32 ----D---- C:\Users\Nadia\AppData\Roaming\Zylom
    2009-04-04 14:00:32 ----D---- C:\Users\Nadia\AppData\Roaming\Identities
    
    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
    
    R1 ASPI32;ASPI32; C:\Windows\system32\drivers\ASPI32.sys [1999-09-10 25244]
    R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]
    R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
    R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-02-13 28376]
    R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
    R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-02-26 3520512]
    R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-07-03 2152088]
    R3 PAC207;PC Camera; C:\Windows\system32\DRIVERS\PFC027.SYS [2007-10-25 616064]
    R3 PCASp50;PCASp50 NDIS Protocol Driver; C:\Windows\System32\Drivers\PCASp50.sys [2006-11-28 27072]
    R3 Ps2;PS2; C:\Windows\system32\DRIVERS\PS2.sys [2005-12-12 19072]
    R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-02-14 118784]
    R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
    S3 catchme;catchme; \??\C:\Users\Nadia\AppData\Local\Temp\catchme.sys []
    S3 Dot4;Pilote MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584]
    S3 Dot4Print;Pilote de classe Imprimante pour IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384]
    S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864]
    S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
    S3 fcdabus;fcdabus; C:\Windows\system32\DRIVERS\fcdabus.sys []
    S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
    S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
    S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
    S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
    S3 PCAMp50;PCAMp50 NDIS Protocol Driver; C:\Windows\System32\Drivers\PCAMp50.sys [2006-11-28 28224]
    S3 usbbus;LGE Mobile Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2008-09-04 13056]
    S3 UsbDiag;LGE Mobile USB Serial Port; C:\Windows\system32\DRIVERS\lgusbdiag.sys [2008-09-04 19968]
    S3 USBModem;LGE Mobile USB Modem; C:\Windows\system32\DRIVERS\lgusbmodem.sys [2008-09-04 24832]
    S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
    S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-21 39936]
    S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
    S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
    S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]
    
    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
    
    R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-04-01 108289]
    R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-03-02 185089]
    R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-02-26 655360]
    R2 CanalPlus.VOD;CanalPlus.VOD; C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [2009-04-29 188416]
    R2 ezSharedSvc;Easybits Shared Services for Windows; C:\Windows\system32\svchost.exe [2008-01-21 21504]
    R2 FTRTSVC;France Telecom Routing Table Service; C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [2007-12-11 65536]
    R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2008-03-14 94208]
    R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-21 21504]
    R2 LightScribeService;LightScribeService Direct Disc Labeling Service; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-03-17 73728]
    R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
    R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
    R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-21 21504]
    S2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
    S3 GameConsoleService;GameConsoleService; C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2007-07-24 181800]
    S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-18 138168]
    S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
    S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
    S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
    
    -----------------EOF-----------------
    
    0
Réponse 20 / 64
crapoulou Messages postés 28002 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 8 046

Le rapport n'est pas bon ...
Poste moi l'intégralité de ce que tu vois à l'écran.
0

Pubs intempestives au demarrage

64 réponses

Discussions similaires

Newsletters