gros virus plus rien a faire Résolu

Question

bonsoir

j ai un soucis .
je n'ai plus d antivirus et impossible de le reinstaller , de plus hijackthis ( conseillè par un ami ) ne fonctionne plus non plus.
mon ami ma dit de prendre malwarebyte et il se bloque...que faire

merci a vous d'aider une étudiante en droit

Utilisateur anonyme · Accepted Answer

T inkietes ..

Pour usbfix il te dira "version non supporté .." mais ça sera corrigé à la prochaine maj .

Si tu le souhaite je peux te passer une version que tu peux tester sous seven , et me faire des remontées en mp 

ou ici : http://www.commentcamarche.net/forum/affich 11859597 retour de usbfix?page=10#218

pour d eventuels bugs , messages d erreures etc .

V-X · Answer

Salut,

Télécharge FindyKill de Chiquitine29

&#x25B6 Fais un clique droit sur le lien et choisis ( "enregistrer la cible sous ...." )( , destination le bureau .


&#x25B6 Laisse toi guider pour l'installer.

&#x25B6 Double clic sur " FindyKill." pour lancer l'outil .

&#x25B6 Choisis La langue:F pour français

&#x25B6 Choisis  l'option 1 . Puis laisses travailler ...

&#x25B6 Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

Les-risques-securitaires-du-peer-to-peer

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

loloetseb · Answer

Désactivez le contrôle des comptes utilisateurs avant utilisation de cet outil: 

* Allez dans "Démarrer" puis Panneau de configuration. 
* Double Cliquez sur l'icône Comptes d'utilisateurs et sur "Activer ou désactiver le contrôle des comptes d'utilisateurs".  
* Décochez la case Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur. 
* Validez par OK et redémarrez .

Aides en images ( Uac ) 


*****************************************************
*************** Option 1  (Recherche) ***************
*****************************************************


Télécharge FindyKill ( de Chiquitine29) sur ton bureau : 



! Déconnecte toi et ferme toutes applications en cours ! 

* Double clique sur "FindyKill.exe" pour lancer l'installation et laisse les paramètres d'instalation par défaut . 

* Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

* Double-clique sur le raccourci FindyKill qui est sur ton bureau pour lancer l'outil .
 
* Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

* Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée] 

Laisse travailler l'outil et ne touche à rien ... 

--> Poste le rapport qui apparait à la fin , sur le forum ...

( le rapport est sauvegardé aussi sous C:\FindyKill.txt ) 
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 

Aides en images ( Installation ) 
Aides en images ( Recherche )

lilou · Answer

merci de m aider
mais ça marche pas
ça me marque acces refuse
et aucun rapport
par contre je poste des rapport que ma fait faire mon copain

Search Navipromo version 3.7.1 commencé le 10/05/2009 à 23:00:09,26

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 02.01.2009 à 19h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-50 )
BIOS : PhoenixBIOS 4.0 Release 6.1     
USER : henri ( Administrator )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:51 Go (Free:9 Go)
D:\ (Local Disk) - NTFS - Total:44 Go (Free:18 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (USB) - FAT - Total:961 Mo (Free:0 Go)
H:\ (Local Disk) - NTFS - Total:35 Go (Free:22 Go)
I:\ (Local Disk) - FAT32 - Total:15 Go (Free:12 Go)


Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\henri\appdataoaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\henri\AppData\Local\virtualstore\Program Files" ***



*** Recherche dossiers dans "C:\Users\henri\AppData\Local" ***




*** Recherche dossiers dans "C:\Users\henri\AppData\Roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

lilou · Answer

--------------------\  Lop S&D 4.2.4-9c   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-50 )
   BIOS : PhoenixBIOS 4.0 Release 6.1     
   USER : henri ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:51 Go (Free:10 Go)
   D:\ (Local Disk) - NTFS - Total:44 Go (Free:18 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)
   G:\ (USB) - FAT - Total:961 Mo (Free:0 Go)
   H:\ (Local Disk) - NTFS - Total:35 Go (Free:22 Go)
   I:\ (Local Disk) - FAT32 - Total:15 Go (Free:12 Go)

   "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
   Option : [2] ( 10/05/2009|23:46 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans Local

   [11/02/2008|16:57] C:\Users\henri\AppData\Local\{B734406A-61B5-4E1D-A964-81B07B93BB70}
   [13/11/2007|14:40] C:\Users\henri\AppData\Local\{C8A2BB40-90D2-4928-AB81-2A84EFB7EA4C}
   [01/01/2008|22:27] C:\Users\henri\AppData\Local\ACD Systems
   [05/09/2007|18:07] C:\Users\henri\AppData\Local\acer eNM
   [29/05/2008|14:31] C:\Users\henri\AppData\Local\Adobe
   [25/01/2008|00:12] C:\Users\henri\AppData\Local\Ahead
   [03/04/2009|16:13] C:\Users\henri\AppData\Local\Apple
   [03/04/2009|16:14] C:\Users\henri\AppData\Local\Apple Computer
   [05/09/2007|18:03] C:\Users\henri\AppData\Local\Application Data 
   [15/04/2009|15:08] C:\Users\henri\AppData\Local\ApplicationHistory
   [15/04/2008|02:15] C:\Users\henri\AppData\Local\Apps
   [26/03/2008|19:06] C:\Users\henri\AppData\Local\Ares
   [27/05/2008|18:04] C:\Users\henri\AppData\Local\CDBurnerXP_Soft
   [10/04/2008|00:15] C:\Users\henri\AppData\Local\cdrtfe
   [24/06/2008|17:44] C:\Users\henri\AppData\Local\d3d9caps.dat
   [10/05/2009|21:59] C:\Users\henri\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [06/04/2009|17:33] C:\Users\henri\AppData\Local\Deployment
   [01/01/2008|22:21] C:\Users\henri\AppData\Local\Downloaded Installations
   [06/01/2009|23:59] C:\Users\henri\AppData\Local\Dynacom
   [04/12/2008|20:58] C:\Users\henri\AppData\Local\Ebp
   [02/11/2008|00:26] C:\Users\henri\AppData\Local\eMule
   [15/04/2009|15:02] C:\Users\henri\AppData\Local\fusioncache.dat
   [15/04/2009|15:02] C:\Users\henri\AppData\Local\GDIPFONTCACHEV1.DAT
   [13/08/2008|11:21] C:\Users\henri\AppData\Local\GMail Drive
   [07/04/2009|11:28] C:\Users\henri\AppData\Local\Google
   [05/09/2007|18:03] C:\Users\henri\AppData\Local\Historique 
   [09/12/2008|17:41] C:\Users\henri\AppData\Local\HP
   [10/05/2009|23:10] C:\Users\henri\AppData\Local\IconCache.db
   [14/03/2009|20:59] C:\Users\henri\AppData\Local\IM
   [15/04/2009|14:49] C:\Users\henri\AppData\Local\Installer2792
   [27/09/2008|22:10] C:\Users\henri\AppData\Local\Installer3980
   [19/11/2008|18:52] C:\Users\henri\AppData\Local\Installer4136
   [20/01/2009|19:53] C:\Users\henri\AppData\Local\Installer4600
   [23/07/2008|12:06] C:\Users\henri\AppData\Local\Macromedia
   [09/09/2007|16:47] C:\Users\henri\AppData\Local\MCE Deluxe Suite
   [03/05/2009|15:49] C:\Users\henri\AppData\Local\Micro Application
   [23/10/2008|13:07] C:\Users\henri\AppData\Local\Microsoft
   [12/11/2007|02:18] C:\Users\henri\AppData\Local\Microsoft Games
   [24/03/2009|15:40] C:\Users\henri\AppData\Local\Microsoft Help
   [13/09/2007|01:02] C:\Users\henri\AppData\Local\MigWiz
   [21/01/2008|17:26] C:\Users\henri\AppData\Local\Mozilla
   [17/09/2007|00:27] C:\Users\henri\AppData\Local\NFS Underground 2
   [26/04/2008|01:21] C:\Users\henri\AppData\Local\Paint.NET
   [11/02/2008|17:03] C:\Users\henri\AppData\Local\Pando
   [09/09/2007|16:46] C:\Users\henri\AppData\Local\PowerCinema
   [06/11/2007|13:53] C:\Users\henri\AppData\Local\Real
   [10/10/2007|11:54] C:\Users\henri\AppData\Local\Shareaza
   [25/09/2007|21:44] C:\Users\henri\AppData\Local\Steam
   [04/12/2008|20:53] C:\Users\henri\AppData\Local\Stimulsoft
   [21/11/2007|02:17] C:\Users\henri\AppData\Local\TechSmith
   [10/05/2009|23:46] C:\Users\henri\AppData\Local\Temp
   [09/10/2008|00:40] C:\Users\henri\AppData\Local\TempDIR
   [05/09/2007|18:03] C:\Users\henri\AppData\Local\Temporary Internet Files 
   [22/01/2009|22:32] C:\Users\henri\AppData\Local\vdownloader
   [07/11/2007|17:52] C:\Users\henri\AppData\Local\VirtualStore
   [07/01/2009|12:09] C:\Users\henri\AppData\Local\WDSetup
   [07/10/2008|10:13] C:\Users\henri\AppData\Local\Xenocode
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [10/05/2009 19:57][--a------] C:\Windows	asks\GoogleUpdateTaskUserS-1-5-21-1754156993-695157337-552481621-1000.job
   [10/05/2009 23:15][--a------] C:\Windows	asks\Google Software Updater.job
   [08/05/2009 17:17][--a------] C:\Windows	asks\Maintenance en 1 clic.job
   [10/05/2009 23:11][--a------] C:\Windows	asks\GlaryInitialize.job
   [10/05/2009 23:13][--ah-----] C:\Windows	asks\User_Feed_Synchronization-{886D59AA-7D3A-4B5C-9D4D-FDB08718D2A7}.job
   [10/05/2009 23:11][--ah-----] C:\Windows	asks\SA.DAT
   [10/05/2009 23:10][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [11/09/2008|23:49] C:\ProgramData\.zreglib
   [04/01/2009|13:52] C:\ProgramData\{3AA1BE04-7F2A-41E0-98CA-BC79285DF0A3}
   [04/01/2009|13:47] C:\ProgramData\{B33CBE2B-A739-401D-A5E0-041195C4A17B}
   [06/01/2009|23:58] C:\ProgramData\{B73EC431-2F59-4E5E-9CEA-001681A75E3E}
   [26/11/2008|23:34] C:\ProgramData\4D
   [18/09/2007|10:22] C:\ProgramData\a32l
   [01/01/2008|22:24] C:\ProgramData\ACD Systems
   [23/04/2009|19:24] C:\ProgramData\Acronis
   [15/04/2009|14:48] C:\ProgramData\Adobe
   [25/01/2008|00:00] C:\ProgramData\Ahead
   [03/04/2009|16:13] C:\ProgramData\Apple
   [12/09/2008|00:20] C:\ProgramData\Apple Computer
   [02/11/2006|15:02] C:\ProgramData\Application Data 
   [24/03/2009|23:23] C:\ProgramData\Aquadelic GT
   [30/04/2008|01:15] C:\ProgramData\Arovax
   [01/02/2009|21:56] C:\ProgramData\Avira
   [31/01/2009|18:47] C:\ProgramData\Avira(338)
   [21/01/2008|21:02] C:\ProgramData\AVS4YOU
   [24/06/2008|15:29] C:\ProgramData\BOONTY
   [23/10/2008|20:23] C:\ProgramData\Broadcom
   [05/09/2007|18:02] C:\ProgramData\Bureau 
   [19/12/2007|18:50] C:\ProgramData\CA
   [01/06/2008|16:24] C:\ProgramData\CheckPoint
   [04/12/2008|18:40] C:\ProgramData\Ciel
   [25/01/2008|10:32] C:\ProgramData\CyberLink
   [02/11/2006|15:02] C:\ProgramData\Desktop 
   [02/11/2006|15:02] C:\ProgramData\Documents 
   [19/12/2008|23:08] C:\ProgramData\DVD Shrink
   [06/01/2009|23:53] C:\ProgramData\Dynacom
   [27/11/2008|16:22] C:\ProgramData\EBP
   [24/01/2008|19:43] C:\ProgramData\Elaborate Bytes
   [09/08/2008|01:05] C:\ProgramData\eMule
   [20/01/2009|23:24] C:\ProgramData\ezsidmv.dat
   [05/09/2007|18:02] C:\ProgramData\Favoris 
   [02/11/2006|15:02] C:\ProgramData\Favorites 
   [23/07/2008|12:49] C:\ProgramData\FLEXnet
   [01/02/2009|20:34] C:\ProgramData\GESTAN
   [24/03/2009|23:30] C:\ProgramData\Google
   [10/05/2009|16:29] C:\ProgramData\Google Updater
   [10/03/2008|19:08] C:\ProgramData\HP
   [25/10/2007|16:06] C:\ProgramData\HPSSUPPLY
   [09/12/2008|17:41] C:\ProgramData\hpzinstall.log
   [16/08/2008|01:42] C:\ProgramData\IM
   [04/12/2007|01:35] C:\ProgramData\IncrediMail
   [28/02/2009|14:34] C:\ProgramData\Installations
   [05/09/2007|18:05] C:\ProgramData\InstallShield
   [19/08/2008|00:59] C:\ProgramData\iolo
   [29/03/2008|14:54] C:\ProgramData\jahafydk
   [24/03/2008|21:01] C:\ProgramData\Kaspersky Lab
   [16/12/2007|23:57] C:\ProgramData\Kaspersky Lab Setup Files
   [01/04/2009|19:33] C:\ProgramData\ma-config.com
   [23/07/2008|11:49] C:\ProgramData\Macromedia
   [29/03/2008|20:49] C:\ProgramData\Macrovision
   [28/05/2008|15:33] C:\ProgramData\Malwarebytes
   [21/01/2008|10:35] C:\ProgramData\McAfee
   [05/09/2007|18:02] C:\ProgramData\Menu D‚marrer 
   [24/03/2009|15:47] C:\ProgramData\Microsoft
   [02/05/2009|00:34] C:\ProgramData\Microsoft Help
   [05/09/2007|18:02] C:\ProgramData\ModŠles 
   [29/03/2008|14:54] C:\ProgramData
oipjros
   [03/11/2007|01:55] C:\ProgramData\NtiDvdCopy
   [17/01/2009|13:53] C:\ProgramData
tuser.pol
   [26/12/2007|15:43] C:\ProgramData\NVIDIA
   [10/01/2008|17:00] C:\ProgramData\Pinnacle
   [06/11/2007|13:53] C:\ProgramData\Real
   [04/03/2009|23:59] C:\ProgramData\Skyline
   [20/01/2009|23:21] C:\ProgramData\Skype
   [20/01/2008|15:29] C:\ProgramData\SlySoft
   [29/03/2009|17:13] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|15:02] C:\ProgramData\Start Menu 
   [27/10/2008|18:24] C:\ProgramData\SWiSHMax2WorkFolder
   [16/12/2007|23:46] C:\ProgramData\Symantec
   [27/02/2008|14:34] C:\ProgramData\TDK
   [21/11/2007|02:17] C:\ProgramData\TechSmith
   [20/12/2008|16:42] C:\ProgramData\TEMP
   [02/11/2006|15:02] C:\ProgramData\Templates 
   [09/10/2008|00:15] C:\ProgramData\TrackMania
   [19/08/2008|01:15] C:\ProgramData\TuneUp Software
   [25/10/2007|17:02] C:\ProgramData\WEBREG
   [18/09/2007|01:18] C:\ProgramData\WinZip
   [26/04/2008|00:31] C:\ProgramData\WLInstaller
   [05/09/2007|18:52] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [11/09/2008|22:57] C:\Program Files\AAALOGO2008
   [30/04/2008|01:17] C:\Program Files\ACD Systems
   [30/04/2008|01:17] C:\Program Files\Acer Arcade Deluxe
   [30/04/2008|01:18] C:\Program Files\Acer Inc
   [01/03/2009|20:26] C:\Program Files\Acronis
   [15/04/2009|14:47] C:\Program Files\Adobe
   [15/09/2008|21:26] C:\Program Files\adslTV
   [06/01/2009|23:28] C:\Program Files\AMtechnologie
   [03/04/2009|16:13] C:\Program Files\Apple Software Update
   [13/04/2009|15:47] C:\Program Files\a-squared Free
   [01/02/2009|21:56] C:\Program Files\Avira
   [23/10/2008|20:28] C:\Program Files\Broadcom
   [13/04/2009|12:29] C:\Program Files\Common Files
   [24/03/2009|23:25] C:\Program Files\CyberLink
   [23/09/2008|14:03] C:\Program Files\DAEMON Tools Lite
   [01/04/2009|19:36] C:\Program Files\DIFX
   [19/12/2008|22:54] C:\Program Files\DVD Shrink
   [13/04/2009|12:40] C:\Program Files\EBP
   [04/01/2009|13:46] C:\Program Files\eChanblard
   [24/03/2009|23:36] C:\Program Files\Error Repair Professional
   [08/08/2008|15:51] C:\Program Files\FileZilla FTP Client
   [10/05/2009|22:46] C:\Program Files\FindyKill
   [07/01/2009|13:03] C:\Program Files\GESTAN
   [26/09/2008|21:33] C:\Program Files\GIMP-2.0
   [30/04/2008|01:19] C:\Program Files\Glary Utilities
   [24/03/2009|23:30] C:\Program Files\Google
   [30/04/2008|01:19] C:\Program Files\Hercules
   [09/12/2008|17:37] C:\Program Files\HP
   [10/05/2008|09:50] C:\Program Files\IEPro
   [14/03/2009|20:57] C:\Program Files\IncrediMail
   [07/05/2009|11:04] C:\Program Files\InstallShield Installation Information
   [09/05/2009|03:01] C:\Program Files\Internet Explorer
   [30/04/2008|01:20] C:\Program Files\Inventel
   [02/09/2008|01:38] C:\Program Files\Java
   [21/11/2008|18:57] C:\Program Files\JRE
   [30/04/2008|01:20] C:\Program Files\K-Lite Codec Pack
   [30/04/2008|01:20] C:\Program Files\Launch Manager
   [10/09/2008|21:21] C:\Program Files\Lavalys
   [01/04/2009|19:33] C:\Program Files\ma-config.com
   [26/02/2009|10:40] C:\Program Files\Macromedia
   [23/03/2009|23:57] C:\Program Files\Malwarebytes' Anti-Malware
   [23/03/2009|13:57] C:\Program Files\Microsoft
   [30/04/2008|01:20] C:\Program Files\Microsoft ActiveSync
   [30/04/2008|01:20] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [30/04/2008|01:20] C:\Program Files\Microsoft Games
   [23/10/2008|20:23] C:\Program Files\Microsoft IntelliPoint
   [30/04/2008|01:20] C:\Program Files\Microsoft Office
   [09/02/2009|21:14] C:\Program Files\Microsoft SQL Server
   [30/04/2008|01:20] C:\Program Files\Microsoft Visual Studio
   [26/03/2009|10:01] C:\Program Files\Microsoft Visual Studio 8
   [24/03/2009|15:49] C:\Program Files\Microsoft Works
   [24/03/2009|15:47] C:\Program Files\Microsoft.NET
   [24/03/2009|23:27] C:\Program Files\Motherboard Monitor 5
   [17/05/2008|09:52] C:\Program Files\Movie Maker
   [10/05/2009|23:01] C:\Program Files\Mozilla Firefox 3 Beta 2
   [24/03/2009|15:49] C:\Program Files\MSBuild
   [23/03/2009|20:57] C:\Program Files\MSN Messenger
   [10/05/2009|23:00] C:\Program Files\Navilog1
   [01/02/2009|21:54] C:\Program Files\Notebook Hardware Control
   [30/04/2008|01:20] C:\Program Files\Notepad++
   [30/04/2008|01:20] C:\Program Files\Nvu
   [30/04/2008|01:20] C:\Program Files\OpenAL
   [04/01/2009|13:46] C:\Program Files\OpenOffice.org 2.4
   [21/11/2008|18:56] C:\Program Files\OpenOffice.org 3
   [30/04/2008|01:20] C:\Program Files\OpenSource Flash Video Splitter
   [15/04/2009|17:18] C:\Program Files\Panda Security
   [21/02/2009|19:41] C:\Program Files\pdfforge Toolbar
   [12/09/2008|00:21] C:\Program Files\QuickTime
   [30/04/2008|01:21] C:\Program Files\RealMedia
   [30/04/2008|01:21] C:\Program Files\Realtek
   [03/03/2009|11:24] C:\Program Files\Recuva
   [30/04/2008|01:21] C:\Program Files\Reference Assemblies
   [03/04/2009|16:14] C:\Program Files\Safari
   [04/03/2009|23:59] C:\Program Files\Skyline
   [10/09/2008|16:53] C:\Program Files\SlySoft
   [11/04/2009|16:02] C:\Program Files\Spamihilator
   [01/03/2009|14:17] C:\Program Files\SpeedFan
   [06/11/2008|02:11] C:\Program Files\Spybot - Search & Destroy
   [04/01/2009|13:46] C:\Program Files\Super DVD Creator 9.20
   [30/04/2008|01:21] C:\Program Files\Synaptics
   [24/09/2008|20:23] C:\Program Files\SystemRequirementsLab
   [30/04/2008|01:21] C:\Program Files\TechSmith
   [01/03/2009|18:10] C:\Program Files\T‚l‚chargeur de Powershot Pinball
   [29/03/2009|16:40] C:\Program Files\T‚l‚chargeur de Sonic Adventure DX
   [19/04/2009|10:40] C:\Program Files\The Bitmap Brothers
   [10/05/2009|22:16] C:\Program Files\Trend Micro
   [23/03/2009|23:52] C:\Program Files\TuneUp Utilities 2008
   [29/01/2009|00:40] C:\Program Files\TuneUp Utilities 2009
   [22/01/2009|22:32] C:\Program Files\VDOWNLOADER
   [04/01/2009|13:46] C:\Program Files\Wanadoo
   [30/04/2008|01:21] C:\Program Files\WinASPI
   [17/05/2008|09:52] C:\Program Files\Windows Calendar
   [17/05/2008|09:52] C:\Program Files\Windows Collaboration
   [17/05/2008|09:52] C:\Program Files\Windows Defender
   [17/05/2008|09:52] C:\Program Files\Windows Journal
   [23/03/2009|13:56] C:\Program Files\Windows Live
   [24/12/2008|18:39] C:\Program Files\Windows Live Safety Center
   [23/03/2009|13:57] C:\Program Files\Windows Live SkyDrive
   [16/04/2009|03:12] C:\Program Files\Windows Mail
   [12/03/2009|04:06] C:\Program Files\Windows Media Player
   [04/01/2009|13:46] C:\Program Files\Windows NT
   [17/05/2008|09:52] C:\Program Files\Windows Photo Gallery
   [17/05/2008|09:52] C:\Program Files\Windows Sidebar
   [30/04/2008|01:21] C:\Program Files\WinZip
   [20/08/2008|00:46] C:\Program Files\Zoom Player

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [30/04/2008|01:18] C:\Program Files\Common Files\ACD Systems
   [01/03/2009|20:26] C:\Program Files\Common Files\Acronis
   [15/04/2009|14:47] C:\Program Files\Common Files\Adobe
   [30/04/2008|01:18] C:\Program Files\Common Files\Adobe Systems Shared
   [29/03/2009|18:18] C:\Program Files\Common Files\Ahead
   [30/04/2008|01:18] C:\Program Files\Common Files\AVSMedia
   [15/09/2008|00:40] C:\Program Files\Common Files\BOONTY Shared
   [30/04/2008|01:18] C:\Program Files\Common Files\Designer
   [30/04/2008|01:18] C:\Program Files\Common Files\France Telecom
   [30/04/2008|01:18] C:\Program Files\Common Files\Hewlett-Packard
   [09/12/2008|17:37] C:\Program Files\Common Files\HP
   [30/04/2008|01:18] C:\Program Files\Common Files\InstallShield
   [30/04/2008|01:18] C:\Program Files\Common Files\Java
   [30/04/2008|01:18] C:\Program Files\Common Files\L&H
   [29/03/2009|16:32] C:\Program Files\Common Files\LightScribe
   [23/07/2008|12:25] C:\Program Files\Common Files\Macromedia
   [23/07/2008|02:02] C:\Program Files\Common Files\Macrovision Shared
   [26/03/2009|09:59] C:\Program Files\Common Files\microsoft shared
   [06/01/2009|23:53] C:\Program Files\Common Files\MSSoap
   [30/04/2008|01:19] C:\Program Files\Common Files\muvee Technologies
   [30/04/2008|01:19] C:\Program Files\Common Files\NewTech Infosystems
   [07/01/2009|12:10] C:\Program Files\Common Files\PC SOFT
   [13/04/2009|12:29] C:\Program Files\Common Files\Pervasive Software Shared
   [30/04/2008|01:19] C:\Program Files\Common Files\PX Storage Engine
   [30/04/2008|01:19] C:\Program Files\Common Files\Scanner
   [30/04/2008|01:19] C:\Program Files\Common Files\Services
   [20/01/2009|23:21] C:\Program Files\Common Files\Skype
   [30/04/2008|01:19] C:\Program Files\Common Files\SpeechEngines
   [27/10/2008|18:13] C:\Program Files\Common Files\SWiSHzone.com
   [30/04/2008|01:19] C:\Program Files\Common Files\Symantec Shared
   [24/03/2009|15:54] C:\Program Files\Common Files\System
   [23/03/2009|13:10] C:\Program Files\Common Files\Windows Live
   [02/03/2008|01:57] C:\Program Files\Common Files\WindowsLiveInstaller
   [20/08/2008|00:52] C:\Program Files\Common Files\Wise Installation Wizard

   --------------------\  Process

   ( 82 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-05-10 23:47:15
   Windows 6.0.6001 Service Pack 1 NTFS
   scanning hidden processes ...
   ? [4912]
   scanning hidden files ...
   C:\Windows\System32\IME\shared
   C:\Windows\System32\IME\shared\IMEAPIS.DLL 29696 bytes executable
   C:\Windows\System32\IME\sharedes
   C:\Windows\System32\IME\sharedes\padrs404.dll 11264 bytes executable
   C:\Windows\System32\IME\sharedes\padrs804.dll 11776 bytes executable
   C:\Windows\System32\mdelk.exe 67667 bytes executable
   C:\Windows\System32\wintems.exe 67667 bytes executable
   scan completed successfully
   hidden processes: 1
   hidden files: 96
 
   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]

   --------------------\  Cracks & Keygens ..

   C:\Users\henri\AppData\Roaming\Microsoft\Office\Recent\crack.LNK
   C:\Users\henri\AppData\Roaming\Shareaza\Torrents\CloneDVD v2.9.1.2 Incl Keygen.torrent
   C:\Users\henri\AppData\Roaming\Shareaza\Torrents\O&O Defrag 10 Professional Edition + Keygen.rar.torrent
   C:\Users\henri\Favorites\KEYGEN.MS - Generates cracks serials keygens for the software to unlock it for free.url
   C:\Users\henri\Favorites\performancetest 6.0 crack EASY CRACKS - the largest cracks keygens and serials database.url
   C:\Users\henri\Favorites\informatique\CRACK.MS - All CRACKs and SERIALs on ONE Site.url


   [F:5][D:5]-> C:\Users\henri\AppData\Local\Temp
   [F:4][D:1]-> C:\Users\henri\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:474][D:17]-> C:\Users\henri\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:29][D:49]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 10/05/2009|23:55 - Option : [2]

   --------------------\  Fin du rapport a 23:55:02

lilou · Answer

SmitFraudFix v2.323

Scan done at 23:24:25,49, 10/05/2009
Run from C:\Users\henri\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts



127.0.0.1       localhost


»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Contrôleur de réseau NVIDIA nForce
DNS Server Search Order: 80.10.246.2
DNS Server Search Order: 80.10.246.129

Description: Carte réseau Broadcom 802.11g
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{99ABC338-4ECA-4792-BEB7-AF20591F034D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{E48E3209-09E1-435B-8A80-A1EDA3A76950}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: NameServer=80.10.246.2,80.10.246.129
HKLM\SYSTEM\CS1\Services\Tcpip\..\{99ABC338-4ECA-4792-BEB7-AF20591F034D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E48E3209-09E1-435B-8A80-A1EDA3A76950}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: NameServer=80.10.246.2,80.10.246.129
HKLM\SYSTEM\CS3\Services\Tcpip\..\{99ABC338-4ECA-4792-BEB7-AF20591F034D}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E48E3209-09E1-435B-8A80-A1EDA3A76950}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: NameServer=80.10.246.2,80.10.246.129
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
 
Registry Cleaning done. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

V-X · Answer

Re,

Euh, tu vas tous les faires ?

Télécharge ComboFix (de sUBs) sur ton Bureau. 

/!\Désactive temporairement toute protection résidente /!\ (Antivirus, antispywares..)
Double clique sur ComboFix.exe.
Accepte la licence en cliquant sur Oui.
Le programme va te demander si tu souhaites installer la Console de Récupération. C'est une précaution, au cas où l'ordinateur tomberait en panne. Je te conseille donc de l'installer, ça ne coûte rien, et ça pourrait potentiellement servir !
Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse. 


Le rapport se trouve ici : %SystemDrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

Aide :Comment utiliser ComboFix. 

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

lilou · Answer

ben si ça peut vous aider j en sais rien moi

lilou · Answer

############################## [ FindyKill V4.728 ]

# User : henri (Administrateurs) # PC-DE-HENRI
# Update on 03/05/09 by Chiquitine29
# Start at: 00:56:44 | 11/05/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

# AMD Turion(tm) 64 X2 Mobile Technology TL-50
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 51,99 Go (10,23 Go free) [VISTA] # NTFS
# D:\ # Disque fixe local # 44,66 Go (18,93 Go free) [LOISIR UTILITAIRE] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# G:\ # Disque amovible # 961,73 Mo (347,94 Mo free) [PHOTO USB] # FAT
# H:\ # Disque fixe local # 35,62 Go (22,94 Go free) [AMOVIBLE1] # NTFS
# I:\ # Disque fixe local # 15,47 Go (12,93 Go free) [AMOVIBLE2] # FAT32

############################## [ Processus actifs ]

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Windows\system32\DRIVERS\CDANTSRV.EXE
C:\Windows\system32\crypserv.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\oodag.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
D:\utilitaire\photodexgold\ScsiAccess.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Windows\System32\wintems.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\PVSW\Bin\w3dbsmgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32	askeng.exe
C:\Users\henri\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\conime.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
 
################## [ Processus infectieux stoppés ]  

"C:\Windows\System32\wintems.exe"  (4220)

################## [ Fichiers / Dossiers infectieux ]

Found ! C:\Windows\system32\mdelk.exe 
Found ! C:\Windows\system32\wintems.exe 
Found ! "C:\Users\henri\AppData\Roaming\drivers" 
Found ! "C:\Users\henri\AppData\Roaming\drivers\downld" 
Found ! "C:\Users\henri\AppData\Roaming\drivers\wfsintwq.sys" 

################## [ Infected Temp Files ]

Found ! C:\Users\henri\Local Settings\Temporary Internet Files\Content.IE5\UG2RGG88\file[1].txt  

################## [ Registre / Clés infectieuses ]

Found ! HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\DateTime4  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA   
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S  
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S  
Found ! HKEY_CURRENT_USER\Software\DateTime4  
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"drvsyskit" 
Found ! HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Run\"drvsyskit"  
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"german.exe" 
Found ! HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Run\"german.exe"  
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"mule_st_key" 
Found ! HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Run\"mule_st_key"  

# (!) HKLM\SYSTEM\...\Services\srosa -> Start = 0x1

################## [ Recherche dans supports amovibles]


################## [ Registre / Mountpoints2 ]

# -> Not found !  

################## [ ! Fin du rapport # FindyKill V4.728 ! ]

V-X · Answer

Re,

Ne fait pas combofix.

Findykill de chiquitine29 option 2:

&#x25B6 Branche tes disques amovibles à ton PC ( (clefs USB, disque dur externe, etc...) sans les ouvrir

&#x25B6 Double-clique sur le raccourci FindyKill sur ton bureau

&#x25B6 Au menu principal, choisisl'option 2 (Suppression)

/!\ Il y aura 1 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

&#x25B6 Ensuite, poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

lilou · Answer

ok merci

lilou · Answer

je n ai pas de rapport et ça fait 5 mn que le pc a redemarrer

V-X · Answer

Re,

le rapport FindyKill.txt est sauvegardé à la racine du disque.

V-X · Answer

Re,

V-X, la star du X. chuuuuuut euhhhhhh !! , faut pas le dire....

Hiuto · Answer

J'ai très envie de toi.

V-X · Answer

Re,

Ah bon ?? Femme /Homme ?

Hiuto · Answer

Femme sur Homme ou Homme sur Femme, c'est toi qui voit.

V-X · Answer

Re,

OKI.

Hiuto · Answer

On fait ça où ?

Par terre, derrière les rideaux, dans la baignoire...

kim.duo00 · Answer

bonsoir

2 solutions radicales:-)
______________________________
1) Y a t-il possibilité de "sortir" le disque dur du PC et de l'installer en "esclave" sur un autre pc ayant comme système d'exploitation un linux!

2) Soit à partir d'un disque de "boot" (exemple" avec ubuntu") de démarrer le PC!
_______________________________

Puis faire une sauvegarde de toutes les données "mortes" (photos, vidéos , musique, etc.) et de réinstaller le disque dur après formatage (à l'aide les disques de réinstallation!)

Nota: pensez à vérifier avec un anti-virus que les données sauvegardées sont saines et sauves LOL


@+

V-X · Answer

Re,

Il en faut peu pour être heureux dadada.

Comme tu dit...

lilou · Answer

bon desolè du retard j ai reussit a faire un rapport hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:25:14, on 11/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32undll32.exe
C:\Users\henri\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\PVSW\Bin\w3dbsmgr.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows
otepad.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Windows
otepad.exe
D:\prout\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NetFxUpdate_v1.1.4322] "C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe" 1 v1.1.4322 GAC + NI NID
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\utilitaire\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [german.exe] C:\Windows\system32\wintems.exe
O4 - Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\Bin\w3dbsmgr.exe
O4 - Global Startup: AutorunsDisabled
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.76\AMVConverter\grab.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\UTILIT~2\WORD\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\UTILIT~2\WORD\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.76\MediaManager\grab.html
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~2\WORD\Office12\REFIEBAR.DLL
O16 - DPF: {13149882-F480-4F6B-8C6A-0764F75B99ED} - http://plug-in.reallusion.com/crazytalk4.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/betaactivescan/cabs/as2stubie.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\WIDEST~1\FREEQU~1\QUICKA~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache2.2 - Unknown owner - D:\xampplite\xampplite\apache\bin\apache.exe (file missing)
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\Windows\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: mysql - Unknown owner - D:\xampplite\xampplite\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: ScsiAccess - Unknown owner - D:\utilitaire\photodexgold\ScsiAccess.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

V-X · Answer

Re,

&#x25B6 Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

&#x25B6 Double clique sur RSIT.exe pour lancer l'outil.

&#x25B6 Clique sur ' continue ' à l'écran Disclaimer.

&#x25B6 Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

&#x25B6 Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports séparément.
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

lilou · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by henri at 2009-05-11 15:42:04
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 11 GB (21%) free of 53 GB
Total RAM: 2814 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:42:16, on 11/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32undll32.exe
C:\Users\henri\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\DRIVERS\CDANTSRV.EXE
C:\Windows\system32\crypserv.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\PVSW\Bin\w3dbsmgr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\oodag.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
D:\utilitaire\photodexgold\ScsiAccess.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\mobsync.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2guard.exe
C:\PROGRAM FILES\A-SQUARED FREE\A2FREE.EXE
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
D:\dvix\a voir\RSIT.exe
D:\prout\henri.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NetFxUpdate_v1.1.4322] "C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe" 1 v1.1.4322 GAC + NI NID
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\utilitaire\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [german.exe] C:\Windows\system32\wintems.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\Bin\w3dbsmgr.exe
O4 - Global Startup: AutorunsDisabled
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.76\AMVConverter\grab.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\UTILIT~2\WORD\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\UTILIT~2\WORD\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.76\MediaManager\grab.html
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~2\WORD\Office12\REFIEBAR.DLL
O16 - DPF: {13149882-F480-4F6B-8C6A-0764F75B99ED} - http://plug-in.reallusion.com/crazytalk4.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/betaactivescan/cabs/as2stubie.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\WIDEST~1\FREEQU~1\QUICKA~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache2.2 - Unknown owner - D:\xampplite\xampplite\apache\bin\apache.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\Windows\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: mysql - Unknown owner - D:\xampplite\xampplite\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: ScsiAccess - Unknown owner - D:\utilitaire\photodexgold\ScsiAccess.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

lilou · Answer

je peux pas poster l autre rapport

lilou · Answer

info.txt logfile of random's system information tool 1.06 2009-05-11 15:42:20

======Uninstall list======

-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B145EC69-66F5-11D8-9D75-000129760D75}\setup.exe"  -uninstall
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B804C424-B66D-447A-84BD-C6B88C392C3A}\setup.exe"  -uninstall
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F79A208D-D929-11D9-9D77-000129760D75}\setup.exe"  -uninstall
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
AAA Logo 2008 2.10-->"C:\Program Files\AAALOGO2008\unins000.exe"
ACDSee 10 Photo Manager-->MsiExec.exe /I{F8B98EB6-FC06-45BF-87D4-9784E0408611}
Acer Arcade Deluxe-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}\setup.exe"  -uninstall
Acer eDataSecurity Management-->C:\Acer\Empowering Technology\eDataSecurity\eDSnstHelper.exe -Operation UNINSTALL
Acer eLock Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}\setup.exe" -l0x40c  -removeonly
Acer Empowering Technology-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x40c  -removeonly
Acer eNet Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C06554A1-2C1E-4D20-B613-EE62C79927CC}\setup.exe" -l0x40c  -removeonly
Acer ePower Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\setup.exe" -l0x40c  -removeonly
Acer ePresentation Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BF839132-BD43-4056-ACBF-4377F4A88E2A}\setup.exe" -l0x40c  -removeonly
Acer eSettings Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CE65A9A0-9686-45C6-9098-3C9543A412F0}\setup.exe" -l0x40c  -removeonly
Acer GridVista-->C:\Windows\UnInst32.exe GridV.UNI
Acer Mobility Center Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11316260-6666-467B-AC34-183FCB5D4335}\setup.exe" -l0x40c  -removeonly
Acer OrbiCam -->C:\Program Files\InstallShield Installation Information\{DD1DED37-2486-4F56-8F89-56AA814003F5}\Setup.exe -runfromtemp -l0x040c -removeonly
Acer OrbiCam-->Rundll32.exe BisonR07.dll,WinMainRmv
Acer Tour-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94389919-B0AA-4882-9BE8-9F0B004ECA35}\setup.exe" -l0x40c  -removeonly
Acronis True Image Home-->MsiExec.exe /X{E5343B27-55DF-40BD-9FCF-A643C1331E8A}
Adiboo and Paziral's Secret-->C:\Windows\unvise32.exe i:\abidoujeux\uninstal.log
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe Dreamweaver CS3-->C:\Program Files\Common Files\Adobe\Installers\ad19d2ae8332572b119cf35fd0a30d8\Setup.exe
Adobe Dreamweaver CS3-->MsiExec.exe /I{4BDB76C6-902E-41D5-9064-68768E02886B}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Extension Manager CS3-->MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->MsiExec.exe /X{8186E1B9-DDC6-45B6-B9EB-C28947CBC4CF}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x40c 
Adobe Reader 8.1.3 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
Adobe Setup-->MsiExec.exe /I{D2E18162-47FB-4216-8AB3-F420C1AF75A4}
Adobe Shockwave Player 11-->C:\Windows\system32\adobe\SHOCKW~1\UNWISE.EXE C:\Windows\system32\Adobe\SHOCKW~1\Install.log
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Album Photo-->MsiExec.exe /X{23BFF55F-A391-4985-96AB-B81657FC508D}
AMT EBS Easy Business Solutions-->MsiExec.exe /X{6444F297-90C5-4A70-AFF1-E565A0E40C61}
Analyseur et SDK MSXML 4.0 SP2-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft Funhouse-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{21A7C708-D575-491C-94AE-86FFCF2BF19F}\Setup.exe" -l0x9  -uninst 
a-squared Anti-Malware 4.0-->"C:\Program Files\a-squared Anti-Malware\unins000.exe"
a-squared Free 4.0-->"C:\Program Files\a-squared Free\unins000.exe"
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Asterix & Obelix XXL-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{D562E689-0ECD-4239-B1A0-323252893405} /l1036 
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Blender (remove only)-->"D:\utilitaire\Blender\uninstall.exe"
Broadcom Driver v4.150.22.0_Foxconn Installation Program-->C:\Program Files\InstallShield Installation Information\{88410D8F-8529-492B-B556-2394A29B811B}\setup.exe -runfromtemp -l0x0009 -removeonly
CCleaner (remove only)-->"D:\utilitaire\CCleaner\uninst.exe"
C-Dilla Licence Management System-->C:\C_DILLA\setup\cdunin16.exe
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Compel Adaptec WinASPI-->"C:\Program Files\WinASPI\unins000.exe"
CSV2ASC-->D:\utilitaire\CSV2ASC\uninstall.exe
Disney Donald Couak Attak-->C:\Windows\IsUn040c.exe -fi:\JEUXLO~1\donald\DeIsL1.isu
DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
EBP Compta & Devis-Factures Open Line Pratic 2009 1.0-->C:\ProgramData\{3AA1BE04-7F2A-41E0-98CA-BC79285DF0A3}\EBP.exe
EBP Comptabilité et Facturation-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9C7C8316-454C-41E4-B3A3-9C30A3943F85}\setup.exe" -l0x40c  /uninst
eMule-->"D:\utilitaire\eMule\Uninstall.exe"
Error Repair Professional 3.8.5-->"C:\Program Files\Error Repair Professional\unins000.exe"
EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
ffdshow [rev 1723] [2007-12-24]-->"C:\Program Files\K-Lite Codec Pack\ffdshow\unins000.exe"
Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)-->MsiExec.exe /X{3380F354-C5F7-4E71-8F51-EEE6C3F06C62}
FileRescue Pro 2.7-->C:\Program Files\FileRescue Pro\uninst.exe
FindyKill-->C:\FindyKill\Uninstal.exe
GIMP 2.4.7-->"C:\Program Files\GIMP-2.0\setup\unins000.exe"
Glary Utilities Pro 2.5-->"C:\Program Files\Glary Utilities\unins000.exe"
GMail Drive Shell Extension-->rundll32.exe C:\Windows\system32\ShellExt\GMailFS.dll,Uninstall C:\Windows\system32\ShellExt\GMailFS.inf
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google SketchUp 6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\setup.exe" -l0x40c  -removeonly
Google SketchUp 6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}\setup.exe" -l0x40c  -removeonly
Google Talk Plugin-->MsiExec.exe /I{5012BC0C-7E1A-329A-8F02-B6846070C5F8}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar3.dll"
GT Legends 1.0.0.0-->"H:\GTL\Support\unins000.exe"
Hercules WiFi Station for Livebox-->C:\Program Files\InstallShield Installation Information\{DECE22F4-EEDD-4615-BC56-2F4827FAD64B}\setup.exe -runfromtemp -l0x040c -removeonly
HijackThis 2.0.2-->"D:\SECURITE\hijack\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Participation Program 8.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 8.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 8.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart Essential 3.5-->C:\Program Files\HP\Digital Imaging\PhotosmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B-->C:\Program Files\HP\Digital Imaging\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}\setup\hpzscr01.exe -datfile hposcr19.dat -onestop -showdisconnect -forcereboot
HP Product Detection-->MsiExec.exe /X{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}
HP Solution Center 8.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
HP USB Disk Storage Format Tool-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}\Setup.exe" -l0x9  anything
HPSSupply-->MsiExec.exe /X{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}
IE7Pro-->C:\Program Files\IEPro\uninst.exe
IncrediMail-->C:\Program Files\IncrediMail\bin\ImSetup.exe /remove /addon:IncrediMail /log:IncMail.log
IndyCar Series-->MsiExec.exe /I{CCD58DA0-8FC9-40F6-9346-5B1528DEA638}
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
IsoBuster 2.4-->"D:\utilitaire\IsoBuster\Uninst\unins000.exe"
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
K-Lite Mega Codec Pack 3.5.0-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lame ACM MP3 Codec-->C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection Remove_LameMP3 132 C:\Windows\INF\LameACM.inf
Launch Manager-->C:\Windows\UnInst32.exe LManager.UNI
Le Monde de Nemo-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{3B26434C-FFA8-4A9C-A9C9-E8EE9C4E89D4} NemoADVUninstall
Lightsmark 2007-->MsiExec.exe /I{4BCAF301-6F25-4BEF-A2F0-416D7F30AEB1}
Ma-Config.com-->MsiExec.exe /X{560BD6E0-0BA6-43AF-B423-E1DF4D2EB3C3}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MiCôSystème-->MsiExec.exe /I{2419C554-4914-4528-85CD-0A8018AFDBB1}
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Office XP Professional with FrontPage-->MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft SQL Server 2005 Express Edition (EBP)-->MsiExec.exe /I{480DBB60-F0B6-45F2-B26F-1A2E11197791}
Microsoft SQL Server 2005 Tools Express Edition-->MsiExec.exe /I{3F59A7E0-BC01-4435-9E93-C7D7015C21DA}
Microsoft SQL Server 2005-->"C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
Microsoft SQL Server Native Client-->MsiExec.exe /I{1F24E48F-7692-4E89-8784-68DD4D2712A0}
Microsoft SQL Server VSS Writer-->MsiExec.exe /I{A30179B7-997A-4D47-AA43-57AE59A9C78B}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour Microsoft Office Excel 2007 Help  (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Word 2007 Help  (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Mise à Jour Vos Photos Deluxe -->MsiExec.exe /X{01511AB4-2011-4733-9E99-9AB9B000D671}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Motherboard Monitor 5 Languages-->"C:\Program Files\Motherboard Monitor 5\Language\unins000.exe"
Motherboard Monitor 5-->"C:\Program Files\Motherboard Monitor 5\unins000.exe"
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox 3 Beta 2\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Navilog1 3.7.6-->"C:\Program Files\Navilog1\unins000.exe"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Notepad++-->C:\Program Files\Notepad++\uninstall.exe
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
Nvu 1.0-->D:\utilitaire\Nvu\unins000.exe
O&O Defrag Professional Edition-->MsiExec.exe /I{53480330-E1D1-41CA-B8F8-7F78644F7F50}
ONES Trial (F)-->C:\Windows\InZU31.exe /U:C:\Program Files\ONES Trial (F)\Uninstall.inz /L:f /K:ONES(F)
OpenAL-->"C:\Program Files\OpenAL\oalinst.exe" /U
OpenOffice.org 3.0-->MsiExec.exe /I{6860B340-530D-46B3-91F8-1AE1F70F7C33}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Paint.NET v3.10-->MsiExec.exe /X{5E749AEB-5A19-43BA-BB20-3CBB37539FE4}
Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
PDFCreator-->D:\utilitaire\PDFCreator\unins000.exe
PerfectAed-->MsiExec.exe /I{68FDFE6E-A0F2-4A9E-9623-BB4A5D735F91}
Pervasive System Analyzer-->C:\Windows\IsUninst.exe -f"C:\Program Files\Common Files\Pervasive Software Shared\PSA\psa.isu"
Pervasive.SQL V8 Workgroup (v8.6)-->MsiExec.exe /I{5FCFC78C-438A-4F4D-B266-E32B8468BAFC}
PhotoFiltre-->"D:\utilitaire\PhotoFiltre\Uninst.exe"
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
PL-2303 USB-to-Serial-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.exe" -l0x9 Installed
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall
PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe"  -uninstall
Product Key Explorer 2.1.2-->"D:\UTILITAIRE SETUP\crakeur\ProductKeyExplorer\unins000.exe"
QuickTime for Windows (32-bit)-->C:\WINDOWS\QTW32DEL.EXE
QuickTime-->MsiExec.exe /I{08094E03-AFE4-4853-9D31-6D0743DF5328}
RealMedia (remove only)-->"C:\Program Files\RealMedia\uninstall.exe"
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Recuva (remove only)-->"C:\Program Files\Recuva\uninst.exe"
Safari-->MsiExec.exe /I{AF10D7E4-D29A-45DA-8050-B116097B69B5}
SAGEM F@st 800-840-->C:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\setup.exe -runfromtemp -l0x040c -removeonly
Search Settings 1.1-->MsiExec.exe /X{32AD1A7A-25F1-44B9-A396-EA8A4A6605B0}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB960003)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F04F8702-18D0-458D-921E-146FB7CD38CF}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB959997)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {9EAC3AEC-5C81-4856-A05B-DE9DC236D740}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Shareaza 2.4.0.0-->"D:\utilitaire\Shareaza\Uninstall\unins000.exe"
Spamihilator-->"C:\Program Files\Spamihilator\uninstall.exe"
SpeedFan (remove only)-->"C:\Program Files\SpeedFan\uninstall.exe"
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SWiSH Max2-->C:\Windows\unvise32.exe d:\utilitaire\flasdh\uninstal.log
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
SyncBack-->"D:\utilitaire\sauvegarde fichier\SyncBack\unins000.exe"
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TerraExplorer-->C:\Program Files\Skyline\TerraExplorer\Setup.exe [OP]/U
TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {80E46078-C1C5-4AE8-8744-3EAFC812E118}
Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
VDownloader  0.77-->"C:\Program Files\VDOWNLOADER\unins000.exe"
Visual C++ CRT 9.0 SP1-->MsiExec.exe /I{EC25B803-4BDB-47F7-B877-FCE7D7966C0F}
VLC media player 0.9.4-->D:\utilitaire\VLC\uninstall.exe
Vos Photos à la Télé sur CD et DVD 2008 DeLuxe-->MsiExec.exe /X{D799BB95-900B-4554-ADD5-70770673C8A6}
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"
Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinZip 11.1-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}
Xenon 2000 - Project PCF-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{93EE3C83-725F-4EA4-891A-CD6B019FCDC1}\Setup.exe"

lilou · Answer

=====HijackThis Backups=====

O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll [2009-05-11]
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) [2009-05-11]
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) [2009-05-11]
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll [2009-05-11]
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll [2009-05-11]
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll [2009-05-11]
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\pdfforge Toolbar\SearchSettings.exe [2009-05-11]
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll [2009-05-11]
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll [2009-05-11]
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll [2009-05-11]
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) [2009-05-11]
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) [2009-05-11]
O4 - HKCU\..\Run: [drvsyskit] C:\Users\henri\AppData\Roaming\drivers\winupgro.exe [2009-05-11]
O4 - HKCU\..\Run: [german.exe] C:\Windows\system32\wintems.exe [2009-05-11]
O4 - HKCU\..\Run: [mule_st_key] C:\Users\henri\AppData\Roaming\m\flec006.exe [2009-05-11]
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (file missing) [2009-05-11]
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) [2009-05-11]
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll [2009-05-11]
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) [2009-05-11]
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll [2009-05-11]
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) [2009-05-11]
O4 - HKCU\..\Run: [german.exe] C:\Windows\system32\wintems.exe [2009-05-11]
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (file missing) [2009-05-11]

======Security center information======

AV: a-squared Anti-Malware
AS: Spybot - Search and Destroy
AS: Windows Defender

======System event log======

Computer Name: PC-de-henri
Event Code: 7026
Message: Le pilote de démarrage système ou d'amorçage suivant n'a pas pu se charger : 
pavboot
Record Number: 265727
Source Name: Service Control Manager
Time Written: 20090511112739.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-henri
Event Code: 7030
Message: Le service a-squared Anti-Malware Service est marqué comme étant interactif. Cependant, le système est configuré pour ne pas autoriser les services interactifs. Ce service peut ne pas fonctionner correctement.
Record Number: 265767
Source Name: Service Control Manager
Time Written: 20090511120215.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-henri
Event Code: 7031
Message: Le service a-squared Anti-Malware Service s'est terminé de manière inattendue. Ceci s'est produit 1 fois. L'action corrective suivante va être effectuée dans 0 millisecondes : Redémarrer le service.
Record Number: 265771
Source Name: Service Control Manager
Time Written: 20090511131916.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-henri
Event Code: 7000
Message: Le service a-squared Free Service n'a pas pu démarrer en raison de l'erreur : 
a-squared Free Service n'est pas une application Win32 valide.
Record Number: 265773
Source Name: Service Control Manager
Time Written: 20090511132422.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-henri
Event Code: 7000
Message: Le service a-squared Free Service n'a pas pu démarrer en raison de l'erreur : 
a-squared Free Service n'est pas une application Win32 valide.
Record Number: 265774
Source Name: Service Control Manager
Time Written: 20090511132433.000000-000
Event Type: Erreur
User: 

=====Application event log=====

Computer Name: PC-de-henri
Event Code: 3
Message: La configuration du protocole AdminConnection\TCP n'est pas valide dans l'instance SQL EBP.
Record Number: 62841
Source Name: SQLBrowser
Time Written: 20090511065228.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-henri
Event Code: 1530
Message: Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela. 

 DÉTAIL - 
 18 user registry handles leaked from \Registry\User\S-1-5-21-1754156993-695157337-552481621-1000:
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000
Process 1552 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Policies\Microsoft\SystemCertificates
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Policies\Microsoft\SystemCertificates
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Policies\Microsoft\SystemCertificates
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Policies\Microsoft\SystemCertificates
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\SystemCertificates\My
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\SystemCertificates	rust
Process 2200 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\SystemCertificates\Disallowed
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\SystemCertificates\Root
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\SystemCertificates\TrustedPeople
Process 2200 (\Device\HarddiskVolume2\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1236 (\Device\HarddiskVolume2\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\SystemCertificates\CA

Record Number: 62903
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090511112504.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-henri
Event Code: 1530
Message: Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela. 

 DÉTAIL - 
 1 user registry handles leaked from \Registry\User\S-1-5-21-1754156993-695157337-552481621-1000_Classes:
Process 1552 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1754156993-695157337-552481621-1000_CLASSES

Record Number: 62904
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090511112505.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-henri
Event Code: 3
Message: La configuration du protocole AdminConnection\TCP n'est pas valide dans l'instance SQL EBP.
Record Number: 62935
Source Name: SQLBrowser
Time Written: 20090511112723.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-henri
Event Code: 1000
Message: Application défaillante a2service.exe, version 4.0.0.21, horodatage 0x2a425e19, module défaillant ntdll.dll, version 6.0.6001.18000, horodatage 0x4791a7a6, code d’exception 0xc0000005, décalage d’erreur 0x00043111, ID du processus 0x1598, heure de début de l’application 0x01c9d23053443649.
Record Number: 62978
Source Name: Application Error
Time Written: 20090511131909.000000-000
Event Type: Erreur
User: 

=====Security event log=====

Computer Name: PC-de-henri
Event Code: 4907
Message: Les paramètres d’audit sur l’objet ont changé.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-HENRI$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7

Objet :
	Serveur de l’objet :	Security
	Type d’objet :	File
	Nom de l’objet :	C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
	ID du handle :	0x14

Informations sur le processus :
	ID du processus :	0x53c
	Nom du processus :	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6001.18000_none_095f6148c74a7a64\poqexec.exe

Paramètres d’audit :
	Descripteur de sécurité d’origine :	
	Nouveau descripteur de sécurité :		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 71616
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090130212122.967223-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-henri
Event Code: 4907
Message: Les paramètres d’audit sur l’objet ont changé.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-HENRI$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7

Objet :
	Serveur de l’objet :	Security
	Type d’objet :	File
	Nom de l’objet :	C:\Windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
	ID du handle :	0x14

Informations sur le processus :
	ID du processus :	0x53c
	Nom du processus :	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6001.18000_none_095f6148c74a7a64\poqexec.exe

Paramètres d’audit :
	Descripteur de sécurité d’origine :	
	Nouveau descripteur de sécurité :		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 71617
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090130212123.081223-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-henri
Event Code: 4907
Message: Les paramètres d’audit sur l’objet ont changé.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-HENRI$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7

Objet :
	Serveur de l’objet :	Security
	Type d’objet :	File
	Nom de l’objet :	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
	ID du handle :	0x14

Informations sur le processus :
	ID du processus :	0x53c
	Nom du processus :	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6001.18000_none_095f6148c74a7a64\poqexec.exe

Paramètres d’audit :
	Descripteur de sécurité d’origine :	
	Nouveau descripteur de sécurité :		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 71618
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090130212123.150223-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-henri
Event Code: 4907
Message: Les paramètres d’audit sur l’objet ont changé.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-HENRI$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7

Objet :
	Serveur de l’objet :	Security
	Type d’objet :	File
	Nom de l’objet :	C:\Windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
	ID du handle :	0x14

Informations sur le processus :
	ID du processus :	0x53c
	Nom du processus :	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6001.18000_none_095f6148c74a7a64\poqexec.exe

Paramètres d’audit :
	Descripteur de sécurité d’origine :	
	Nouveau descripteur de sécurité :		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 71619
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090130212123.246223-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-henri
Event Code: 4907
Message: Les paramètres d’audit sur l’objet ont changé.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-HENRI$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7

Objet :
	Serveur de l’objet :	Security
	Type d’objet :	File
	Nom de l’objet :	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
	ID du handle :	0x14

Informations sur le processus :
	ID du processus :	0x53c
	Nom du processus :	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.0.6001.18000_none_095f6148c74a7a64\poqexec.exe

Paramètres d’audit :
	Descripteur de sécurité d’origine :	
	Nouveau descripteur de sécurité :		S:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Record Number: 71620
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090130212123.346223-000
Event Type: Succès de l'audit
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=C:\PVSW\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;D:\utilitaire\IsoBuster;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Microsoft SQL Server\90\Tools\binn\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 72 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=4802
"NUMBER_OF_PROCESSORS"=2
"CLASSPATH"=C:\PVSW\bin\pvjdbc2x.jar;C:\PVSW\bin\pvjdbc.jar
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"VSL"=C:\PVSW\bin

-----------------EOF-----------------

V-X · Answer

Re,

&#x25B6 Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

&#x25B6 Mets le à jour

&#x25B6 Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.

&#x25B6 Sélectionne Exécuter un examen COMPLET si ce n'est pas déjà fait

&#x25B6 clique sur Rechercher

&#x25B6 Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

&#x25B6 Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

&#x25B6 Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

&#x25B6 Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Tutoriel pour MalwareByte's

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

lilou · Answer

voila

merci encore

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2109
Windows 6.0.6001 Service Pack 1

11/05/2009 21:48:32
mbam-log-2009-05-11 (21-48-32).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 261428
Temps écoulé: 1 hour(s), 12 minute(s), 46 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\german.exe (Rootkit.Bagle) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

V-X · Answer

Re, ==>>Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.<<=== !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !! ▶ Double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ... ▶ Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil . ▶ Choisis l'option 1 ( "recherche") et tapes "entrée" . ▶Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité de son contenu dans ta prochaine réponse ... ( le rapport est en outre sauvegardé ici -> C:\TB.txt ) Tutoriel Toolbard-S&D Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

lilou · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-50 )
   BIOS : PhoenixBIOS 4.0 Release 6.1     
   USER : henri ( Administrator )
   BOOT : Normal boot
   Antivirus : a-squared Anti-Malware 4 (Not Activated)
   C:\ (Local Disk) - NTFS - Total:51 Go (Free:10 Go)
   D:\ (Local Disk) - NTFS - Total:44 Go (Free:18 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)
   H:\ (Local Disk) - NTFS - Total:35 Go (Free:22 Go)
   I:\ (Local Disk) - FAT32 - Total:15 Go (Free:12 Go)
   J:\ (USB)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 11/05/2009|21:59 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "SearchAssistant"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"
   "CustomizeSearch"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Local Page"="C:\windows\system32\blank.htm"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
   "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchAssistant"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"
   "CustomizeSearch"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm"
   "Local Page"="C:\windows\system32\blank.htm"


   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]

   --------------------\  Cracks & Keygens ..

   C:\Users\henri\Favorites\informatique\CRACK.MS - All CRACKs and SERIALs on ONE Site.url
   1 - "C:\ToolBar SD\TB_1.txt" - 11/05/2009|22:01 - Option : [1]

   -----------\  Fin du rapport a 22:01:46,45

V-X · Answer

Re,

Supprime ton crack.

Télécharge ComboFix (de sUBs) sur ton Bureau. 

/!\Désactive temporairement toute protection résidente /!\ (Antivirus, antispywares..)
Double clique sur ComboFix.exe.
Accepte la licence en cliquant sur Oui.
Le programme va te demander si tu souhaites installer la Console de Récupération. C'est une précaution, au cas où l'ordinateur tomberait en panne. Je te conseille donc de l'installer, ça ne coûte rien, et ça pourrait potentiellement servir !
Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse. 


Le rapport se trouve ici : %SystemDrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

Aide :Comment utiliser ComboFix. 

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

lilou · Answer

quel crack?

V-X · Answer

Re,

Quel crack?

Gné...

C:\Users\henri\Favorites\informatique\CRACK.MS - All CRACKs and SERIALs on ONE Site.url 

C'est venue comme sa ce qui est ci-dessous :

Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA]
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]

lilou · Answer

ComboFix 09-05-11.01 - henri 11/05/2009 22:46.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6001.1.1252.33.1036.18.2814.1322 [GMT 2:00]
Lancé depuis: d:\dvix\a voir\pipi5217ipip5871.exe
AV: a-squared Anti-Malware *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\henri\AppData\Roaming\drivers\downld
c:\users\henri\AppData\Roaming\drivers\downld\1312233.exe
c:\users\henri\AppData\Roaming\drivers\downld\1316071.exe
c:\users\henri\AppData\Roaming\drivers\downld\1316086.exe
c:\users\henri\AppData\Roaming\drivers\downld\1331016.exe
c:\users\henri\AppData\Roaming\drivers\downld\1332357.exe
c:\users\henri\AppData\Roaming\drivers\downld\1332778.exe
c:\users\henri\AppData\Roaming\drivers\downld\1340922.exe
c:\users\henri\AppData\Roaming\drivers\downld\1341748.exe
c:\users\henri\AppData\Roaming\drivers\downld\1345181.exe
c:\users\henri\AppData\Roaming\drivers\downld\1359891.exe
c:\users\henri\AppData\Roaming\drivers\downld\1362668.exe
c:\users\henri\AppData\Roaming\drivers\downld\1363526.exe
c:\users\henri\AppData\Roaming\drivers\downld\1448672.exe
c:\users\henri\AppData\Roaming\drivers\downld\1449202.exe
c:\users\henri\AppData\Roaming\drivers\downld\1449483.exe
c:\users\henri\AppData\Roaming\drivers\downld\147140.exe
c:\users\henri\AppData\Roaming\drivers\downld\147514.exe
c:\users\henri\AppData\Roaming\drivers\downld\1484583.exe
c:\users\henri\AppData\Roaming\drivers\downld\1485675.exe
c:\users\henri\AppData\Roaming\drivers\downld\1486252.exe
c:\users\henri\AppData\Roaming\drivers\downld\1489591.exe
c:\users\henri\AppData\Roaming\drivers\downld\1490464.exe
c:\users\henri\AppData\Roaming\drivers\downld\1490480.exe
c:\users\henri\AppData\Roaming\drivers\downld\1493849.exe
c:\users\henri\AppData\Roaming\drivers\downld\1494988.exe
c:\users\henri\AppData\Roaming\drivers\downld\1495004.exe
c:\users\henri\AppData\Roaming\drivers\downld\1504130.exe
c:\users\henri\AppData\Roaming\drivers\downld\1506564.exe
c:\users\henri\AppData\Roaming\drivers\downld\1507281.exe
c:\users\henri\AppData\Roaming\drivers\downld\169183.exe
c:\users\henri\AppData\Roaming\drivers\downld\169198.exe
c:\users\henri\AppData\Roaming\drivers\downld\169229.exe
c:\users\henri\AppData\Roaming\drivers\downld\1692330.exe
c:\users\henri\AppData\Roaming\drivers\downld\169245.exe
c:\users\henri\AppData\Roaming\drivers\downld\1692610.exe
c:\users\henri\AppData\Roaming\drivers\downld\1803090.exe
c:\users\henri\AppData\Roaming\drivers\downld\1806023.exe
c:\users\henri\AppData\Roaming\drivers\downld\1806850.exe
c:\users\henri\AppData\Roaming\drivers\downld\1807536.exe
c:\users\henri\AppData\Roaming\drivers\downld\1808503.exe
c:\users\henri\AppData\Roaming\drivers\downld\1808550.exe
c:\users\henri\AppData\Roaming\drivers\downld\199946.exe
c:\users\henri\AppData\Roaming\drivers\downld\200320.exe
c:\users\henri\AppData\Roaming\drivers\downld\205812.exe
c:\users\henri\AppData\Roaming\drivers\downld\206248.exe
c:\users\henri\AppData\Roaming\drivers\downld\207543.exe
c:\users\henri\AppData\Roaming\drivers\downld\207871.exe
c:\users\henri\AppData\Roaming\drivers\downld\207886.exe
c:\users\henri\AppData\Roaming\drivers\downld\212005.exe
c:\users\henri\AppData\Roaming\drivers\downld\217168.exe
c:\users\henri\AppData\Roaming\drivers\downld\219384.exe
c:\users\henri\AppData\Roaming\drivers\downld\223206.exe
c:\users\henri\AppData\Roaming\drivers\downld\223533.exe
c:\users\henri\AppData\Roaming\drivers\downld\223549.exe
c:\users\henri\AppData\Roaming\drivers\downld\227449.exe
c:\users\henri\AppData\Roaming\drivers\downld\233439.exe
c:\users\henri\AppData\Roaming\drivers\downld\234984.exe
c:\users\henri\AppData\Roaming\drivers\downld\235967.exe
c:\users\henri\AppData\Roaming\drivers\downld\237870.exe
c:\users\henri\AppData\Roaming\drivers\downld\254656.exe
c:\users\henri\AppData\Roaming\drivers\downld\257152.exe
c:\users\henri\AppData\Roaming\drivers\downld\257401.exe
c:\users\henri\AppData\Roaming\drivers\downld\258696.exe
c:\users\henri\AppData\Roaming\drivers\downld\259133.exe
c:\users\henri\AppData\Roaming\drivers\downld\260100.exe
c:\users\henri\AppData\Roaming\drivers\downld\261598.exe
c:\users\henri\AppData\Roaming\drivers\downld\261629.exe
c:\users\henri\AppData\Roaming\drivers\downld\263454.exe
c:\users\henri\AppData\Roaming\drivers\downld\263828.exe
c:\users\henri\AppData\Roaming\drivers\downld\264328.exe
c:\users\henri\AppData\Roaming\drivers\downld\265076.exe
c:\users\henri\AppData\Roaming\drivers\downld\267526.exe
c:\users\henri\AppData\Roaming\drivers\downld\268493.exe
c:\users\henri\AppData\Roaming\drivers\downld\268961.exe
c:\users\henri\AppData\Roaming\drivers\downld\284202.exe
c:\users\henri\AppData\Roaming\drivers\downld\286527.exe
c:\users\henri\AppData\Roaming\drivers\downld\287338.exe
c:\users\henri\AppData\Roaming\drivers\downld\298773.exe
c:\users\henri\AppData\Roaming\drivers\downld\299662.exe
c:\users\henri\AppData\Roaming\drivers\downld\300130.exe
c:\users\henri\AppData\Roaming\drivers\downld\310660.exe
c:\users\henri\AppData\Roaming\drivers\downld\313047.exe
c:\users\henri\AppData\Roaming\drivers\downld\313967.exe
c:\users\henri\AppData\Roaming\drivers\downld\343545.exe
c:\users\henri\AppData\Roaming\drivers\downld\344653.exe
c:\users\henri\AppData\Roaming\drivers\downld\345635.exe
c:\users\henri\AppData\Roaming\drivers\downld\351298.exe
c:\users\henri\AppData\Roaming\drivers\downld\353903.exe
c:\users\henri\AppData\Roaming\drivers\downld\354434.exe
c:\users\henri\AppData\Roaming\drivers\downld\367943.exe
c:\users\henri\AppData\Roaming\drivers\downld\368271.exe
c:\users\henri\AppData\Roaming\drivers\downld\368567.exe
c:\users\henri\AppData\Roaming\drivers\downld\382764.exe
c:\users\henri\AppData\Roaming\drivers\downld\383856.exe
c:\users\henri\AppData\Roaming\drivers\downld\385634.exe
c:\users\henri\AppData\Roaming\drivers\downld\387568.exe
c:\users\henri\AppData\Roaming\drivers\downld\388879.exe
c:\users\henri\AppData\Roaming\drivers\downld\389440.exe
c:\users\henri\AppData\Roaming\drivers\downld\390376.exe
c:\users\henri\AppData\Roaming\drivers\downld\390798.exe
c:\users\henri\AppData\Roaming\drivers\downld\390813.exe
c:\users\henri\AppData\Roaming\drivers\downld\393481.exe
c:\users\henri\AppData\Roaming\drivers\downld\394120.exe
c:\users\henri\AppData\Roaming\drivers\downld\394136.exe
c:\users\henri\AppData\Roaming\drivers\downld\394152.exe
c:\users\henri\AppData\Roaming\drivers\downld\394183.exe
c:\users\henri\AppData\Roaming\drivers\downld\394198.exe
c:\users\henri\AppData\Roaming\drivers\downld\395509.exe
c:\users\henri\AppData\Roaming\drivers\downld\396320.exe
c:\users\henri\AppData\Roaming\drivers\downld\396757.exe
c:\users\henri\AppData\Roaming\drivers\downld\396772.exe
c:\users\henri\AppData\Roaming\drivers\downld\396788.exe
c:\users\henri\AppData\Roaming\drivers\downld\396913.exe
c:\users\henri\AppData\Roaming\drivers\downld\399690.exe
c:\users\henri\AppData\Roaming\drivers\downld\400345.exe
c:\users\henri\AppData\Roaming\drivers\downld\400360.exe
c:\users\henri\AppData\Roaming\drivers\downld\402560.exe
c:\users\henri\AppData\Roaming\drivers\downld\402716.exe
c:\users\henri\AppData\Roaming\drivers\downld\403886.exe
c:\users\henri\AppData\Roaming\drivers\downld\403902.exe
c:\users\henri\AppData\Roaming\drivers\downld\406694.exe
c:\users\henri\AppData\Roaming\drivers\downld\408129.exe
c:\users\henri\AppData\Roaming\drivers\downld\408597.exe
c:\users\henri\AppData\Roaming\drivers\downld\413465.exe
c:\users\henri\AppData\Roaming\drivers\downld\414245.exe
c:\users\henri\AppData\Roaming\drivers\downld\414635.exe
c:\users\henri\AppData\Roaming\drivers\downld\414791.exe
c:\users\henri\AppData\Roaming\drivers\downld\415087.exe
c:\users\henri\AppData\Roaming\drivers\downld\415883.exe
c:\users\henri\AppData\Roaming\drivers\downld\417911.exe
c:\users\henri\AppData\Roaming\drivers\downld\418847.exe
c:\users\henri\AppData\Roaming\drivers\downld\419299.exe
c:\users\henri\AppData\Roaming\drivers\downld\442512.exe
c:\users\henri\AppData\Roaming\drivers\downld\443417.exe
c:\users\henri\AppData\Roaming\drivers\downld\443947.exe
c:\users\henri\AppData\Roaming\drivers\downld\446646.exe
c:\users\henri\AppData\Roaming\drivers\downld\447270.exe
c:\users\henri\AppData\Roaming\drivers\downld\447286.exe
c:\users\henri\AppData\Roaming\drivers\downld\449626.exe
c:\users\henri\AppData\Roaming\drivers\downld\450608.exe
c:\users\henri\AppData\Roaming\drivers\downld\450624.exe
c:\users\henri\AppData\Roaming\drivers\downld\455647.exe
c:\users\henri\AppData\Roaming\drivers\downld\458471.exe
c:\users\henri\AppData\Roaming\drivers\downld\459890.exe
c:\users\henri\AppData\Roaming\drivers\downld\460343.exe
c:\users\henri\AppData\Roaming\drivers\downld\578841.exe
c:\users\henri\AppData\Roaming\drivers\downld\579075.exe
c:\users\henri\AppData\Roaming\drivers\downld\579091.exe
c:\users\henri\AppData\Roaming\drivers\downld\603926.exe
c:\users\henri\AppData\Roaming\drivers\downld\605533.exe
c:\users\henri\AppData\Roaming\drivers\downld\605673.exe
c:\users\henri\AppData\Roaming\drivers\downld\634128.exe
c:\users\henri\AppData\Roaming\drivers\downld\634144.exe
c:\users\henri\AppData\Roaming\drivers\downld\634159.exe
c:\users\henri\AppData\Roaming\drivers\downld\662146.exe
c:\users\henri\AppData\Roaming\drivers\downld\662364.exe
c:\users\henri\AppData\Roaming\drivers\downld\662380.exe
c:\users\henri\AppData\Roaming\drivers\downld\663721.exe
c:\users\henri\AppData\Roaming\drivers\downld\664111.exe
c:\users\henri\AppData\Roaming\drivers\downld\664174.exe
c:\users\henri\AppData\Roaming\drivers\downld\664517.exe
c:\users\henri\AppData\Roaming\drivers\downld\665515.exe
c:\users\henri\AppData\Roaming\drivers\downld\718244.exe
c:\users\henri\AppData\Roaming\drivers\downld\719679.exe
c:\users\henri\AppData\Roaming\drivers\downld\720272.exe
c:\users\henri\AppData\Roaming\drivers\downld\720958.exe
c:\users\henri\AppData\Roaming\drivers\downld\722581.exe
c:\users\henri\AppData\Roaming\drivers\downld\722783.exe
c:\users\henri\AppData\Roaming\drivers\downld\745232.exe
c:\users\henri\AppData\Roaming\drivers\downld\745731.exe
c:\users\henri\AppData\Roaming\drivers\downld\746105.exe
c:\users\henri\AppData\Roaming\drivers\downld\746651.exe
c:\users\henri\AppData\Roaming\drivers\downld\746667.exe
c:\users\henri\AppData\Roaming\drivers\downld\746714.exe
c:\users\henri\AppData\Roaming\drivers\downld\754280.exe
c:\users\henri\AppData\Roaming\drivers\downld\754686.exe
c:\users\henri\AppData\Roaming\drivers\downld\754764.exe
c:\users\henri\AppData\Roaming\drivers\downld\755169.exe
c:\users\henri\AppData\Roaming\drivers\downld\755871.exe
c:\windows\system32\404Fix.exe
c:\windows\System32\Desktop_.ini
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\msql32sys.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Legacy_SK9OU0S
-------\Legacy_SROSA
-------\Service_Boonty Games


(((((((((((((((((((((((((((((   Fichiers créés du 2009-04-12 au 2009-05-12  ))))))))))))))))))))))))))))))))))))
.

2009-05-11 20:43 . 2009-05-11 20:44	--------	d-----w	C:\caca865a47c851
2009-05-11 19:58 . 2009-05-11 20:01	--------	d-----w	C:\ToolBar SD
2009-05-11 13:42 . 2009-05-11 13:42	--------	d-----w	C:\rsit
2009-05-11 12:01 . 2009-05-11 17:59	--------	d-----w	c:\program files\a-squared Anti-Malware
2009-05-10 23:22 . 2009-05-10 23:26	55640	----a-w	c:\windows\system32\drivers\avgntflt.sys
2009-05-10 23:22 . 2009-05-10 23:22	--------	d-----w	c:\progra~2\Avira
2009-05-10 23:22 . 2009-05-10 23:22	--------	d-----w	c:\users\All Users\Avira
2009-05-10 23:22 . 2009-05-10 23:22	--------	d-----w	c:\program files\Avira
2009-05-10 22:56 . 2009-05-11 06:56	--------	d-----w	C:\FindyKill
2009-05-10 22:32 . 2009-05-10 22:32	--------	d-----w	C:\fixwareout
2009-05-10 22:12 . 2009-05-10 22:13	--------	d-----w	c:\program files\FileRescue Pro
2009-05-10 21:45 . 2009-05-10 21:55	--------	d-----w	C:\Lop SD
2009-05-10 20:34 . 2009-05-10 22:55	--------	d-----w	c:\program files\FindyKill
2009-05-10 20:05 . 2009-05-11 07:22	--------	d-----w	c:\program files\Navilog1
2009-05-10 18:30 . 2009-05-11 21:04	--------	d--h--w	c:\users\henri\AppData\Roaming\drivers
2009-04-19 08:40 . 2009-04-19 08:40	--------	d-----w	c:\program files\The Bitmap Brothers
2009-04-15 15:18 . 2009-04-15 15:18	--------	d-----w	c:\program files\Panda Security
2009-04-15 13:02 . 2009-04-15 13:02	93	----a-w	c:\users\henri\AppData\Local\fusioncache.dat
2009-04-15 13:02 . 2009-04-15 13:08	--------	d-----w	c:\users\henri\AppData\Local\ApplicationHistory
2009-04-15 12:57 . 2009-04-15 12:57	--------	d-----w	c:\windows\system32\URTTEMP
2009-04-15 12:50 . 2009-04-15 12:50	--------	d-----w	C:\DESI-III
2009-04-15 12:49 . 2009-04-15 12:49	--------	d-----w	c:\users\henri\AppData\Local\Installer2792
2009-04-13 19:38 . 2009-05-10 22:46	--------	d-----w	C:\tmp
2009-04-13 18:45 . 2009-04-13 18:45	--------	d-----w	c:\users\henri\AppData\Roaming\Blender Foundation
2009-04-13 12:30 . 2009-05-11 13:26	--------	d-----w	c:\program files\a-squared Free
2009-04-13 10:40 . 2006-05-10 12:18	1929216	----a-w	c:\windows\system32\cdintf250.dll
2009-04-13 10:40 . 2009-04-13 10:40	--------	d-----w	c:\program files\EBP
2009-04-13 10:40 . 2009-04-13 10:40	--------	d-----w	C:\EBP
2009-04-13 10:29 . 2009-04-13 10:29	201	----a-w	c:\windows\runconfmig.bat
2009-04-13 10:29 . 2009-04-13 10:29	--------	d-----w	c:\program files\Common Files\Pervasive Software Shared
2009-04-13 10:29 . 2002-06-30 11:40	19456	----a-w	c:\windows\keyhh.exe
2009-04-13 10:28 . 2009-04-13 10:28	544816	----a-w	c:\windows\system32\pscl.dll
2009-04-13 10:28 . 2009-04-13 10:28	254002	----a-w	c:\windows\system32\pscore.dll
2009-04-13 10:28 . 2009-04-13 10:28	43760	----a-w	c:\windows\system32\nwlocale.dll
2009-04-13 10:28 . 2009-04-13 10:28	146976	----a-w	c:\windows\system32\mfcoleui.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-11 18:31 . 2008-05-28 13:33	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-05-11 11:26 . 2007-09-05 16:25	13025	----a-w	c:\users\henri\AppData\Roaming\nvModes.dat
2009-05-11 07:55 . 2006-12-10 19:02	736660	----a-w	c:\windows\system32\perfh00C.dat
2009-05-11 07:55 . 2006-12-10 19:02	151838	----a-w	c:\windows\system32\perfc00C.dat
2009-05-11 07:18 . 2008-01-21 15:26	--------	d-----w	c:\program files\Mozilla Firefox 3 Beta 2
2009-05-10 23:29 . 2008-09-23 12:03	--------	d-----w	c:\program files\DAEMON Tools Lite
2009-05-10 21:26 . 2008-11-05 18:34	35	----a-w	c:\users\henri\AppData\Roaming\SetValue.bat
2009-05-10 21:26 . 2008-11-05 18:34	691	----a-w	c:\users\henri\AppData\Roaming\GetValue.vbs
2009-05-10 20:16 . 2008-11-05 18:03	--------	d-----w	c:\program files\Trend Micro
2009-05-07 09:04 . 2006-12-02 07:31	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-04-16 01:12 . 2006-11-02 11:18	--------	d-----w	c:\program files\Windows Mail
2009-04-15 13:02 . 2007-09-05 16:03	150968	----a-w	c:\users\henri\AppData\Local\GDIPFONTCACHEV1.DAT
2009-04-15 12:47 . 2006-12-10 10:09	--------	d-----w	c:\program files\Common Files\Adobe
2009-04-11 14:02 . 2009-04-11 14:02	--------	d-----w	c:\program files\Spamihilator
2009-04-06 13:32 . 2008-09-15 19:09	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2008-05-28 13:33	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-04-03 14:14 . 2009-04-03 14:13	--------	d-----w	c:\program files\Safari
2009-04-03 14:13 . 2009-04-03 14:13	--------	d-----w	c:\program files\Apple Software Update
2009-04-03 09:13 . 2006-11-02 10:25	51200	----a-w	c:\windows\inf\infpub.dat
2009-04-03 09:13 . 2006-11-02 10:25	143360	----a-w	c:\windows\inf\infstrng.dat
2009-04-03 09:13 . 2006-11-02 10:25	86016	----a-w	c:\windows\inf\infstor.dat
2009-04-01 17:36 . 2009-04-01 17:36	--------	d-----w	c:\program files\DIFX
2009-04-01 17:33 . 2008-09-10 19:27	--------	d-----w	c:\program files\ma-config.com
2009-04-01 17:33 . 2008-09-10 19:27	--------	d-----w	c:\progra~2\ma-config.com
2009-03-29 16:18 . 2008-11-21 10:22	--------	d-----w	c:\program files\Common Files\Ahead
2009-03-29 14:40 . 2009-03-01 16:04	--------	d-----w	c:\program files\Téléchargeur de Sonic Adventure DX
2009-03-29 14:32 . 2006-12-10 10:17	--------	d-----w	c:\program files\Common Files\LightScribe
2009-03-26 08:01 . 2009-03-24 13:41	--------	d-----w	c:\program files\Microsoft Visual Studio 8
2009-03-24 21:36 . 2009-01-02 15:28	--------	d-----w	c:\program files\Error Repair Professional
2009-03-24 21:30 . 2007-09-05 21:41	--------	d-----w	c:\program files\Google
2009-03-24 21:27 . 2009-03-03 15:39	--------	d-----w	c:\program files\Motherboard Monitor 5
2009-03-24 21:25 . 2006-12-10 10:14	--------	d-----w	c:\program files\CyberLink
2009-03-24 18:39 . 2009-03-24 18:36	32768	----a-w	c:\windows\system32\DesignerUninst.exe
2009-03-24 13:49 . 2009-03-24 13:49	--------	d-----w	c:\program files\Microsoft Works
2009-03-24 13:49 . 2006-11-02 12:37	--------	d-----w	c:\program files\MSBuild
2009-03-24 13:47 . 2008-12-04 18:33	--------	d-----w	c:\program files\Microsoft.NET
2009-03-23 21:52 . 2008-08-19 22:54	--------	d-----w	c:\program files\TuneUp Utilities 2008
2009-03-23 21:52 . 2009-03-23 21:52	354560	----a-w	c:\windows\system32\TuneUpDefragService.exe
2009-03-23 18:57 . 2009-03-23 18:57	--------	d-----w	c:\program files\MSN Messenger
2009-03-23 11:57 . 2009-03-23 11:57	--------	d-----w	c:\program files\Microsoft
2009-03-23 11:57 . 2009-03-23 11:57	--------	d-----w	c:\program files\Windows Live SkyDrive
2009-03-23 11:56 . 2008-01-03 15:08	--------	d-----w	c:\program files\Windows Live
2009-03-23 11:10 . 2009-03-23 11:10	--------	d-----w	c:\program files\Common Files\Windows Live
2009-03-22 20:07 . 2009-03-04 10:21	21840	----atw	c:\windows\system32\SIntfNT.dll
2009-03-22 20:07 . 2009-03-04 10:21	17212	----atw	c:\windows\system32\SIntf32.dll
2009-03-22 20:07 . 2009-03-04 10:21	12067	----atw	c:\windows\system32\SIntf16.dll
2009-03-17 03:38 . 2009-04-15 07:42	13824	----a-w	c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 07:42	24064	----a-w	c:\windows\system32\amxread.dll
2009-03-14 18:57 . 2007-12-03 23:34	--------	d-----w	c:\program files\IncrediMail
2009-03-08 11:34 . 2009-04-01 09:13	914944	----a-w	c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-04-01 09:13	43008	----a-w	c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-04-01 09:13	18944	----a-w	c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-04-01 09:13	109056	----a-w	c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-04-01 09:13	109568	----a-w	c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-04-01 09:13	132608	----a-w	c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-04-01 09:13	107520	----a-w	c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-04-01 09:13	107008	----a-w	c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-04-01 09:13	103936	----a-w	c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-04-01 09:13	420352	----a-w	c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-04-01 09:13	72704	----a-w	c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-04-01 09:13	71680	----a-w	c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-04-01 09:13	66560	----a-w	c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-04-01 09:13	169472	----a-w	c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-04-01 09:13	34816	----a-w	c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-04-01 09:13	48128	----a-w	c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-04-01 09:13	45568	----a-w	c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-04-01 09:13	156160	----a-w	c:\windows\system32\msls31.dll
2009-03-03 04:46 . 2009-04-15 07:42	3599328	----a-w	c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-15 07:42	3547632	----a-w	c:\windows\system32\ntoskrnl.exe
2009-03-03 04:39 . 2009-04-15 07:42	183296	----a-w	c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-15 07:42	551424	----a-w	c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-15 07:42	26112	----a-w	c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-15 07:42	98304	----a-w	c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-15 07:42	54784	----a-w	c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-15 07:42	44032	----a-w	c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-15 07:42	666624	----a-w	c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-15 07:42	17408	----a-w	c:\windows\system32\iashost.exe
2009-03-01 18:27 . 2009-03-01 18:27	44384	----a-w	c:\windows\system32\drivers\tifsfilt.sys
2009-03-01 18:27 . 2009-03-01 18:27	441760	----a-w	c:\windows\system32\drivers\timntr.sys
2009-03-01 18:27 . 2009-03-01 18:27	129248	----a-w	c:\windows\system32\drivers\snapman.sys
2009-03-01 18:26 . 2009-03-01 18:26	368736	----a-w	c:\windows\system32\drivers\tdrpman.sys
2009-02-15 21:48 . 2008-02-13 00:45	86016	----a-w	c:\windows\system32\OpenAL32.dll
2009-02-13 08:49 . 2009-04-15 07:42	72704	----a-w	c:\windows\system32\secur32.dll
2009-02-13 08:49 . 2009-04-15 07:42	1255936	----a-w	c:\windows\system32\lsasrv.dll
2008-05-17 08:05 . 2006-11-02 12:50	174	--sha-w	c:\program files\desktop.ini
2008-09-10 14:46 . 2008-06-18 14:42	72	--sh--w	c:\windows\SA0594035.tmp
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"AlcoholAutomount"="d:\utilitaire\Alcohol 120\axcmd.exe" [2009-03-17 203928]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Google Update"="c:\users\henri\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-04-06 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-20 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-20 7766016]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-10-07 2620336]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-10-07 904880]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2007-10-07 140568]
"Spamihilator"="c:\program files\Spamihilator\spamihilator.exe" [2008-12-23 1321984]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"NetFxUpdate_v1.1.4322"="c:\windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" [2007-01-15 73728]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2006-11-09 3784704]

c:\users\henri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Pervasive.SQL Workgroup Engine.lnk - c:\pvsw\Bin\w3dbsmgr.exe [2004-7-22 106546]

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
WiFi Station pour Livebox.lnk - c:\program files\Hercules\WiFi Station pour Livebox\WiFiLB.exe [2007-11-7 102400]

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\AutorunsDisabled
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2006-12-10 528384]

c:\users\henri\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\
Pervasive.SQL Workgroup Engine.lnk - c:\pvsw\Bin\w3dbsmgr.exe [2004-7-22 106546]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\WIDEST~1\FREEQU~1\QUICKA~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	"autocheck autochk *"\[u]0/uOODBS

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^DSLMON.lnk]
backup=c:\windows\pss\DSLMON.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Outil de mise à jour Google.lnk]
backup=c:\windows\pss\Outil de mise à jour Google.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SnagIt 8.lnk]
backup=c:\windows\pss\SnagIt 8.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^henri^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GigaTribe.lnk]
backup=c:\windows\pss\GigaTribe.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^henri^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Moteur WinSauvegarde.lnk]
backup=c:\windows\pss\Moteur WinSauvegarde.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^henri^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
backup=c:\windows\pss\OpenOffice.org 2.4.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^henri^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\users\henri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\au
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EoEngine
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrustPPAP
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\exp32sys
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ItsTV
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ehTray.exe"=c:\windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"SynTPEnh"=c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1754156993-695157337-552481621-1000]
"EnableNotificationsRef"=dword:00000007

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{081659FE-5F03-42E3-B488-636242C7D835}"= UDP:c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{2A8BAAA4-1E02-4C0A-BC8A-3882CFC56A0D}"= TCP:c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"TCP Query User{9F7ED434-5549-47A2-94EB-DCCE3AA2481E}d:\jeux\petanquedemo\bin\releasedemo\petanque.exe"= UDP:d:\jeux\petanquedemo\bin\releasedemo\petanque.exe:Petanque
"UDP Query User{4AB610E7-08D8-4DF4-82A6-5F45A60BB6EE}d:\jeux\petanquedemo\bin\releasedemo\petanque.exe"= TCP:d:\jeux\petanquedemo\bin\releasedemo\petanque.exe:Petanque
"TCP Query User{1B85A63B-D7ED-4DD7-B3FF-C581273198EE}d:\jeux\trackmania nations eswc\tmnationseswc.exe"= UDP:d:\jeux\trackmania nations eswc\tmnationseswc.exe:TmNationsESWC
"UDP Query User{5BD7C597-8408-4926-8F77-1520ACB69431}d:\jeux\trackmania nations eswc\tmnationseswc.exe"= TCP:d:\jeux\trackmania nations eswc\tmnationseswc.exe:TmNationsESWC
"{420A529D-26F0-4FA3-9402-62A6F4266AAE}"= UDP:c:\program files\Shareaza\Shareaza.exe:Shareaza
"{5C5BBB86-7639-49BC-8296-CD09E7567E02}"= TCP:c:\program files\Shareaza\Shareaza.exe:Shareaza
"{35333AA0-418F-49B8-A630-F2D1B0EE306B}"= UDP:d:\utilitaire\DEFRAGMENTEUR PUISSANT\UDefrag.exe:UltimateDefrag Lite
"{CBBDD1F7-35DD-41F4-AB97-C1D426DD3216}"= TCP:d:\utilitaire\DEFRAGMENTEUR PUISSANT\UDefrag.exe:UltimateDefrag Lite
"TCP Query User{1CC85DE6-CEE2-4475-9682-39916DEF32F3}c:\program files\emule\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule Plus
"UDP Query User{02175312-2328-43C6-876B-2D81BAF632F7}c:\program files\emule\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule Plus
"{2998AF1F-AD1C-4AA7-B2DC-2F25D76B1F7E}"= UDP:c:\program files\eMule\eMule.exe:eMule Plus
"{81F178C2-B4BF-4425-ADF6-76FFD8D53E0E}"= TCP:c:\program files\eMule\eMule.exe:eMule Plus
"{76E0B84A-D1C4-45DA-81D1-B787F8F38D12}"= UDP:c:\program files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{005EE143-17A9-4CAC-883A-ACC78B3E400B}"= UDP:56390:Pando P2P TCP Listening Port
"{72E412F1-ABD1-4631-8436-73C1B850076A}"= TCP:56390:Pando P2P UDP Listening Port
"TCP Query User{1B5CF3E8-9375-4047-9E3B-CF10C5FA2AC2}c:\program files\pando networks\pando\pando.exe"= UDP:c:\program files\pando networks\pando\pando.exe:pando
"UDP Query User{8F39B2D7-B1E2-43C6-BF9A-32BE2CE84C4F}c:\program files\pando networks\pando\pando.exe"= TCP:c:\program files\pando networks\pando\pando.exe:pando
"{4500800B-1F61-4463-BB0C-7A3C27AAAE83}"= UDP:d:\utilitaire\GigaTribe\gigatribe.exe:GigaTribe
"{34AB010E-87CD-4F74-8731-AD8FFBAEBECA}"= TCP:d:\utilitaire\GigaTribe\gigatribe.exe:GigaTribe
"TCP Query User{4CF7F9CD-AFE3-427C-A7F3-C28D415E66ED}d:\jeux\x-plane 8.64\x-plane 864.exe"= Disabled:UDP:d:\jeux\x-plane 8.64\x-plane 864.exe:X-Plane 864
"UDP Query User{F3399E03-F1FB-4ADF-9E21-3EAC4DBA68E1}d:\jeux\x-plane 8.64\x-plane 864.exe"= Disabled:TCP:d:\jeux\x-plane 8.64\x-plane 864.exe:X-Plane 864
"TCP Query User{3BED2BA9-947D-4725-A4D0-AE9A98CE055A}d:\utilitaire\telechargement peer to peers\ares\ares.exe"= UDP:d:\utilitaire\telechargement peer to peers\ares\ares.exe:Ares p2p for windows
"UDP Query User{8015BB2A-7538-46ED-83FD-04A3608DE0D0}d:\utilitaire\telechargement peer to peers\ares\ares.exe"= TCP:d:\utilitaire\telechargement peer to peers\ares\ares.exe:Ares p2p for windows
"{61F10847-37CD-4A58-91BB-2CB9063244A2}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{070E6C79-A26C-4BEE-A9F1-86778DBC745E}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{57B0030D-2DCC-43BD-B913-AE4A895827D0}d:\jeux\flightgear\bin\win32\fgfs.exe"= UDP:d:\jeux\flightgear\bin\win32\fgfs.exe:fgfs
"UDP Query User{62E21F5A-A2CD-4647-A73D-72B5BD41946F}d:\jeux\flightgear\bin\win32\fgfs.exe"= TCP:d:\jeux\flightgear\bin\win32\fgfs.exe:fgfs
"TCP Query User{0B90AE32-4F86-4454-BBEA-3AD6776EB863}c:\program files\common files\ahead\nero web\setupx.exe"= UDP:c:\program files\common files\ahead\nero web\setupx.exe:MSI starter
"UDP Query User{32C4647C-2CE1-49A5-BC68-469F219FECE5}c:\program files\common files\ahead\nero web\setupx.exe"= TCP:c:\program files\common files\ahead\nero web\setupx.exe:MSI starter
"TCP Query User{260F391E-0476-4F4E-9DC0-94C2A72C718A}d:\utilitaire\aida32 - enterprise system information\aida32.bin"= UDP:d:\utilitaire\aida32 - enterprise system information\aida32.bin:AIDA32 - Worldwide SysInfo Tool
"UDP Query User{E0A03289-3EFB-4B72-8B3D-9BEA843A4CEC}d:\utilitaire\aida32 - enterprise system information\aida32.bin"= TCP:d:\utilitaire\aida32 - enterprise system information\aida32.bin:AIDA32 - Worldwide SysInfo Tool
"TCP Query User{BB4D6DC1-09D5-408B-9667-9284FE2E3EED}c:\program files\windows sidebar\sidebar.exe"= UDP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"UDP Query User{7D56974D-E112-490D-8636-1EAE2B32A6D4}c:\program files\windows sidebar\sidebar.exe"= TCP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"TCP Query User{378443D9-05CD-4080-AB94-A2BA0938C105}c:\program files\iepro\minidm.exe"= UDP:c:\program files\iepro\minidm.exe:MiniDM
"UDP Query User{5BA2CF1A-049D-4882-B705-8C25BD6A158C}c:\program files\iepro\minidm.exe"= TCP:c:\program files\iepro\minidm.exe:MiniDM
"TCP Query User{BEDC6B78-DDBA-46A4-B250-0A025C0C6759}d:\utilitaire\izispot\izispot.exe"= UDP:d:\utilitaire\izispot\izispot.exe:IziSpot
"UDP Query User{8700A5CB-0315-45A9-B1B4-D83D50A12C55}d:\utilitaire\izispot\izispot.exe"= TCP:d:\utilitaire\izispot\izispot.exe:IziSpot
"TCP Query User{5BAD5CF7-C94E-4FDA-A871-4AD59F43959F}c:\program files\secondlife\slvoice.exe"= UDP:c:\program files\secondlife\slvoice.exe:SLVoice
"UDP Query User{CAF42D3C-CE34-402D-A02A-E5DC877C97E1}c:\program files\secondlife\slvoice.exe"= TCP:c:\program files\secondlife\slvoice.exe:SLVoice
"TCP Query User{4DC20D1D-685D-415D-9917-2B518B0855BF}d:\utilitaire\emule\emule.exe"= UDP:d:\utilitaire\emule\emule.exe:eMule
"UDP Query User{983723EC-916D-4754-91F7-5677ADB044CC}d:\utilitaire\emule\emule.exe"= TCP:d:\utilitaire\emule\emule.exe:eMule
"{EF94F3A9-B56F-4443-8F76-020AA2BB3763}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{640EC807-DED8-4D00-A9C8-DE9C682BE51A}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"TCP Query User{51961A99-3997-4173-AC09-18E3935025FB}d:\jeux\worms\worms 4 mayhem online demo.exe"= UDP:d:\jeux\worms\worms 4 mayhem online demo.exe:Worms 4 Mayhem
"UDP Query User{46D7A13C-B2CF-4131-8E29-3EB149BE8C9A}d:\jeux\worms\worms 4 mayhem online demo.exe"= TCP:d:\jeux\worms\worms 4 mayhem online demo.exe:Worms 4 Mayhem
"TCP Query User{898FA178-CBA4-4213-B3B2-1C06DDF310EF}c:\program files\foxtarot4\foxtarot.exe"= UDP:c:\program files\foxtarot4\foxtarot.exe:JEU DE TAROT
"UDP Query User{9FF49E43-2D68-46A3-8F2B-086F7071BFE9}c:\program files\foxtarot4\foxtarot.exe"= TCP:c:\program files\foxtarot4\foxtarot.exe:JEU DE TAROT
"{191EF9BA-73FD-4976-8392-E7E7D8920D1D}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{AD6C26BD-4532-4C1F-AE3F-EA2A25898C17}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{778DF7F6-5FE4-4BE5-A8B0-E05B0BA3251D}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{A3B4DB02-D53C-4798-BBD7-678E5C2AC6D6}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"TCP Query User{7D96B69D-293A-41BF-9D63-64DE1A12D3A3}d:\jeux\tmnationsforever\tmforever.exe"= UDP:d:\jeux\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{6E093925-0C0F-4F5A-95EC-7BEB808646E6}d:\jeux\tmnationsforever\tmforever.exe"= TCP:d:\jeux\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{B1BAFC55-24EC-4C5A-88D6-197C66466BB6}c:\program files\echanblard\emule.exe"= UDP:c:\program files\echanblard\emule.exe:eChanblard
"UDP Query User{9DAD1F0E-E220-4B8F-A826-0DB6DC696C38}c:\program files\echanblard\emule.exe"= TCP:c:\program files\echanblard\emule.exe:eChanblard
"TCP Query User{D9813E72-A67A-440B-A82B-31CFC2764662}c:\program files\echanblard\emule.exe"= UDP:c:\program files\echanblard\emule.exe:eChanblard
"UDP Query User{1278CF72-7DFF-4852-BE9A-70463A11C02D}c:\program files\echanblard\emule.exe"= TCP:c:\program files\echanblard\emule.exe:eChanblard
"TCP Query User{AFE86CA7-924D-4E89-8ED0-37D13BA860E7}d:\jeux\aquadelic gt\run.exe"= UDP:d:\jeux\aquadelic gt\run.exe:Aquadelic GT game
"UDP Query User{3A8866ED-93D3-4A37-98B2-919A21B22C73}d:\jeux\aquadelic gt\run.exe"= TCP:d:\jeux\aquadelic gt\run.exe:Aquadelic GT game
"TCP Query User{A9B8BEC8-3AC3-46F2-A2CB-3635868326BB}c:\users\henri\appdata\local\emule\emule.exe"= UDP:c:\users\henri\appdata\local\emule\emule.exe:emule.exe
"UDP Query User{63111BC0-99A7-44AB-B8DF-01D4B9968FF8}c:\users\henri\appdata\local\emule\emule.exe"= TCP:c:\users\henri\appdata\local\emule\emule.exe:emule.exe
"TCP Query User{B47A071B-F523-4672-B258-FD071F46F20A}h:\gtl\gtl.exe"= UDP:h:\gtl\gtl.exe:GT Legends
"UDP Query User{258BAE91-2BC4-4DFA-9610-597609CB41D0}h:\gtl\gtl.exe"= TCP:h:\gtl\gtl.exe:GT Legends
"{427DC75E-E4AF-4428-8E65-C82E782D76CB}"= c:\program files\HP\Digital Imaging\bin\hpqpse.exe:hpqpse.exe
"{F6E146A2-FBC2-40C7-8124-54925E6EF5C8}"= c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe:hpqphotocrm.exe
"{EDB0FFC9-A7B2-4C0D-80E7-D79695F6FA7A}"= c:\program files\HP\Digital Imaging\bin\hpqsudi.exe:hpqsudi.exe
"{1F6490C7-ED2C-4173-B77C-028126D70440}"= c:\program files\HP\Digital Imaging\bin\hpqpsapp.exe:hpqpsapp.exe
"TCP Query User{E6630856-3CE7-4057-8CA0-4BF987D9513E}c:\program files\java\jre1.6.0_07\bin\javaw.exe"= UDP:c:\program files\java\jre1.6.0_07\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{9669BABA-303B-4E26-A00C-7ECE9DF7E0AB}c:\program files\java\jre1.6.0_07\bin\javaw.exe"= TCP:c:\program files\java\jre1.6.0_07\bin\javaw.exe:Java(TM) Platform SE binary
"{12EC6FF8-0AFD-43F1-A1E1-6FBD0C819F15}"= UDP:c:\pvsw\Bin\w3dbsmgr.exe:Database Service Manager
"{4209A43E-D4E3-4DAA-B099-A5C937AF6EB5}"= TCP:c:\pvsw\Bin\w3dbsmgr.exe:Database Service Manager
"{ECC7DB0A-59A0-4447-A03C-1CA85031E567}"= UDP:c:\pvsw\Bin\w3dbsmgr.exe:Database Service Manager
"{FB43423C-6BD1-4C7D-A934-22D9B41A49A1}"= TCP:c:\pvsw\Bin\w3dbsmgr.exe:Database Service Manager
"{4430D02C-9B45-4D6E-9EF8-E38FF83A60E7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3EA6E84A-BB75-42CA-A53A-E8FFF1FD3C02}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{F08EB402-BC07-475D-AE71-59C5C3BFCBD7}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{8492B468-B174-44CE-B925-D03E7D84A184}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{7B590E8C-CEE9-4776-AB34-293956E22B6E}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{CDA0F618-08C0-4513-B421-42E0938D2C32}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{86B95658-206E-472D-9F28-CA38E9362B5C}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"TCP Query User{746DF77F-8900-4C64-BAB9-D046D4CA9FD5}d:\utilitaire\shareaza\shareaza.exe"= UDP:d:\utilitaire\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
"UDP Query User{0C934E9A-5B86-4F78-9FA3-F1705A7AEAF7}d:\utilitaire\shareaza\shareaza.exe"= TCP:d:\utilitaire\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
"{2B4E082F-56B3-4087-B1CF-AA23C92816B3}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{1EA72BFE-83DD-482E-BAED-813DF96EBDC7}"= TCP:6004|d:\utilitaire\WORD\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{78B040A7-5F07-4FFD-B736-8257C90ABBFD}i:\jeux loulou\racer\racer070\racer.exe"= UDP:i:\jeux loulou\racer\racer070\racer.exe:racer
"UDP Query User{D74EAA9B-DE96-4D09-ADFB-F6C403466B56}i:\jeux loulou\racer\racer070\racer.exe"= TCP:i:\jeux loulou\racer\racer070\racer.exe:racer
"{E528D0F2-36AE-4517-9316-3F0307D9B95F}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{C838080A-886E-490E-AC60-83D9B95F82EA}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{ECBC4CA1-2902-4A8B-8E16-4DE6A5ADF3B7}"= UDP:c:\program files\Spamihilator\cdcc.exe:Spamihilator DCC Filter Configuration
"{3D0064B1-F623-444F-9E42-FDF23E1455AC}"= TCP:c:\program files\Spamihilator\cdcc.exe:Spamihilator DCC Filter Configuration
"{E118666B-9316-4858-973B-9FBAD2291A81}"= UDP:c:\program files\Spamihilator\dccproc.exe:Spamihilator DCC Filter
"{2804B16F-F9C2-4DBA-845A-3515916E2A8E}"= TCP:c:\program files\Spamihilator\dccproc.exe:Spamihilator DCC Filter
"{7DD1EE1A-78FE-43C3-A25A-BA6A99C9225B}"= UDP:c:\program files\Spamihilator\spamihilator.exe:Spamihilator
"{DB5AC62D-9626-4B9B-B7B2-A396983DB663}"= TCP:c:\program files\Spamihilator\spamihilator.exe:Spamihilator
"TCP Query User{1AEA6EA0-5595-4BFE-BFE5-449E43C28B52}c:\program files\spamihilator\dccproc.exe"= UDP:c:\program files\spamihilator\dccproc.exe:dccproc
"UDP Query User{0C793B68-6C0B-41E7-9A56-308859D669CD}c:\program files\spamihilator\dccproc.exe"= TCP:c:\program files\spamihilator\dccproc.exe:dccproc
"TCP Query User{32B33E33-2A51-4313-809B-A2D1389E49B3}c:\pvsw\bin\w3dbsmgr.exe"= UDP:c:\pvsw\bin\w3dbsmgr.exe:Database Service Manager
"UDP Query User{77C6C854-8020-4324-8977-66759D543F94}c:\pvsw\bin\w3dbsmgr.exe"= TCP:c:\pvsw\bin\w3dbsmgr.exe:Database Service Manager

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe"= c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS
"c:\Program Files\IEPro\MiniDM.exe"= c:\program files\IEPro\MiniDM.exe:*:Enabled:MiniDM

R0 PzWDM;PzWDM;c:\windows\System32\drivers\PzWDM.sys [04/06/2008 14:31 15172]
R1 ElRawDisk;ElRawDisk;c:\windows\System32\drivers\elrawdsk.sys [18/08/2008 01:24 12800]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/05/2009 01:22 108289]
R2 MSSQL$EBP;SQL Server (EBP);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [24/11/2008 23:31 29263712]
S2 Apache2.2;Apache2.2;"d:\xampplite\xampplite\apache\bin\apache.exe" -k runservice --> d:\xampplite\xampplite\apache\bin\apache.exe [?]
S2 ELOADER;General Purpose USB Driver (adildr.sys);c:\windows\System32\drivers\adildr.sys [05/09/2007 20:54 56088]
S3 Ipbuoi;Ipbuoi; [x]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [15/03/2009 09:34 216232]
S3 magpsc;magpsc;c:\windows\System32\drivers\magpsc.sys [03/04/2009 11:12 53719]
S3 netr73;Hercules Wireless USB Dongle Driver for Vista;c:\windows\System32\drivers\netr73.sys [07/11/2007 18:21 256000]
S3 papycpu;papycpu;c:\windows\System32\drivers\papycpu.sys [22/09/2007 15:34 1984]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [07/11/2007 17:52 28224]
S3 WSVD;WSVD;c:\windows\System32\drivers\WSVD.sys [20/09/2008 18:50 80744]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - sptd

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10e1844f-f520-11dd-a758-0016d3547c20}]
\shell\AutoRun\command - G:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f647f947-8966-11dd-93ef-0016d3547c20}]
\shell\AutoRun\command - F:\MLLaunch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe
HKCU-Run-german.exe - c:\windows\system32\wintems.exe


.
------- Examen supplémentaire -------
.
mWindow Title = 
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.76\AMVConverter\grab.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Crawler Search - tbr:iemenu
IE: E&xport to Microsoft Excel - d:\utilit~2\WORD\Office10\EXCEL.EXE/3000
IE: E&xporter vers Microsoft Excel - d:\utilit~2\WORD\Office12\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 3.76\MediaManager\grab.html
Trusted Zone: localhost
TCP: {ED5973AF-F337-492D-9BDD-9273F4F194FE} = 80.10.246.2,80.10.246.129
Handler: skyline - {3a4f9195-65a8-11d5-85c1-0001023952c1} - c:\program files\Skyline\TerraExplorer\TerraExplorerX.dll
DPF: {13149882-F480-4F6B-8C6A-0764F75B99ED} - hxxp://plug-in.reallusion.com/CrazyTalk4.cab
FF - ProfilePath - c:\users\henri\AppData\Roaming\Mozilla\Firefox\Profiles\hjs756fj.default\
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 2\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox 3 Beta 2\plugins\npSton3D.dll
FF - plugin: c:\users\henri\AppData\Local\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\users\henri\AppData\Roaming\Mozilla\Firefox\Profiles\hjs756fj.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\users\henri\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-12 08:48
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 


c:\users\henri\AppData\Local\Temp\STS7E2E.tmp 79 bytes


**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.dib"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.emf"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.fpx"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-1754156993-695157337-552481621-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Gif"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.icl"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.ico"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.jfif"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-1754156993-695157337-552481621-1000)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-1754156993-695157337-552481621-1000)
@Denied: (2) (LocalSystem)
"Progid"="Google.PhotoViewer.3.0"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-1754156993-695157337-552481621-1000)
@Denied: (2) (LocalSystem)
"Progid"="PhotoViewer.FileAssoc.Png"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.rle"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.tga"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.thm"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.ttc"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.ttf"

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 10.0.wmf"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(1232)
c:\windows\system32\relog_ap.dll

- - - - - - - > 'Explorer.exe'(1936)
c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
c:\program files\Acer Arcade Deluxe\VideoMagician\Kernel\EditMovie\MDTLM2Splter.ax
c:\program files\Acer Arcade Deluxe\VideoMagician\Kernel\EditMovie\MDTLM1Splter.ax
c:\windows\system32\DivXAF.ax
c:\program files\CyberLink\PowerDVD\NavFilter\CLDemuxer.ax
d:\utilitaire\VOSPHOTOALATELE\mcspmpeg.ax
d:\utilitaire\VOSPHOTOALATELE\mcmpegin.dll
c:\program files\K-Lite Codec Pack\Filters\avisplitter.ax
c:\program files\K-Lite Codec Pack\Filters\MP4Splitter.ax
c:\program files\K-Lite Codec Pack\Filters\WavPackDSSplitter.ax
c:\program files\Super DVD Creator 9.20\RMSP.DLL
d:\utilitaire\VOSPHOTOALATELE\HDX4FlashDemuxer.ax
d:\utilitaire\VOSPHOTOALATELE\mcdsmpeg.ax
d:\utilitaire\VOSPHOTOALATELE\mcmpgadec.dll
d:\utilitaire\VOSPHOTOALATELE\mcmpgvdec.dll
c:\program files\CyberLink\PowerDVD\NavFilter\clm4splt.ax
c:\program files\K-Lite Codec Pack\Filters\MpegSplitter.ax
c:\program files\Acer Arcade Deluxe\VideoMagician\Kernel\Movie\CLDemuxer.ax
c:\windows\system32\aac_parser.ax
d:\utilitaire\VOSPHOTOALATELE\HDX4AACParser.ax
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\a-squared Anti-Malware\a2service.exe
c:\program files\a-squared Free\a2service.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\System32\drivers\CDANTSRV.EXE
c:\windows\System32\Crypserv.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\program files\Common Files\microsoft shared\VS7Debug\mdm.exe
c:\acer\Mobility Center\MobilityService.exe
c:\windows\System32\oodag.exe
d:\utilitaire\photodexgold\scsiaccess.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
d:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
c:\windows\System32\drivers\XAudio.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\acer\Empowering Technology\ePower\ePowerSvc.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\users\henri\AppData\Local\Temp\RtkBtMnt.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Mozilla Firefox 3 Beta 2\firefox.exe
.
**************************************************************************
.
Heure de fin: 2009-05-12  8:57 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-05-12 06:56

Avant-CF: 11 261 714 432 octets libres
Après-CF: 13 293 916 160 octets libres

736	--- E O F ---	2009-05-11 10:23

gen-hackman · Answer

fiouuu !!!

lilou · Answer

qui y a t il??

V-X · Answer

Re,

&#x25B6 Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

&#x25B6 Mets le à jour

&#x25B6 Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.

&#x25B6 Sélectionne Exécuter un examen COMPLET si ce n'est pas déjà fait

&#x25B6 clique sur Rechercher

&#x25B6 Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

&#x25B6 Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

&#x25B6 Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

&#x25B6 Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Tutoriel pour MalwareByte's

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

lilou · Answer

mais je l'ai deja fait cette manip la non ???

V-X · Answer

Re,

Ben refait la , et met à jour malwarebyte.

Utilisateur anonyme · Answer

Salut , juste pour info ......

Vista = executer en tant qu administrateur ..

Avant MBAM y a ...


HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EoEngine 
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ItsTV 
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings 

Bon courage pour tes etudes Lilou .

V-X · Answer

Re,

Oui je le sais , mais merci de me le rappeler.

Utilisateur anonyme · Answer

re ,

Mais de rien ;)

Bonne suite .

V-X · Answer

Re,

J'ai passer toolbard S&D pour Search and setting aussi...Mais comme A-R le fait maintenant..... ;)

Au fait il ta vue pour seven et ad remover cyril ?

Utilisateur anonyme · Answer

Au fait il ta vue pour seven et ad remover cyril ?

c est a dire ?

V-X · Answer

Re,

ben en fait lui et demander , si A-R etait colmptatible avec SEVEN et j'ai proposer de faire les test et en fait A-R , bloque , même avec l'UAC désactiver et clic droit .

Donc , je pensais qu'il t'avait demander des infos la dessus.Mais a prioiri non.

Utilisateur anonyme · Answer

non , on en a pas parlé mais oui l uac seven va pauser des soucis à AD , mais rien de grave .

Bonne suite .

V-X · Answer

Re,

OK, si tu l'as tantôt , dit lui que j'attend sont feu vert pour débuter.

Et toi pour USBFIX tu as pas de souci ?

V-X · Answer

Re,

Vas y fait pêter usbfix.

Utilisateur anonyme · Answer

je te prepare ça ... 5 min .

gen-hackman · Answer

salut tous 

V-X t'as vu y'a la version 7100 de seven qui est sorite en test ?

V-X · Answer

Re,

Ben j'ai celle là en french et oui pas en english comprend poas.....un mot.

Utilisateur anonyme · Answer

Bon test

V-X · Answer

Re,

Option 1 Rapport R.A.S

++

gen-hackman · Answer

tiens...légère :)

lilou · Answer

je fais quoi la alors je pige pas grand chose ???

Utilisateur anonyme · Answer

Salut Lilou ,

on va continuer ensemble ;)


Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 

- Vas dans "Démarrer" puis Panneau de configuration. 
- Double Clique sur l'icône Comptes d'utilisateurs et sur Activer ou désactiver le contrôle des comptes d'utilisateurs. 
- Clique sur Continuer. 
- Décoche la case Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur. 
- Valide par OK et redémarre. 

Tuto : https://forum.malekal.com/viewtopic.php?f=59&t=6517

Télécharge Ad-remover ( de C_XX ) sur ton bureau : 

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

! Déconnecte toi et ferme toutes applications en cours ! 

* Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut . 

* Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
 
* Au menu principal choisis l'option "A" et tape sur [entrée] . 

Laisse travailler l'outil et ne touche à rien ... 

--> Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log ) 
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 

Tuto : http://pagesperso-orange.fr/NosTools/ad_remover.html

lilou · Answer

ok merci je fais ça de suite

lilou · Answer

------- LOGFILE OF AD-REMOVER 1.1.3.7 | ONLY XP/VISTA -------

Updated by C_XX on 11/05/2009 at 16:00
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html

Start at: 12:51:09, 13/05/2009 | Boot mode: Normal Boot
Option: Scan | Executed from: C:\Program Files\Ad-remover\
Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
Computer Name: PC-DE-HENRI
Current User: henri - Administrator
Drive(s): 
- C:\  (File System: NTFS)
- D:\  (File System: NTFS)
- H:\  (File System: NTFS)
- I:\  (File System: FAT32)


============ Known Adwares Found ============

.
.
C:\Users\henri\Appdata\LocalLow\Dealio
C:\Users\henri\AppData\Roaming\Microsoft\Windows\Cookies\henri@bs.serving-sys[2].txt

+-----------------| Eorezo Elements Found:

HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCU\Software\EoRezo
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\Software\Classes\EoRezoBHO.EoBho
HKLM\Software\Classes\EoRezoBHO.EoBho.1
.
C:\Users\henri\AppData\Roaming\EoRezo
C:\ProgramData\Microsoft\Windows\Startm~1\Programs\EoRezo

+-----------------| It's TV Elements Found:

HKCU\Software\ItsLabel
HKLM\Software\ItsLabel
HKU\S-1-5-21-1754156993-695157337-552481621-1000\Software\ItsLabel
.
C:\Users\henri\AppData\Roaming\ItsLabel
C:\ProgramData\Microsoft\Windows\Startm~1\Programs\ItsLabel

+-----------------| Sweetim Elements Found:

.

+-----------------| Added Scan:

---- Mozilla FireFox Version 3.0.10 ----

ProfilePath: hjs756fj.default (henri)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "MyStart Rechercher");
(Prefs.js) user_pref("browser.startup.homepage", "chrome://speeddial/content");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.10");
.

---- Internet Explorer Version 8.0.6001.18702 ----

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\..\Internet Explorer\Main]

Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
SearchAssistant: hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

=========== Suspicious ==========


+---------------------------------------------------------------------------+

3193 Byte(s) - C:\Ad-Report-Scan-13.05.2009.log

0 File(s) - C:\Program Files\Ad-remover\BACKUP
0 File(s) - C:\Program Files\Ad-remover\QUARANTINE

End at: 13:12:01 | 13/05/2009
.
+-----------------| E.O.F
.

Utilisateur anonyme · Answer

! Déconnecte toi et ferme toutes les applications en cours ( navigateur compris ) . 

* Relance "Ad-remover" : au menu principal choisis l'option "B" . 

* A l'écran de sélection ( http://sd-1.archive-host.com/membres/up/16506160323759868/Capturer-ADR.JPG ): 

> choisis le(s) chiffre(s) suivant(s) pour nettoyer les traces de: 

1 - "Adwares Connus" puis [Entrée]
2 - "Eorezo" puis [Entrée] 
3 - "it's TV" puis [Entrée] 


Une fois la sélection faite, tape S puis [entrée] pour lancer la suppression . 
--> le programme va travailler, ne touche à rien ... 
* Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\Ad-report.log ) 

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide 

Aides en images ( Nettoyage ) : http://pagesperso-orange.fr/FindyKill.Ad.Remover/ad_r_nettoyage.html

lilou · Answer

j ai fait ma manip mais quand je fait "S" le programme ne travail pas
que dois je faire?

lilou · Answer

y a quelqun ?

gen-hackman · Answer

desactive ton antivirus pour l utiliser

lilou · Answer

voila :



------- LOGFILE OF AD-REMOVER 1.1.3.7 | ONLY XP/VISTA -------

Updated by C_XX on 11/05/2009 at 16:00
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html

**** LIMITED TO ****

Known Adwares
Eorezo
It's TV

********************

Start at: 10:22:22, 15/05/2009 | Boot mode: Normal Boot
Option: Clean | Executed from: C:\Program Files\Ad-remover\
Operating System: Microsoft® Windows Vista™ Home Premium Service Pack 1 (version 6.0.6001)
Computer Name: PC-DE-HENRI
Current User: henri - Administrator
Drive(s): 
- C:\  (File System: NTFS)
- D:\  (File System: NTFS)
- H:\  (File System: NTFS)
- I:\  (File System: FAT32)


(!) ---- IE start pages/Tabs reset

============ Known Adwares Deleted ============

.
.
C:\Users\henri\Appdata\LocalLow\Dealio
C:\Users\henri\AppData\Roaming\Microsoft\Windows\Cookies\henri@bs.serving-sys[2].txt

+-----------------| Eorezo Elements Deleted :

/!\ NOT DELETED - HKCR\EoRezoBHO.EoBho
/!\ NOT DELETED - HKCR\EoRezoBHO.EoBho.1
HKCU\Software\EoRezo
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
/!\ NOT DELETED - HKLM\Software\Classes\EoRezoBHO.EoBho
/!\ NOT DELETED - HKLM\Software\Classes\EoRezoBHO.EoBho.1
.
C:\Users\henri\AppData\Roaming\EoRezo
C:\ProgramData\Microsoft\Windows\Startm~1\Programs\EoRezo

+-----------------| It's TV Elements Deleted :

HKCU\Software\ItsLabel
/!\ NOT DELETED - HKLM\Software\ItsLabel
.
C:\Users\henri\AppData\Roaming\ItsLabel
C:\ProgramData\Microsoft\Windows\Startm~1\Programs\ItsLabel

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


************* /!\ REGISTRY ELEMENT(S) NOT DELETED /!\ *************

"HKCR\EoRezoBHO.EoBho"
"HKCR\EoRezoBHO.EoBho.1"
"HKLM\Software\Classes\EoRezoBHO.EoBho"
"HKLM\Software\Classes\EoRezoBHO.EoBho.1"
"HKLM\Software\ItsLabel"

Second run ...

RESIST ! - "HKCR\EoRezoBHO.EoBho"
RESIST ! - "HKCR\EoRezoBHO.EoBho.1"
RESIST ! - "HKLM\Software\Classes\EoRezoBHO.EoBho"
RESIST ! - "HKLM\Software\Classes\EoRezoBHO.EoBho.1"
RESIST ! - "HKLM\Software\ItsLabel"


+-----------------| Added Scan:

---- Mozilla FireFox Version 3.0.10 ----

ProfilePath: hjs756fj.default (henri)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "MyStart Rechercher");
(Prefs.js) user_pref("browser.startup.homepage", "chrome://speeddial/content");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.10");
.

---- Internet Explorer Version 8.0.6001.18702 ----

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
SearchAssistant: hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

=========== Suspicious ==========


+---------------------------------------------------------------------------+

4127 Byte(s) - C:\Ad-Report-Clean-15.05.2009.log
3410 Byte(s) - C:\Ad-Report-Scan-13.05.2009.log

21 File(s) - C:\Program Files\Ad-remover\BACKUP
1 File(s) - C:\Program Files\Ad-remover\QUARANTINE

End at: 10:33:11 | 15/05/2009
.
+-----------------| E.O.F
.

lilou · Answer

et voila un rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:38:15, on 15/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\Windows\ehome\ehmsas.exe
C:\PVSW\Bin\w3dbsmgr.exe
C:\Users\henri\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
D:\utilitaire\WORD\Office12\WINWORD.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\GESTAN\Gestan.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
D:\prout\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NetFxUpdate_v1.1.4322] "C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe" 1 v1.1.4322 GAC + NI NID
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\utilitaire\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [german.exe] C:\Windows\system32\wintems.exe
O4 - Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\Bin\w3dbsmgr.exe
O4 - Global Startup: AutorunsDisabled
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.76\AMVConverter\grab.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\UTILIT~2\WORD\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\UTILIT~2\WORD\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.76\MediaManager\grab.html
O8 - Extra context menu item: Tout télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddList.html
O8 - Extra context menu item: Télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddLink.html
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~2\WORD\Office12\REFIEBAR.DLL
O16 - DPF: {13149882-F480-4F6B-8C6A-0764F75B99ED} - http://plug-in.reallusion.com/crazytalk4.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/betaactivescan/cabs/as2stubie.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\WIDEST~1\FREEQU~1\QUICKA~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache2.2 - Unknown owner - D:\xampplite\xampplite\apache\bin\apache.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\Windows\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: mysql - Unknown owner - D:\xampplite\xampplite\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: ScsiAccess - Unknown owner - D:\utilitaire\photodexgold\ScsiAccess.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Utilisateur anonyme · Answer

re Lilou ,

refais l option 1 de findykill ( executer en tant qu administrateur) et post le rapport stp

lilou · Answer

############################## [ FindyKill V4.728 ]

# User : henri (Administrateurs) # PC-DE-HENRI
# Update on 03/05/09 by Chiquitine29
# Start at: 11:06:41 | 15/05/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

# AMD Turion(tm) 64 X2 Mobile Technology TL-50
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : a-squared Anti-Malware 4 [ (!) Disabled | Updated ]

# C:\ # Disque fixe local # 51,99 Go (12,05 Go free) [VISTA] # NTFS
# D:\ # Disque fixe local # 44,66 Go (29,76 Go free) [LOISIR UTILITAIRE] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# H:\ # Disque fixe local # 35,62 Go (22,94 Go free) [AMOVIBLE1] # NTFS
# I:\ # Disque fixe local # 15,47 Go (12,93 Go free) [AMOVIBLE2] # FAT32

############################## [ Processus actifs ]

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\DRIVERS\CDANTSRV.EXE
C:\Windows\system32\crypserv.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\PVSW\Bin\w3dbsmgr.exe
C:\Users\henri\AppData\Local\Temp\RtkBtMnt.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\oodag.exe
C:\Windows\system32\svchost.exe
D:\utilitaire\photodexgold\ScsiAccess.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32	askeng.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
D:\utilitaire\WORD\Office12\WINWORD.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\GESTAN\Gestan.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## [ Fichiers / Dossiers infectieux ]

Found ! "C:\Users\henri\AppData\Roaming\drivers" 

################## [ Infected Temp Files ]


################## [ Registre / Clés infectieuses ]

Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"german.exe" 
Found ! HKEY_USERS\S-1-5-21-1754156993-695157337-552481621-1000\Software\Microsoft\Windows\CurrentVersion\Run\"german.exe"  


################## [ Recherche dans supports amovibles]


################## [ Registre / Mountpoints2 ]

# -> Not found !  

################## [ ! Fin du rapport # FindyKill V4.728 ! ]

Utilisateur anonyme · Answer

! Déconnecte toi et ferme toutes application en cours ( navigateur compris ) . 

* Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...)

* Relance "FindyKill" : au menu principal choisis l'option " F " pour français et tape sur [entrée] .

* Au second menu choisis l'option 2 (suppression) et tape sur [entrée] 

* Le pc va redémarrer automatiquement ...

--> le programme va travailler , ne touche à rien ... , ton bureau ne sera pas accessible c est normal !

* Poste le rapport qui apparait à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt ) 

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide 

Tuto (aides) : http://pagesperso-orange.fr/FindyKill.Ad.Remover/crbst_0.html

lilou · Answer

############################## [ FindyKill V4.728 ]

# User : henri (Administrateurs) # PC-DE-HENRI
# Update on 03/05/09 by Chiquitine29
# Start at: 11:34:39 | 15/05/2009
# Website : http://pagesperso-orange.fr/NosTools/findykill.html

# AMD Turion(tm) 64 X2 Mobile Technology TL-50
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : a-squared Anti-Malware 4 [ (!) Disabled | Updated ]

# C:\ # Disque fixe local # 51,99 Go (12,07 Go free) [VISTA] # NTFS
# D:\ # Disque fixe local # 44,66 Go (29,76 Go free) [LOISIR UTILITAIRE] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# H:\ # Disque fixe local # 35,62 Go (22,94 Go free) [AMOVIBLE1] # NTFS
# I:\ # Disque fixe local # 15,47 Go (12,93 Go free) [AMOVIBLE2] # FAT32

############################## [ Active Processes ] 

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Windows\system32	askeng.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\DRIVERS\CDANTSRV.EXE
C:\Windows\system32\crypserv.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\oodag.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
D:\utilitaire\photodexgold\ScsiAccess.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32unonce.exe
C:\Windows\system32\conime.exe

################## [ Infected Files \ Folders ]

Deleted ! C:\Windows\Prefetch\WINUPGRO.EXE-B9E72D89.pf  
Deleted ! "C:\Users\henri\AppData\Roaming\drivers"  

################## [ Infected Temp Files ]


################## [ Registry / Infected keys ] 

Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"german.exe"  

################## [ Cleaning Removable drives ] 

Deleted ! C:\Avenger  

################## [ Registry / Mountpoint2 ]

# -> Not found !  

################## [ States / Restarting of services ]  

# Services : [ Auto=2 / Request=3 / Disable=4 ]

# Ndisuio -> # Type of startup =3  
# EapHost -> # Type of startup =2  
# Wlansvc -> # Type of startup =2  
# SharedAccess -> # Type of startup =2  
# wuauserv -> # Type of startup =2  
# wscsvc -> # Type of startup =2  
# WinDefend -> # Type of startup =2  
# -> UAC is Enable.  

################## [ Searching Other Infections ]

# -> Nothing found.
 
################## [ Corrupted files # Re-Installation required ] 
 
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Trend Micro\caca\HijackThis.exe
C:\Program Files\Trend Micro\coco\HijackThis.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
D:\dvix\a voir\vava\HijackThis.exe
D:\SECURITE\ComboFix.exe
D:\SECURITE\hijack\HijackThis.exe
D:\SECURITE\hijackthis\gzgzg\HijackThis.exe
I:\jeux loulou\HijackThis.exe

################################### [ Cracks / Keygens / Serials ]

# -> Nothing found !  

################## [ ! End of Report # FindyKill V4.728 ! ]

lilou · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:08:42, on 15/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Spamihilator\spamihilator.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\PVSW\Bin\w3dbsmgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Users\henri\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\livecall.exe
D:\prout\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NetFxUpdate_v1.1.4322] "C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe" 1 v1.1.4322 GAC + NI NID
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\utilitaire\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [german.exe] C:\Windows\system32\wintems.exe
O4 - Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\Bin\w3dbsmgr.exe
O4 - Global Startup: AutorunsDisabled
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.76\AMVConverter\grab.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\UTILIT~2\WORD\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\UTILIT~2\WORD\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.76\MediaManager\grab.html
O8 - Extra context menu item: Tout télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddList.html
O8 - Extra context menu item: Télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddLink.html
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~2\WORD\Office12\REFIEBAR.DLL
O16 - DPF: {13149882-F480-4F6B-8C6A-0764F75B99ED} - http://plug-in.reallusion.com/crazytalk4.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/betaactivescan/cabs/as2stubie.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\WIDEST~1\FREEQU~1\QUICKA~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache2.2 - Unknown owner - D:\xampplite\xampplite\apache\bin\apache.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\Windows\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: mysql - Unknown owner - D:\xampplite\xampplite\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: ScsiAccess - Unknown owner - D:\utilitaire\photodexgold\ScsiAccess.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Utilisateur anonyme · Answer

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 




:processes 
explorer.exe 

:services 
Boonty Games 

:files 
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Trend Micro
D:\dvix\a voir\vava\HijackThis.exe 
D:\SECURITE\ComboFix.exe 
D:\SECURITE\hijack\HijackThis.exe 
D:\SECURITE\hijackthis\gzgzg\HijackThis.exe 
I:\jeux loulou\HijackThis.exe 

:reg 
HKCR\EoRezoBHO.EoBho1
HKCR\EoRezoBHO.EoBho.1
HKLM\Software\Classes\EoRezoBHO.EoBho
HKLM\Software\Classes\EoRezoBHO.EoBho.1
HKLM\Software\ItsLabel

:commands 
[emptytemp] 
[start explorer] 



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log


#############################################


Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries. 
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.) 
Double-clique sur le répertoire JavaRa obtenu. 
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher) 
Clique sur Search For Updates. 
Sélectionne Update Using jucheck.exe puis clique sur Search. 
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes. 
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions. 
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok. 
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse. 
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log 
(c:\JavaRa.log) 
Ferme l'application.

lilou · Answer

j arrive pas a voir le rapport par contre j ai copier ceci

Files moved on Reboot...
Folder move failed. C:\Program Files\Common Files\Symantec Shared\DecABI scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Common Files\Symantec Shared\CCPD-LC scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Common Files\Symantec Shared\DecABI scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Common Files\Symantec Shared\CCPD-LC scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Common Files\Symantec Shared scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\HijackThis\backups scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\HijackThis\backups scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\HijackThis scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\coco scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\caca scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\HijackThis\backups scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\HijackThis scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\coco scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro\caca scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Trend Micro scheduled to be moved on reboot.
File move failed. D:\dvix\a voir\vava\HijackThis.exe scheduled to be moved on reboot.
File move failed. D:\SECURITE\hijack\HijackThis.exe scheduled to be moved on reboot.
File move failed. D:\SECURITE\hijackthis\gzgzg\HijackThis.exe scheduled to be moved on reboot.

lilou · Answer

je n ai pas ceci :

c:\JavaRa.log

j ai fait ce que tu m a demandè
ça a fonctionner
mais pas de rapport

Utilisateur anonyme · Answer

Comment va le pc ?

fais un clic droit sur hijackthis
choisi executer en tant qu administrateur 

fais do a system scan and save a logfile et post le rapport stp

lilou · Answer

le pc va bien. j ai l impression qu il chauffe moins au niveau de la ventilation

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:36:47, on 15/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Spamihilator\spamihilator.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
C:\PVSW\Bin\w3dbsmgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\henri\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Windows\system32\SearchFilterHost.exe
D:\prout\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NetFxUpdate_v1.1.4322] "C:\Windows\Microsoft.NET\Framework\v1.1.4322
etfxupdate.exe" 1 v1.1.4322 GAC + NI NID
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\utilitaire\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\henri\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [german.exe] C:\Windows\system32\wintems.exe
O4 - Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\Bin\w3dbsmgr.exe
O4 - Global Startup: AutorunsDisabled
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WiFi Station pour Livebox.lnk = C:\Program Files\Hercules\WiFi Station pour Livebox\WiFiLB.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.76\AMVConverter\grab.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\UTILIT~2\WORD\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\UTILIT~2\WORD\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.76\MediaManager\grab.html
O8 - Extra context menu item: Tout télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddList.html
O8 - Extra context menu item: Télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddLink.html
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\UTILIT~2\WORD\Office12\REFIEBAR.DLL
O16 - DPF: {13149882-F480-4F6B-8C6A-0764F75B99ED} - http://plug-in.reallusion.com/CrazyTalk4.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/betaactivescan/cabs/as2stubie.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED5973AF-F337-492D-9BDD-9273F4F194FE}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\WIDEST~1\FREEQU~1\QUICKA~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache2.2 - Unknown owner - D:\xampplite\xampplite\apache\bin\apache.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\Windows\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: mysql - Unknown owner - D:\xampplite\xampplite\mysql\bin\mysqld-nt.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: ScsiAccess - Unknown owner - D:\utilitaire\photodexgold\ScsiAccess.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\utilitaire\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Utilisateur anonyme · Answer

Fais un clic droit sur hijackthis
choisi executer en tant qu administrateur
fais scan only
coches ces lignes :


O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 

O4 - HKCU\..\Run: [german.exe] C:\Windows\system32\wintems.exe 

O4 - Global Startup: AutorunsDisabled 

O16 - DPF: {13149882-F480-4F6B-8C6A-0764F75B99ED} - http://plug-in.reallusion.com/crazytalk4.cab 
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab 
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/betaactivescan/cabs/as2stubie.cab 

tu les coches et tu clci sur fix checked 


ensuite :

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 



:services 
Apache2.2
mysql 
NMIndexingService




---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log


ensuite :


* pour supprimer les outils/fix utilisés : 

Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pc-system.fr/ 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Fais un clic droit sur toolcleaner
# Choisi executer en tant qu administrateur
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


ensuite :


Désactive et reactive ta restauration

ensuite lance un scan avec Antivir et post son rapport stp
@+

lilou · Answer

========== SERVICES/DRIVERS ==========
Service\Driver Apache2.2 not found.
Unable to delete service\driver keyApache2.2.
Service\Driver mysql not found.
Unable to delete service\driver keymysql.
Service\Driver NMIndexingService not found.
Unable to delete service\driver keyNMIndexingService.
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05152009_135334





C:\FindyKill.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Users\henri\AppData\Local\IM\Identities\{418CC75A-EC4A-4429-B5BB-19168A07273E}\Message Store\Attachments\hijackthis.log: ERREUR DE SUPPRESSION !!
C:\Users\henri\AppData\Local\IM\Identities\{418CC75A-EC4A-4429-B5BB-19168A07273E}\Message Store\Attachments\{203D7355-BFC8-42DC-9BFD-70B287EC3160}\hijackthis.log: ERREUR DE SUPPRESSION !!
C:\Users\henri\Documents\Mes fichiers reçus\hijackthis.log: supprimé !
C:\Users\henri\Documents\Mes fichiers reçus\cleannavi.txt: supprimé !
C:\FixWareOut: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\FindyKill: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Navilog1: ERREUR DE SUPPRESSION !!
C:\Program Files\FindyKill: ERREUR DE SUPPRESSION !!
C:\Program Files\Ad-remover: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Navilog1: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\FindyKill: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\Ad-remover: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Navilog1: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FindyKill: ERREUR DE SUPPRESSION !!
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-remover: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\Navilog1: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\FindyKill: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\Ad-remover: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Navilog1: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\FindyKill: ERREUR DE SUPPRESSION !!
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Ad-remover: ERREUR DE SUPPRESSION !!
C:\Users\henri\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: supprimé !
C:\Users\henri\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes\FindyKill: ERREUR DE SUPPRESSION !!
C:\Users\henri\AppData\Roaming\Microsoft\Windows\Start Menu\Programmes\Ad-remover: ERREUR DE SUPPRESSION !!
C:\Users\henri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FindyKill: supprimé !
C:\Users\henri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ad-remover: supprimé !
C:\Users\henri\Desktop\SmitFraudfix: supprimé !
C:\Users\henri\Desktop\Nouveau dossier\GenProc: supprimé !

lilou · Answer

la je fait un scan sur avira antivirus et te poste apres merci a vous tous en tous cas !

lilou · Answer

Avira AntiVir Personal Report file date: vendredi 15 mai 2009 14:01 Scanning for 1394996 virus strains and unwanted programs. Licensee : Avira AntiVir Personal - FREE Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows Vista Windows version : (Service Pack 1) [6.0.6001] Boot mode : Normally booted Username : SYSTEM Computer name : PC-DE-HENRI Version information: BUILD.DAT : 9.0.0.394 17962 Bytes 17/04/2009 11:20:00 AVSCAN.EXE : 9.0.3.5 466689 Bytes 10/05/2009 23:26:40 AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 08:58:24 LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 09:35:49 LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 08:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 10:30:36 ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 18:33:26 ANTIVIR2.VDF : 7.1.3.185 2010112 Bytes 12/05/2009 06:47:07 ANTIVIR3.VDF : 7.1.3.208 103936 Bytes 15/05/2009 08:13:19 Engineversion : 8.2.0.166 AEVDF.DLL : 8.1.1.1 106868 Bytes 10/05/2009 23:26:40 AESCRIPT.DLL : 8.1.1.81 385401 Bytes 10/05/2009 23:26:40 AESCN.DLL : 8.1.1.10 127348 Bytes 10/05/2009 23:26:40 AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 16:24:41 AEPACK.DLL : 8.1.3.16 397686 Bytes 10/05/2009 23:26:40 AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 18:01:56 AEHEUR.DLL : 8.1.0.128 1757559 Bytes 10/05/2009 23:26:40 AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 18:01:56 AEGEN.DLL : 8.1.1.42 348531 Bytes 10/05/2009 23:26:40 AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 12:32:40 AECORE.DLL : 8.1.6.9 176500 Bytes 10/05/2009 23:26:40 AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 12:32:40 AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 06:47:59 AVPREF.DLL : 9.0.0.1 43777 Bytes 05/12/2008 08:32:15 AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 12:34:28 AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 08:32:09 AVARKT.DLL : 9.0.0.3 292609 Bytes 10/05/2009 23:26:40 AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 08:37:08 SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 13:03:49 SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 06:21:33 NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 08:32:10 RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 09/02/2009 09:45:45 RCTEXT.DLL : 9.0.37.0 86785 Bytes 10/05/2009 23:26:40 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp Logging.............................: low Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, H:, I:, Process scan........................: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: medium Start of the scan: vendredi 15 mai 2009 14:01 Starting search for hidden objects. '99120' objects were checked, '0' hidden objects were found. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'ToolsCleaner2.exe' - '1' Module(s) have been scanned Scan process 'OTMoveIt3.exe' - '1' Module(s) have been scanned Scan process 'notepad.exe' - '1' Module(s) have been scanned Scan process 'livecall.exe' - '1' Module(s) have been scanned Scan process 'hpqste08.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'sidebar.exe' - '1' Module(s) have been scanned Scan process 'RtkBtMnt.exe' - '1' Module(s) have been scanned Scan process 'ehmsas.exe' - '1' Module(s) have been scanned Scan process 'w3dbsmgr.exe' - '1' Module(s) have been scanned Scan process 'WiFiLB.exe' - '1' Module(s) have been scanned Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned Scan process 'GoogleUpdate.exe' - '1' Module(s) have been scanned Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned Scan process 'sidebar.exe' - '1' Module(s) have been scanned Scan process 'ehtray.exe' - '1' Module(s) have been scanned Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'spamihilator.exe' - '1' Module(s) have been scanned Scan process 'schedhlp.exe' - '1' Module(s) have been scanned Scan process 'TimounterMonitor.exe' - '1' Module(s) have been scanned Scan process 'TrueImageMonitor.exe' - '1' Module(s) have been scanned Scan process 'ipoint.exe' - '1' Module(s) have been scanned Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'taskeng.exe' - '1' Module(s) have been scanned Scan process 'dwm.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'usnsvc.exe' - '1' Module(s) have been scanned Scan process 'UI0Detect.exe' - '1' Module(s) have been scanned Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned Scan process 'taskeng.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned Scan process 'ePowerSvc.exe' - '1' Module(s) have been scanned Scan process 'capuserv.exe' - '1' Module(s) have been scanned Scan process 'eRecoveryService.exe' - '1' Module(s) have been scanned Scan process 'XAudio.exe' - '1' Module(s) have been scanned Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'TrueImageTryStartService.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'StarWindServiceAE.exe' - '1' Module(s) have been scanned Scan process 'sqlwriter.exe' - '1' Module(s) have been scanned Scan process 'sqlbrowser.exe' - '1' Module(s) have been scanned Scan process 'scsiaccess.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'oodag.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'sqlservr.exe' - '1' Module(s) have been scanned Scan process 'MobilityService.exe' - '1' Module(s) have been scanned Scan process 'mdm.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'eNet Service.exe' - '1' Module(s) have been scanned Scan process 'eLockServ.exe' - '1' Module(s) have been scanned Scan process 'eDSService.exe' - '1' Module(s) have been scanned Scan process 'Crypserv.exe' - '1' Module(s) have been scanned Scan process 'CDANTSRV.EXE' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'schedul2.exe' - '1' Module(s) have been scanned Scan process 'a2service.exe' - '1' Module(s) have been scanned Scan process 'a2service.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'SLsvc.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'audiodg.exe' - '0' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsm.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'wininit.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 92 processes with 92 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Boot sector 'H:\' [INFO] No virus was found! Boot sector 'I:\' [INFO] No virus was found! Starting to scan executable files (registry). The registry was scanned ( '43' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! [NOTE] This file is a Windows system file. [NOTE] This file cannot be opened for scanning. C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W4QGT8E3\mvsdeflt[1].cab [0] Archive type: CAB (Microsoft) --> mvsdeflt.dll [WARNING] No further files can be extracted from this archive. The archive will be closed [WARNING] No further files can be extracted from this archive. The archive will be closed C:\Windows\System32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'D:\' Begin scan in 'H:\' H:\pclegende\itw-gtl.r47 [0] Archive type: RAR --> itw-gtl.mds [WARNING] No further files can be extracted from this archive. The archive will be closed [WARNING] No further files can be extracted from this archive. The archive will be closed Begin scan in 'I:\' End of the scan: vendredi 15 mai 2009 15:30 Used time: 1:29:03 Hour(s) The scan has been done completely. 26514 Scanned directories 750844 Files were scanned 0 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 0 Files were moved to quarantine 0 Files were renamed 2 Files cannot be scanned 750842 Files not concerned 5818 Archives were scanned 6 Warnings 1 Notes 99120 Objects were scanned with rootkit scan 0 Hidden objects were found

Utilisateur anonyme · Answer

si tu n as pas d autres soucis change le statut du sujet en resolu stp

http://www.commentcamarche.net/faq/sujet 11365 marquer un fil de discussion comme etant resolu

lilou · Answer

merci a toi chiquitine
merci a v.x et aux autres !!

quel delicatesse de votre part !!
bisous tendre

Utilisateur anonyme · Answer

de rien , bon week end

Gros virus plus rien a faire - Page 5

Discussions similaires

Newsletters