Trojan + 23 infections Résolu

Question

Bonjour,

J'ai  pris  un virus en cliquant sur un lien envoyé sur msn. 
Je me retrouve avec 23 infections et plusieurs Trojan.
J'ai passé Malwarebytes 2 fois et Antivir.
Je vous poste les rapports ici pour avoir de l'aide pour terminer le nettoyage.
 
1 ER NETTOYAGE 
Malwarebytes' Anti-Malware 1.35
Version de la base de données: 1917
Windows 5.1.2600 Service Pack 2

13/05/2009 19:40:05
mbam-log-2009-05-13 (19-39-33).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 154306
Temps écoulé: 34 minute(s), 40 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rirawapola (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center (Backdoor.Bot) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\soveveje.dll (Trojan.Agent) -> No action taken.


2EME NETTOYAGE
Malwarebytes' Anti-Malware 1.35
Version de la base de données: 1917
Windows 5.1.2600 Service Pack 2

13/05/2009 21:16:12
mbam-log-2009-05-13 (21-16-06).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 154626
Temps écoulé: 41 minute(s), 56 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 6
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\kugeyugu.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\yizesoko.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\vabofoka.dll (Trojan.Vundo.H) -> No action taken.
c:\WINDOWS\system32\pogobiwu.dll (Trojan.Vundo.H) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{499e9650-0baa-4087-9c29-6a5000dba20c} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{499e9650-0baa-4087-9c29-6a5000dba20c} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{499e9650-0baa-4087-9c29-6a5000dba20c} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\320d18a1 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm313e2b3d (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rirawapola (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\vabofoka.dll -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\vabofoka.dll  -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\vabofoka.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\pogobiwu.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\pogobiwu.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\kugeyugu.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\uguyeguk.ini (Trojan.Vundo.H) -> No action taken.
c:\WINDOWS\system32\pogobiwu.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\yizesoko.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\vabofoka.dll (Trojan.Vundo.H) -> No action taken.
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0108179.dll (Trojan.Vundo.H) -> No action taken.


NETTOYAGE ANTIVIR


Avira AntiVir Personal
Report file date: mercredi 13 mai 2009  21:21

Scanning for 1392690 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    LAURA

Version information:
BUILD.DAT     : 8.2.0.348      16934 Bytes  23/03/2009 13:44:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  26/11/2008 17:34:24
AVSCAN.DLL    : 8.1.4.0        40705 Bytes  26/05/2008 07:56:42
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 12:44:20
LUKERES.DLL   : 8.1.4.0        12033 Bytes  26/05/2008 07:58:54
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  27/10/2008 16:38:28
ANTIVIR1.VDF  : 7.1.2.12     3336192 Bytes  11/02/2009 12:09:22
ANTIVIR2.VDF  : 7.1.3.185    2010112 Bytes  12/05/2009 17:29:08
ANTIVIR3.VDF  : 7.1.3.199      70656 Bytes  13/05/2009 17:20:48
Engineversion : 8.2.0.166 
AEVDF.DLL     : 8.1.1.1       106868 Bytes  03/05/2009 17:18:28
AESCRIPT.DLL  : 8.1.1.81      385401 Bytes  08/05/2009 17:20:00
AESCN.DLL     : 8.1.1.10      127348 Bytes  04/04/2009 13:17:12
AERDL.DLL     : 8.1.1.3       438645 Bytes  05/11/2008 17:33:36
AEPACK.DLL    : 8.1.3.16      397686 Bytes  08/05/2009 17:19:58
AEOFFICE.DLL  : 8.1.0.36      196987 Bytes  27/02/2009 12:07:28
AEHEUR.DLL    : 8.1.0.128    1757559 Bytes  08/05/2009 17:19:56
AEHELP.DLL    : 8.1.2.2       119158 Bytes  27/02/2009 12:07:28
AEGEN.DLL     : 8.1.1.42      348531 Bytes  08/05/2009 17:19:50
AEEMU.DLL     : 8.1.0.9       393588 Bytes  15/10/2008 17:23:26
AECORE.DLL    : 8.1.6.9       176500 Bytes  14/04/2009 17:08:52
AEBB.DLL      : 8.1.0.3        53618 Bytes  15/10/2008 17:23:18
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 08:40:06
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 09:28:02
AVREP.DLL     : 8.0.0.3       155688 Bytes  22/04/2009 17:09:24
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 11:26:42
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 08:29:24
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 12:27:50
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 17:28:04
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 12:49:42
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 12:05:12
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  12/06/2008 13:48:08
RCTEXT.DLL    : 8.0.52.0       86273 Bytes  27/06/2008 13:34:38

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: mercredi 13 mai 2009  21:21

Starting search for hidden objects.
'64657' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'WSCNTFY.EXE' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.EXE' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'CTFMON.EXE' - '1' Module(s) have been scanned
Scan process 'PINMENU.EXE' - '1' Module(s) have been scanned
Scan process 'MSMSGS.EXE' - '1' Module(s) have been scanned
Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned
Scan process 'SweetIM.exe' - '1' Module(s) have been scanned
Scan process 'BTLiveUpdate.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'vVX1000.exe' - '1' Module(s) have been scanned
Scan process 'AVGNT.EXE' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'RUNDLL32.EXE' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'ALG.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'MSCamS32.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'CISVC.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SCHED.EXE' - '1' Module(s) have been scanned
Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned
Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'InCDsrv.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
42 processes with 42 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!
Master boot sector HD1
    [INFO]      No virus was found!
    [WARNING]   System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD2
    [INFO]      No virus was found!
    [WARNING]   System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
    [INFO]      No virus was found!
    [WARNING]   System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
    [INFO]      No virus was found!
    [WARNING]   System error [21]: Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '65' files ).


Starting the file scan:

Begin scan in 'C:\' <ACER>
C:\pagefile.sys
    [WARNING]   The file could not be opened!
C:\hiberfil.sys
    [WARNING]   The file could not be opened!
C:\sfide.exe
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE]      The file was moved to '4a741e72.qua'!
C:\Documents and Settings\13\Local Settings\Temporary Internet Files\Content.IE5\B60QRGWM\is[1].jpg
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE]      The file was moved to '4a6624a5.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0107213.exe
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE]      The file was moved to '4a3c28d9.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0109190.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE]      The file was moved to '4a3c28dd.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0109192.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE]      The file was moved to '4a3c28df.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0109193.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE]      The file was moved to '4a3c28e2.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0109194.dll
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE]      The file was moved to '4a3c28e4.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0109200.exe
    [DETECTION] Is the TR/Vundo.Gen Trojan
    [NOTE]      The file was moved to '4a3c28e7.qua'!


End of the scan: mercredi 13 mai 2009  22:08
Used time: 47:12 Minute(s)

The scan has been done completely.

   6489 Scanning directories
 199141 Files were scanned
      8 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      8 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 199131 Files not concerned
   7090 Archives were scanned
      6 Warnings
      8 Notes
  64657 Objects were scanned with rootkit scan
      0 Hidden objects were found


Merci de m'aider car Antivir va certainement passer son temps à biper.  j'ai bien cru que j'avais perdu l'ordi car antivir sonnait tellement que tout était bloqué.

georges86400 · Answer

Bonsoir
je vois dans le rapport Malwarebytes " no action taken ".
As tu bien mis en quarantaine tout ce que malwarebytes a trouvé?

Utilisateur anonyme · Answer

ensuite, fait ceci, mais lits bien la procédure avant
---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
places le sur le bureau et renommes le jacobin.exe

/!\ Déconnecte-toi du net et désactives les défenses, antivirus et antispyware y compris /!\
---> Double-clique sur jacobin.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"
SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

fraggle559 · Answer

Bonjour Nathandre

Merci pour tes conseils très précis. J'ai mis à jour malverbytes et l'ai repassé.

Avant de commencer, pour éviter toute erreur, dis moi comment on installe la CONSOLE DE RECUPERATION c'est automatique après accord ou il y a une procédure spéciale ?

J'en ai déjà entendu parler mais il me semble que je n'avais pas réussi à l'installer et je ne me rapelle plus comment.

Merci

fraggle559 · Answer

bonjour à tous

Merci pour votre aide.
voici un 1er rapport
Logfile of random's system information tool 1.06 (written by random/random)
Run by 13 at 2009-05-14 15:07:05
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 7 GB (18%) free of 38 GB
Total RAM: 735 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:07:22, on 14/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\BboxUpdate\BTLiveUpdate.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32undll32.exe
C:\Documents and Settings\13\Bureau\RSIT.exe
C:\Program Files	rend micro\13.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [PROMT Integrator] "C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BboxUpdate] C:\Program Files\BboxUpdate\BTLiveUpdate.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\ADOBE\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7" -"http://www8.agame.com/..."
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2a22063e1a6841fa860803837843fbd1
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2a22063e1a6841fa860803837843fbd1
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.acer.com/worldwide/selection.html
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - AppInit_DLLs: ixrhij.dll ofpfdj.dll  , 
O20 - Winlogon Notify: vtUkihHB - vtUkihHB.dll (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

fraggle559 · Answer

voici le 2eme rapport INFO txt
info.txt logfile of random's system information tool 1.06 2009-05-14 15:07:25

======Uninstall list======

-->C:\Program Files\Ahead
ero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\NuNInst.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ACE Mega CoDecS Pack-->"C:\Program Files\ACE Mega CoDecS Pack\unins000.exe"
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Adobe Shockwave Player-->C:\WINDOWS\system32\ADOBE\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\ADOBE\SHOCKW~1\INSTALL.LOG
Alchemy 1.2-->C:\Program Files\PopCap Games\Alchemy\UnGins.exe "C:\Program Files\PopCap Games\Alchemy\install.log"
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ArcSoft PhotoImpression-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35B8CC58-F128-4169-82EB-0E6CB0C3AFE6}\setup.exe" -l0x40c  -uninst 
ArcSoft PhotoStudio 5.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x40c 
ArcSoft VideoImpression 1.6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DEF2E5A3-0317-4822-B930-8B721EB483E4}\setup.exe" -l0x40c  -uninst 
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
AstroPop Deluxe 1.0-->C:\Program Files\PopCap Games\AstroPop Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\AstroPop Deluxe\Install.log"
Atomica Deluxe 2.52-->C:\Program Files\PopCap Games\Atomica Deluxe\PopUninstall.exe C:\Program Files\PopCap Games\Atomica Deluxe\Install.log
AVIConverter 5.1-->C:\Program Files\AVIConverter\uninst.exe
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Barre d'outils Outlook de Windows Live (Windows Live Toolbar)-->MsiExec.exe /X{6E15BEDF-7EB5-4010-998E-B430DB4EFE45}
Bbox - Bouygues Telecom - Utilitaire de mise à jour-->C:\Program Files\BboxUpdate\uninstall.exe
Bejeweled 2 Deluxe 1.0-->C:\Program Files\PopCap Games\Bejeweled 2 Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Bejeweled 2 Deluxe\Install.log"
Big Money Deluxe 1.22-->C:\Program Files\PopCap Games\Big Money Deluxe\PopUninstall.exe C:\Program Files\PopCap Games\Big Money Deluxe\Install.log
Bloqueur de fenêtres pop-up (Windows Live Toolbar)-->MsiExec.exe /X{A425C250-A0E1-4D78-B1C1-A5CBC7385E7C}
BookWorm Deluxe 1.02-->C:\Program Files\PopCap Games\BookWorm Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\BookWorm Deluxe\Install.log"
Canon MP Navigator 2.0-->"C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 2.0\uninst.ini
Canon MP150-->"C:\WINDOWS\system32\CanonMP Uninstaller Information\{CA9A3609-3ECC-4574-8824-A8161A71A603}\DelDrv.exe" /U:{CA9A3609-3ECC-4574-8824-A8161A71A603} /L0x000c
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
Coffret de pilotes Logitech QuickCam-->"C:\Program Files\Fichiers communs\LogiShrd\LogiDriverStore\lvdrivers\11.50.1145\LgDrvInst.exe" -remove -instdir"C:\Program Files\Fichiers communs\LogiShrd\LogiDriverStore\lvdrivers\" -enumdelay=2000 -enabledifx -forcedelete -usbhubsfirst -forceremove -cumulativeremove -promptuninstall -arpregkey"lvdrivers_11.50" /clone_wait /hide_progress
Collection Microsoft Encarta 2003-->MsiExec.exe /I{034600C0-3975-4267-9F39-1DC4745090B7}
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB914440)-->"C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif Windows XP - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Correctif Windows XP - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Correctif Windows XP - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Correctif Windows XP - KB885884-->C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
Correctif Windows XP - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Correctif Windows XP - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Correctif Windows XP - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Correctif Windows XP - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Correctif Windows XP - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
Crazy Taxi-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F68A7F48-9F26-4FB1-A7C2-DF3C0F2D849C}\setup.exe" 
Désinstaller Bouygues Telecom - CD d'installation Bbox-->C:\Program Files\Bbox\eSKernel.exe /Uninstall.xml
Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{EFFCB0F1-CFEC-48D4-B793-EBFCAE852976}
Dynomite Deluxe 2.71-->C:\Program Files\PopCap Games\Dynomite Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Dynomite Deluxe\Install.log"
Easy-WebPrint-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_0531C63A913CC9D1.exe" /uninstall
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
L&H TTS3000 Français-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSFRF.inf, Uninstall
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Logitech Desktop Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\SETUP.exe" -l0x40c UNINSTALL -removeonly
Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x040c -removeonly
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Memories Disc Creator 2.0-->MsiExec.exe /X{2E132061-C78A-48D4-A899-1D13B9D189FA}
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Messenger Plus! Live & Sponsor (CiD)-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft LifeCam-->MsiExec.exe /X{968D41C3-25BB-4632-A6DF-2E1C8F0143A4}
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901190)-->"C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB917344)-->"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB917953)-->"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB919007)-->"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920685)-->"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB921503)-->"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924191)-->"C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929969)-->"C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB933566)-->"C:\WINDOWS\$NtUninstallKB933566$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB937143)-->"C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938829)-->"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB939653)-->"C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB942615)-->"C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338)-->"C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944533)-->"C:\WINDOWS\$NtUninstallKB944533$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB947864)-->"C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB968220)-->"C:\WINDOWS\ie8updates\KB968220-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB904942)-->"C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB931836)-->"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB932823-v3)-->"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB933360)-->"C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942840)-->"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB946627)-->"C:\WINDOWS\$NtUninstallKB946627$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{E916E61F-DE9D-4EAF-91E1-CEB50016326A}
Nero Suite-->C:\Program Files\Fichiers communs\Ahead\Uninstall\setup.exe /uninstall
NingPo MahJong Deluxe 1.04-->C:\Program Files\PopCap Games\NingPo MahJong Deluxe\UnGins.exe "C:\Program Files\PopCap Games\NingPo MahJong Deluxe\install.log"
Norton™ Security Scan-->MsiExec.exe /I{E5431FB5-B3EB-46C8-8275-F6447131C98A}
NTI Backup NOW! 3-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{4E68EAA3-775A-4542-A08A-47DB8E8E74A6} /l1036 BUNText
NTI CD & DVD-Maker Gold -->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{C438B7C4-B4F8-49C5-A4DF-FF6F1F242778} /l1036 AnyText
OneCare Advisor (Windows Live Toolbar)-->MsiExec.exe /X{6D7F8D4B-D1A4-402A-973E-31E90940E585}
PKR-->"C:\Program Files\PKR\uninstall-pkr.exe"
PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Recuva (remove only)-->"C:\Program Files\Recuva\uninst.exe"
Rocket Mania 1.01-->C:\Program Files\PopCap Games\Rocket Mania Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Rocket Mania Deluxe\Install.log"
SAMSUNG CDMA Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
SAMSUNG Mobile USB Modem ^^-->C:\WINDOWS\system32\Samsung_USB_Drivers\4\SSVDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Shockwave-->C:\WINDOWS\system32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~1\INSTALL.LOG
SiS 900 PCI Fast Ethernet Adapter Driver-->C:\Progra~1\SiSLan\Uninst.exe
SuperCopier-->"C:\Program Files\SuperCopier\SCUninst.exe"
SweetIM for Messenger 2.6-->MsiExec.exe /X{023EC958-023C-42D1-B2A4-E9E4BEF599FC}
SweetIM Toolbar for Internet Explorer 3.3-->MsiExec.exe /X{266C7330-C0F4-49E5-8F20-A56F9F822875}
VLC media player 0.9.8a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Writer-->MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"

======Security center information======

AV: Avira AntiVir PersonalEdition

======System event log======

Computer Name: LAURA
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 58508
Source Name: Tcpip
Time Written: 20090403165553.000000+120
Event Type: Avertissement
User: 

Computer Name: LAURA
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 58507
Source Name: Tcpip
Time Written: 20090403164213.000000+120
Event Type: Avertissement
User: 

Computer Name: LAURA
Event Code: 7036
Message: Le service Google Updater Service est entré dans l'état : arrêté.

Record Number: 58506
Source Name: Service Control Manager
Time Written: 20090403154954.000000+120
Event Type: Informations
User: 

Computer Name: LAURA
Event Code: 7036
Message: Le service Google Updater Service est entré dans l'état : en cours d'exécution.

Record Number: 58505
Source Name: Service Control Manager
Time Written: 20090403154754.000000+120
Event Type: Informations
User: 

Computer Name: LAURA
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Google Updater Service.

Record Number: 58504
Source Name: Service Control Manager
Time Written: 20090403154754.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

=====Application event log=====

Computer Name: LAURA
Event Code: 11728
Message: Produit : Microsoft Office XP Professional avec FrontPage -- La configuration s'est terminée correctement.

Record Number: 1793
Source Name: MsiInstaller
Time Written: 20090221140051.000000+060
Event Type: Informations
User: LAURA\13

Computer Name: LAURA
Event Code: 11729
Message: Produit : Microsoft Office XP Professional avec FrontPage -- La configuration a échoué.

Record Number: 1792
Source Name: MsiInstaller
Time Written: 20090221135914.000000+060
Event Type: Informations
User: LAURA\13

Computer Name: LAURA
Event Code: 11706
Message: Produit : Microsoft Office XP Professional avec FrontPage -- Erreur 1706. Le programme d'installation ne peut pas trouver les fichiers requis. Vérifiez votre connexion au réseau ou votre lecteur de CD-ROM. Pour des solutions éventuelles à ce problème, consultez C:\Program Files\Microsoft Office\Office10\1036\SETUP.HLP.

Record Number: 1791
Source Name: MsiInstaller
Time Written: 20090221135913.000000+060
Event Type: erreur
User: LAURA\13

Computer Name: LAURA
Event Code: 1001
Message: Échec de détection du produit '{9028040C-6000-11D3-8CFE-0050048383C9}', fonctionnalité 'InternationalSupportFiles_JPN' lors de la demande du composant '{D4C8BFFA-BF6F-11D1-843A-0000F807F120}'

Record Number: 1790
Source Name: MsiInstaller
Time Written: 20090221135858.000000+060
Event Type: Avertissement
User: LAURA\13

Computer Name: LAURA
Event Code: 11729
Message: Produit : Microsoft Office XP Professional avec FrontPage -- La configuration a échoué.

Record Number: 1789
Source Name: MsiInstaller
Time Written: 20090221135827.000000+060
Event Type: Informations
User: LAURA\13

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 10 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION"=0a00
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------







Le scan a été fait à une vitesse hallucinante. C'est normal ?

fraggle559 · Answer

voici le rapport ad-remover

------- LOGFILE OF AD-REMOVER 1.1.3.7 | ONLY XP/VISTA -------

Updated by C_XX on 11/05/2009 at 16:00
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html

Start at: 15:36:40, 14/05/2009 | Boot mode: Normal Boot
Option: Scan | Executed from: C:\Program Files\Ad-remover\
Operating System: Microsoft® Windows XP™ Service Pack 2 (version 5.1.2600)
Computer Name: LAURA
Current User: 13 - Administrator
Drive(s):
- C:\ (File System: FAT32)

(!) ---- C:\Documents and Settings\maxime\Ntuser.dat Loaded as: 'HKU\maxime'

============ Known Adwares Found ============

.
HKCU\Software\pacificpoker
HKCU\Software\pokerinstaller
HKCU\Software\Titan Poker
HKLM\Software\Titan Poker
HKLM\Software\Trymedia Systems
HKU\S-1-5-21-784569582-1608279117-3960356139-1010\Software\Titan Poker
.
C:\Program Files\PacificPoker
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\EBSuggestHistory
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\searchplugins\conduit.xml
C:\Documents and Settings\13\Application Data\PacificPoker
C:\Documents and Settings\13\Cookies\13@atdmt[1].txt
C:\Documents and Settings\13\Cookies\13@bs.serving-sys[1].txt

+-----------------| Eorezo Elements Found:

.

+-----------------| It's TV Elements Found:

.

+-----------------| Sweetim Elements Found:

HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\MediaPlayer.GraphicsUtils
HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1
HKLM\Software\Classes\MgMediaPlayer.GifAnimator
HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1
HKLM\Software\Classes\SWEETIE.IEToolbar
HKLM\Software\Classes\SWEETIE.IEToolbar.1
HKLM\Software\Classes\SWEETIE.SWEETIE
HKLM\Software\Classes\SWEETIE.SWEETIE.3
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKLM\Software\Classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Classes\Toolbar3.SWEETIE
HKLM\Software\Classes\Toolbar3.SWEETIE.1
HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\SOFTWARE\Microsoft\Installer\Products\5D72AF385B5242D47B69FD47F2805AFC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\WINDOWS\Installer\1e0f987.msi
C:\WINDOWS\Installer\1e0f98c.msi
C:\Program Files\SweetIM
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\searchplugins\sweetim.xml
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\SweetIMToolbarData
C:\WINDOWS\Installer\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\Documents and Settings\13\Cookies\13@www.sweetim[2].txt
C:\Documents and Settings\13\Cookies\13@search.sweetim[1].txt
C:\Documents and Settings\13\Cookies\13@sweetim[3].txt
C:\Documents and Settings\13\Cookies\13@sweetim[2].txt

+-----------------| Added Scan:

---- Mozilla FireFox Version 3.0.10 ----

ProfilePath: 9ka9hnr1.default (13)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
(Prefs.js) user_pref("browser.search.selectedEngine", "Google");
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=3&q=");
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.msn.com/");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.10");
(Prefs.js) user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://fr.msn.com/");
.
(Prefs.js) Found: user_pref("CT2077008.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
(Prefs.js) Found: user_pref("CT2077008.CTPBaseServerUrl", "hxxp://services.conduit.com/");
(Prefs.js) Found: user_pref("CT2077008.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=2&q=");
(Prefs.js) Found: user_pref("CT2077008.Server", "hxxp://users.conduit.com");
(Prefs.js) Found: user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) Found: user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) Found: user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) Found: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
(Prefs.js) Found: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
(Prefs.js) Found: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
(Prefs.js) Found: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
(Prefs.js) Found: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
(Prefs.js) Found: user_pref("sweetim.toolbar.mode.debug", "false");
(Prefs.js) Found: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
(Prefs.js) Found: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=3&q=");
(Prefs.js) Found: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://fr.msn.com/");
(Prefs.js) Found: user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=2&q=");
(Prefs.js) Found: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
(Prefs.js) Found: user_pref("sweetim.toolbar.search.history.capacity", "10");
(Prefs.js) Found: user_pref("sweetim.toolbar.simapp_id", "{BC109927-5281-4912-8116-DFD04D9805B8}");
(Prefs.js) Found: user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
(Prefs.js) Found: user_pref("sweetim.toolbar.version", "1.0.0.8");

---- Internet Explorer Version 8.0.6001.18702 ----

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://home.sweetim.com
Start Page: hxxp://fr.msn.com/?ocid=iehp

[HKEY_USERS\S-1-5-21-784569582-1608279117-3960356139-1010\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://home.sweetim.com
Start Page: hxxp://fr.msn.com/?ocid=iehp

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://home.sweetim.com

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

=========== Suspicious ==========

+---------------------------------------------------------------------------+

38050 Byte(s) - C:\AD-REPORT-SCAN-22.01.2009.LOG
9851 Byte(s) - C:\AD-REPORT-CLEAN-23.01.2009.LOG
16323 Byte(s) - C:\Ad-Report-Scan-14.05.2009.log

1 File(s) - C:\Program Files\Ad-remover\BACKUP
0 File(s) - C:\Program Files\Ad-remover\QUARANTINE

End at: 16:02:51 | 14/05/2009
.
+-----------------| E.O.F
.

fraggle559 · Answer

Je suis restée en panne pendant 1 heure plus de connexion internet.
voila le nouveau rapport

------- LOGFILE OF AD-REMOVER 1.1.3.7 | ONLY XP/VISTA -------

Updated by C_XX on 11/05/2009 at 16:00
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html

**** LIMITED TO ****

Known Adwares
Sweetim

********************

Start at: 18:19:05, 14/05/2009 | Boot mode: Normal Boot
Option: Clean | Executed from: C:\Program Files\Ad-remover\
Operating System: Microsoft® Windows XP™ Service Pack 2 (version 5.1.2600)
Computer Name: LAURA
Current User: 13 - Administrator
Drive(s):
- C:\ (File System: FAT32)

(!) ---- C:\Documents and Settings\maxime\Ntuser.dat Loaded as: 'HKU\maxime'

(!) ---- IE start pages/Tabs reset

============ Known Adwares Deleted ============

.
HKCU\Software\pacificpoker
HKCU\Software\pokerinstaller
HKCU\Software\Titan Poker
HKLM\Software\Titan Poker
HKLM\Software\Trymedia Systems
.
C:\Program Files\PacificPoker
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\EBSuggestHistory
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\searchplugins\conduit.xml
C:\Documents and Settings\13\Application Data\PacificPoker
C:\Documents and Settings\13\Cookies\13@atdmt[1].txt
C:\Documents and Settings\13\Cookies\13@bs.serving-sys[1].txt

+-----------------| Sweetim Elements Deleted :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Sweetim
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks\\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKCR\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCR\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
HKCR\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
HKCR\MediaPlayer.GraphicsUtils
HKCR\MediaPlayer.GraphicsUtils.1
HKCR\MgMediaPlayer.GifAnimator
HKCR\MgMediaPlayer.GifAnimator.1
HKCR\SWEETIE.IEToolbar
HKCR\SWEETIE.IEToolbar.1
HKCR\SWEETIE.SWEETIE
HKCR\SWEETIE.SWEETIE.3
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook
HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1
HKCR\Toolbar3.SWEETIE
HKCR\Toolbar3.SWEETIE.1
HKCR\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKCR\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}
HKCR\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}
HKCU\Software\SweetIM
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
HKLM\Software\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{266C7330-C0F4-49E5-8F20-A56F9F822875}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKLM\Software\SweetIM
HKCU\SOFTWARE\Microsoft\Installer\Products\5D72AF385B5242D47B69FD47F2805AFC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
.
C:\WINDOWS\Installer\1e0f987.msi
C:\WINDOWS\Installer\1e0f98c.msi
/!\ NOT DELETED - C:\Program Files\SweetIM
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\searchplugins\sweetim.xml
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
C:\Documents and Settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\SweetIMToolbarData
C:\WINDOWS\Installer\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\Documents and Settings\13\Cookies\13@www.sweetim[2].txt
C:\Documents and Settings\13\Cookies\13@search.sweetim[1].txt
C:\Documents and Settings\13\Cookies\13@sweetim[3].txt
C:\Documents and Settings\13\Cookies\13@sweetim[2].txt

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.

************* /!\ FILE(S)/FOLDER(S) NOT DELETED /!\ *************

"C:\Program Files\SweetIM"

Second run ...

/!\ RESIST ! - "C:\Program Files\SweetIM"

+-----------------| Added Scan:

---- Mozilla FireFox Version 3.0.10 ----

ProfilePath: 9ka9hnr1.default (13)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
(Prefs.js) user_pref("browser.search.selectedEngine", "Google");
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=3&q=");
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.msn.com/");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.10");
(Prefs.js) user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://fr.msn.com/");
.
(Prefs.js) Removed: user_pref("CT2077008.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
(Prefs.js) Removed: user_pref("CT2077008.CTPBaseServerUrl", "hxxp://services.conduit.com/");
(Prefs.js) Removed: user_pref("CT2077008.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=2&q=");
(Prefs.js) Removed: user_pref("CT2077008.Server", "hxxp://users.conduit.com");
(Prefs.js) Removed: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=3&q=");
(Prefs.js) Removed: user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=2&q=");
(Prefs.js) Removed: user_pref("browser.search.defaultenginename", "SweetIM Search");
(Prefs.js) Removed: user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) Removed: user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");
(Prefs.js) Removed: user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
(Prefs.js) Removed: user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
(Prefs.js) Removed: user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
(Prefs.js) Removed: user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
(Prefs.js) Removed: user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
(Prefs.js) Removed: user_pref("sweetim.toolbar.mode.debug", "false");
(Prefs.js) Removed: user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "chrome://browser-region/locale/region.properties");
(Prefs.js) Removed: user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=3&q=");
(Prefs.js) Removed: user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://fr.msn.com/");
(Prefs.js) Removed: user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077008&SearchSource=2&q=");
(Prefs.js) Removed: user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"hxxp://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"hxxp://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
(Prefs.js) Removed: user_pref("sweetim.toolbar.search.history.capacity", "10");
(Prefs.js) Removed: user_pref("sweetim.toolbar.simapp_id", "{BC109927-5281-4912-8116-DFD04D9805B8}");
(Prefs.js) Removed: user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
(Prefs.js) Removed: user_pref("sweetim.toolbar.version", "1.0.0.8");

---- Internet Explorer Version 8.0.6001.18702 ----

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Start Page: hxxp://fr.msn.com/?ocid=iehp

[HKEY_USERS\S-1-5-21-784569582-1608279117-3960356139-1010\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Start Page: hxxp://fr.msn.com/?ocid=iehp

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: hxxp://ieframe.dll/tabswelcome.htm

=========== Suspicious ==========

+---------------------------------------------------------------------------+

38050 Byte(s) - C:\AD-REPORT-SCAN-22.01.2009.LOG
9851 Byte(s) - C:\AD-REPORT-CLEAN-23.01.2009.LOG
16541 Byte(s) - C:\Ad-Report-Scan-14.05.2009.log
15900 Byte(s) - C:\Ad-Report-Clean-14.05.2009.log

19 File(s) - C:\Program Files\Ad-remover\BACKUP
10 File(s) - C:\Program Files\Ad-remover\QUARANTINE

End at: 18:47:10 | 14/05/2009
.
+-----------------| E.O.F
.

fraggle559 · Answer

l'infection date de combien de temps ?
 parce que je ne pourrais pas tout brancher en même temps  pourrais-je en brancher plusieurs en même temps et recommencer avec ceux qui reste après ? 
Est-ce une autre infection précédente ou c'est tout arrive ensemble par msn car si tel est le cas, je n'ai rien brancher depuis mon "attaque"   sur msn.

fraggle559 · Answer

Bonjour,
voici les rapports usbfix. j'ai du en faire 3


############################## [ UsbFix V3.019 # Scan ]

# User : 13 (Administrateurs) # LAURA
# Update on 13/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 09:18:45 | 15/05/2009

# AMD Sempron(tm)   2800+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]

# C:\ # Disque fixe local # 37,26 Go (6,8 Go free) [ACER] # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque amovible
# G:\ # Disque amovible # 3,82 Go (2,89 Go free) # FAT32
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque amovible
# L:\ # Disque amovible # 1,86 Go (136,69 Mo free) # FAT
# M:\ # Disque amovible

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\vVX1000.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\BboxUpdate\BTLiveUpdate.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre # Startup ]

HKCU_Main:  "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:  "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" 
HKCU_Main:  "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp" 
HKCU_Main:  "Start Page Redirect Cache_TIMESTAMP"=hex:0a,b6,ec,aa,04,b5,c9,01 
HKCU_Main:  "Start Page Redirect Cache AcceptLangs"="fr" 
HKCU_Main:  "Window Title"="" 
HKLM_logon: "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon: "DefaultUserName"="13" 
HKLM_logon: "AltDefaultUserName"="13" 
HKLM_logon: "LegalNoticeCaption"="" 
HKLM_logon: "LegalNoticeText"="" 
HKLM_Run:    SoundMan=SOUNDMAN.EXE 
HKLM_Run:    RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" 
HKLM_Run:    DXDllRegExe=dxdllreg.exe 
HKLM_Run:    NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe 
HKLM_Run:    InCD=C:\Program Files\Ahead\InCD\InCD.exe 
HKLM_Run:    PROMT Integrator="C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun 
HKLM_Run:    BluetoothAuthenticationAgent=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
HKLM_Run:    Logitech Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    Symantec PIF AlertEng="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" 
HKLM_Run:    avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min 
HKLM_Run:    Kernel and Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    LifeCam="C:\Program Files\Microsoft LifeCam\LifeExp.exe" 
HKLM_Run:    VX1000=C:\WINDOWS\vVX1000.exe 
HKLM_Run:    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
HKLM_Run:    BboxUpdate=C:\Program Files\BboxUpdate\BTLiveUpdate.exe 
HKLM_Run:    QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    LDM=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe  
HKCU_Run:    MsnMsgr=~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background  
HKCU_Run:    MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background  
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  

################## [ Informations ]


################## [ Fichiers # Dossiers infectieux ]

Found ! G:\autorun.inf  

################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

HKCU\Software\Microsoft\....\MountPoints2\{5c4563d0-e49e-11dd-b57f-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c4563d0-e49e-11dd-b57f-000fead631fe}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\AutoRun\command  

################## [ ! Fin du rapport # UsbFix V3.019 ! ]

fraggle559 · Answer

sur le 1er rapport j'ai branché 4 objets, apparaissent ils tous ?


############################## [ UsbFix V3.019 # Scan ]

# User : 13 (Administrateurs) # LAURA
# Update on 13/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 09:18:45 | 15/05/2009

# AMD Sempron(tm)   2800+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]

# C:\ # Disque fixe local # 37,26 Go (6,8 Go free) [ACER] # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque amovible
# G:\ # Disque amovible # 3,82 Go (2,89 Go free) # FAT32
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque amovible
# L:\ # Disque amovible # 1,86 Go (136,69 Mo free) # FAT
# M:\ # Disque amovible

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\vVX1000.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\BboxUpdate\BTLiveUpdate.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre # Startup ]

HKCU_Main:  "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:  "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" 
HKCU_Main:  "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp" 
HKCU_Main:  "Start Page Redirect Cache_TIMESTAMP"=hex:0a,b6,ec,aa,04,b5,c9,01 
HKCU_Main:  "Start Page Redirect Cache AcceptLangs"="fr" 
HKCU_Main:  "Window Title"="" 
HKLM_logon: "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon: "DefaultUserName"="13" 
HKLM_logon: "AltDefaultUserName"="13" 
HKLM_logon: "LegalNoticeCaption"="" 
HKLM_logon: "LegalNoticeText"="" 
HKLM_Run:    SoundMan=SOUNDMAN.EXE 
HKLM_Run:    RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" 
HKLM_Run:    DXDllRegExe=dxdllreg.exe 
HKLM_Run:    NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe 
HKLM_Run:    InCD=C:\Program Files\Ahead\InCD\InCD.exe 
HKLM_Run:    PROMT Integrator="C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun 
HKLM_Run:    BluetoothAuthenticationAgent=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
HKLM_Run:    Logitech Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    Symantec PIF AlertEng="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" 
HKLM_Run:    avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min 
HKLM_Run:    Kernel and Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    LifeCam="C:\Program Files\Microsoft LifeCam\LifeExp.exe" 
HKLM_Run:    VX1000=C:\WINDOWS\vVX1000.exe 
HKLM_Run:    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
HKLM_Run:    BboxUpdate=C:\Program Files\BboxUpdate\BTLiveUpdate.exe 
HKLM_Run:    QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    LDM=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe  
HKCU_Run:    MsnMsgr=~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background  
HKCU_Run:    MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background  
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  

################## [ Informations ]


################## [ Fichiers # Dossiers infectieux ]

Found ! G:\autorun.inf  

################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

HKCU\Software\Microsoft\....\MountPoints2\{5c4563d0-e49e-11dd-b57f-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c4563d0-e49e-11dd-b57f-000fead631fe}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\AutoRun\command  

################## [ ! Fin du rapport # UsbFix V3.019 ! ]

fraggle559 · Answer

et enfin

############################## [ UsbFix V3.019 # Scan ]

# User : 13 (Administrateurs) # LAURA
# Update on 13/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 09:29:38 | 15/05/2009

# AMD Sempron(tm)   2800+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]

# C:\ # Disque fixe local # 37,26 Go (6,8 Go free) [ACER] # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# L:\ # Disque amovible # 1,84 Go (483,56 Mo free) # FAT

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\vVX1000.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\BboxUpdate\BTLiveUpdate.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre # Startup ]

HKCU_Main:  "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:  "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" 
HKCU_Main:  "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp" 
HKCU_Main:  "Start Page Redirect Cache_TIMESTAMP"=hex:0a,b6,ec,aa,04,b5,c9,01 
HKCU_Main:  "Start Page Redirect Cache AcceptLangs"="fr" 
HKCU_Main:  "Window Title"="" 
HKLM_logon: "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon: "DefaultUserName"="13" 
HKLM_logon: "AltDefaultUserName"="13" 
HKLM_logon: "LegalNoticeCaption"="" 
HKLM_logon: "LegalNoticeText"="" 
HKLM_Run:    SoundMan=SOUNDMAN.EXE 
HKLM_Run:    RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" 
HKLM_Run:    DXDllRegExe=dxdllreg.exe 
HKLM_Run:    NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe 
HKLM_Run:    InCD=C:\Program Files\Ahead\InCD\InCD.exe 
HKLM_Run:    PROMT Integrator="C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun 
HKLM_Run:    BluetoothAuthenticationAgent=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
HKLM_Run:    Logitech Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    Symantec PIF AlertEng="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" 
HKLM_Run:    avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min 
HKLM_Run:    Kernel and Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    LifeCam="C:\Program Files\Microsoft LifeCam\LifeExp.exe" 
HKLM_Run:    VX1000=C:\WINDOWS\vVX1000.exe 
HKLM_Run:    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
HKLM_Run:    BboxUpdate=C:\Program Files\BboxUpdate\BTLiveUpdate.exe 
HKLM_Run:    QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    LDM=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe  
HKCU_Run:    MsnMsgr=~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background  
HKCU_Run:    MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background  
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  

################## [ Informations ]


################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\AutoRun\command  

################## [ ! Fin du rapport # UsbFix V3.019 ! ]

fraggle559 · Answer

Bonjour,
peux tu me dire les quels ou dois-je tous les branchés comme pour le scan ?

fraggle559 · Answer

Bonjour,
Voici les rapports après suppression ubfix


############################## [ UsbFix V3.019 # Cleaning ]

# User : 13 (Administrateurs) # LAURA
# Update on 13/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 12:59:29 | 16/05/2009

# AMD Sempron(tm)   2800+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ Enabled | Updated ]

# C:\ # Disque fixe local # 37,26 Go (6,59 Go free) [ACER] # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM # 5,57 Mo (0 Mo free) [U3 System] # CDFS
# G:\ # Disque amovible # 1,9 Go (1,81 Go free) # FAT
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque amovible
# O:\ # Disque amovible # 1,84 Go (483,56 Mo free) # FAT

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe

################## [ Fichiers # Dossiers infectieux ]

(!) Not Deleted ! F:\autorun.inf   

################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\Auto\command   
Deleted ! HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\Auto\command   

################## [ Listing des fichiers présent ]

[20/04/2004 11:31|--a------|5] - C:\xpsp2.id
[20/04/2004 11:31|--a------|5] - C:\flag.id
[20/04/2004 11:31|--a------|5] - C:\fr.id
[?|?|?] - C:\pagefile.sys
[15/03/1998 10:30|--a------|81920] - C:\bivbx11.dll
[27/09/1993 10:17|-r-------|50784] - C:\mhcl200.vbx
[21/09/1993 17:30|-r-------|58192] - C:\mhrun300.dll
[27/12/2006 19:02|--ah-----|8628] - C:\chiffres.GID
[18/04/2005 15:38|---hs----|78] - C:\BOOTLOG.TXT
[27/08/1995 13:19|--a------|11912] - C:\chiffres.hlp
[29/07/1998 19:39|--a------|47384] - C:\katalog.hlp
[07/03/2007 20:11|--ah-----|8628] - C:\katalog.GID
[18/04/2005 15:38|---hs----|512] - C:\BOOTSECT.DOS
[13/04/2009 19:27|--a------|1506] - C:\error.log
[12/07/2007 12:41|--a------|90] - C:\Setup.log
[28/03/2009 14:03|--ah-----|244] - C:\sqmnoopt00.sqm
[?|?|?] - C:\hiberfil.sys
[25/12/2007 19:40|--a------|186] - C:\picsetup.log
[05/08/2004 05:00|-rahs----|4952] - C:\Bootfont.bin
[09/04/2009 09:38|-rahs----|252240] - C:
tldr
[05/08/2004 05:00|-rahs----|47564] - C:\NTDETECT.COM
[28/03/2009 14:03|--ah-----|268] - C:\sqmdata00.sqm
[12/04/2009 17:04|--a------|0] - C:\conmgr.log
[25/02/2009 16:16|--a------|230424] - C:\img2-001.raw
[04/07/2005 17:54|-rahs----|216] - C:\boot.ini
[09/04/2004 16:42|--a------|0] - C:\AUTOEXEC.BAT
[09/04/2004 16:22|--a------|0] - C:\CONFIG.SYS
[23/04/1999 22:22|-r-hs----|0] - C:\IO.SYS
[18/04/2005 15:29|-r-hs----|0] - C:\MSDOS.SYS
[15/09/2008 01:56|--ah-----|172] - C:\sqmnoopt01.sqm
[15/09/2008 01:56|--ah-----|172] - C:\sqmdata01.sqm
[09/08/2007 16:02|--a------|44545] - C:\playground.log
[15/09/2008 07:51|--ah-----|244] - C:\sqmnoopt02.sqm
[15/09/2008 07:51|--ah-----|268] - C:\sqmdata02.sqm
[15/09/2008 13:28|--ah-----|244] - C:\sqmnoopt04.sqm
[15/09/2008 13:28|--ah-----|268] - C:\sqmdata04.sqm
[15/09/2008 11:09|--ah-----|208] - C:\sqmdata03.sqm
[18/04/2005 16:06|--a------|171] - C:\iv5setup.log
[15/09/2008 11:09|--ah-----|172] - C:\sqmnoopt03.sqm
[15/09/2008 13:32|--ah-----|244] - C:\sqmnoopt05.sqm
[15/09/2008 13:32|--ah-----|268] - C:\sqmdata05.sqm
[18/09/2008 23:36|--ah-----|268] - C:\sqmdata07.sqm
[16/09/2008 00:38|--ah-----|244] - C:\sqmnoopt06.sqm
[16/09/2008 00:38|--ah-----|268] - C:\sqmdata06.sqm
[18/09/2008 23:36|--ah-----|244] - C:\sqmnoopt07.sqm
[19/09/2008 17:58|--ah-----|244] - C:\sqmnoopt08.sqm
[19/09/2008 17:58|--ah-----|268] - C:\sqmdata08.sqm
[19/09/2008 22:31|--ah-----|244] - C:\sqmnoopt09.sqm
[19/09/2008 22:31|--ah-----|268] - C:\sqmdata09.sqm
[21/09/2008 00:02|--ah-----|244] - C:\sqmnoopt10.sqm
[21/09/2008 00:02|--ah-----|268] - C:\sqmdata10.sqm
[21/09/2008 10:16|--ah-----|244] - C:\sqmnoopt11.sqm
[21/09/2008 10:16|--ah-----|268] - C:\sqmdata11.sqm
[20/10/2008 09:37|--ah-----|244] - C:\sqmnoopt12.sqm
[20/10/2008 09:37|--ah-----|268] - C:\sqmdata12.sqm
[05/11/2008 19:32|--ah-----|244] - C:\sqmnoopt13.sqm
[05/11/2008 19:32|--ah-----|268] - C:\sqmdata13.sqm
[21/11/2008 18:13|--ah-----|268] - C:\sqmdata15.sqm
[21/11/2008 18:12|--ah-----|244] - C:\sqmnoopt14.sqm
[21/11/2008 18:12|--ah-----|232] - C:\sqmdata14.sqm
[21/11/2008 18:13|--ah-----|244] - C:\sqmnoopt15.sqm
[21/11/2008 18:13|--ah-----|172] - C:\sqmnoopt16.sqm
[21/11/2008 18:13|--ah-----|172] - C:\sqmdata16.sqm
[17/02/2009 16:02|--ah-----|244] - C:\sqmnoopt17.sqm
[17/02/2009 16:02|--ah-----|268] - C:\sqmdata17.sqm
[25/02/2009 16:16|--ah-----|244] - C:\sqmnoopt18.sqm
[25/02/2009 16:16|--ah-----|268] - C:\sqmdata18.sqm
[26/02/2009 08:53|--ah-----|244] - C:\sqmnoopt19.sqm
[26/02/2009 08:53|--ah-----|268] - C:\sqmdata19.sqm
[05/01/2009 16:06|--a------|0] - C:\LOG2.tmp
[05/01/2009 16:06|--a------|475] - C:\LOG2.log
[05/01/2009 16:21|--a------|0] - C:\LOG3.tmp
[18/04/2005 17:00|--a------|48] - C:\AVVirus.log
[18/04/2005 17:00|--a------|48] - C:\AVApp.log
[18/04/2005 17:00|--a------|48] - C:\AVError.log
[05/01/2009 16:21|--a------|475] - C:\LOG3.log
[08/02/2009 11:01|--a------|0] - C:\LOG76E.tmp
[08/02/2009 11:01|--a------|475] - C:\LOG76E.log
[08/02/2009 11:07|--a------|0] - C:\LOG770.tmp
[22/01/2009 11:08|--a------|38050] - C:\AD-REPORT-SCAN-22.01.2009.LOG
[23/01/2009 09:52|--a------|9851] - C:\AD-REPORT-CLEAN-23.01.2009.LOG
[08/02/2009 11:07|--a------|475] - C:\LOG770.log
[08/02/2009 11:10|--a------|0] - C:\LOG774.tmp
[27/01/2009 16:16|--a------|84244846] - C:\Sauv.reg
[27/01/2009 16:17|--a------|1171] - C:\TCleaner.txt
[08/02/2009 11:10|--a------|475] - C:\LOG774.log
[08/02/2009 11:38|--a------|0] - C:\LOG775.tmp
[08/02/2009 11:38|--a------|475] - C:\LOG775.log
[08/02/2009 17:12|--a------|0] - C:\LOG86E.tmp
[08/02/2009 17:12|--a------|475] - C:\LOG86E.log
[21/02/2009 14:14|--a------|0] - C:\LOG136.tmp
[21/02/2009 14:14|--a------|475] - C:\LOG136.log
[21/02/2009 14:18|--a------|0] - C:\LOG137.tmp
[21/02/2009 14:18|--a------|475] - C:\LOG137.log
[22/02/2009 01:06|--a------|0] - C:\LOG2C8.tmp
[22/02/2009 01:06|--a------|475] - C:\LOG2C8.log
[22/02/2009 01:25|--a------|0] - C:\LOG2DE.tmp
[22/02/2009 01:25|--a------|475] - C:\LOG2DE.log
[22/02/2009 11:19|--a------|0] - C:\LOG2D.tmp
[22/02/2009 11:19|--a------|475] - C:\LOG2D.log
[02/03/2009 13:18|--a------|0] - C:\LOGCE.tmp
[02/03/2009 13:18|--a------|475] - C:\LOGCE.log
[02/03/2009 16:53|--a------|0] - C:\LOG5.tmp
[02/03/2009 16:53|--a------|475] - C:\LOG5.log
[02/03/2009 17:14|--a------|0] - C:\LOG1B.tmp
[02/03/2009 17:14|--a------|475] - C:\LOG1B.log
[14/05/2009 16:02|--a------|16541] - C:\Ad-Report-Scan-14.05.2009.log
[14/05/2009 18:47|--a------|16121] - C:\Ad-Report-Clean-14.05.2009.log
[16/05/2009 13:00|--a------|7997] - C:\UsbFix.txt
[15/05/2009 09:24|--a------|0] - C:\LOG4D.tmp
[15/05/2009 09:24|--a------|475] - C:\LOG4D.log
[16/05/2009 12:56|--a------|0] - C:\LOGB6F.tmp
[16/05/2009 12:56|--a------|475] - C:\LOGB6F.log
[28/06/2007 15:21|-r-------|277] - F:\autorun.inf
[29/08/2007 13:29|-r-------|1131832] - F:\LaunchU3.exe
[29/08/2007 13:30|-r-------|4654626] - F:\LaunchPad.zip
[29/08/2007 13:29|-ra------|1131832] - G:\LaunchU3.exe
[24/04/2008 17:07|--a------|1410048] - O:\_DS_MENU.DAT
[18/07/2007 15:41|--a------|497728] - O:\_DS_MSHL.NDS
[10/12/2008 07:49|--a------|4194304] - O:\_DS_MENU.SYS

################## [ Vaccination ]

# C:\autorun.inf -> Folder created by UsbFix.  
# G:\autorun.inf -> Folder created by UsbFix.  
# O:\autorun.inf -> Folder created by UsbFix.  

################## [ Cracks / Keygens / Serials ]

# -> Nothing found !  

################## [ ! Fin du rapport # UsbFix V3.019 ! ]

fraggle559 · Answer

rapport 2


############################## [ UsbFix V3.019 # Cleaning ]

# User : 13 (Administrateurs) # LAURA
# Update on 13/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 13:06:17 | 16/05/2009

# AMD Sempron(tm)   2800+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ Enabled | Updated ]

# C:\ # Disque fixe local # 37,26 Go (6,59 Go free) [ACER] # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# K:\ # Disque amovible
# L:\ # Disque amovible
# O:\ # Disque amovible # 1,86 Go (136,69 Mo free) # FAT

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

# -> Not Found !  

################## [ Listing des fichiers présent ]

[20/04/2004 11:31|--a------|5] - C:\xpsp2.id
[20/04/2004 11:31|--a------|5] - C:\flag.id
[20/04/2004 11:31|--a------|5] - C:\fr.id
[?|?|?] - C:\pagefile.sys
[15/03/1998 10:30|--a------|81920] - C:\bivbx11.dll
[27/09/1993 10:17|-r-------|50784] - C:\mhcl200.vbx
[21/09/1993 17:30|-r-------|58192] - C:\mhrun300.dll
[27/12/2006 19:02|--ah-----|8628] - C:\chiffres.GID
[18/04/2005 15:38|---hs----|78] - C:\BOOTLOG.TXT
[27/08/1995 13:19|--a------|11912] - C:\chiffres.hlp
[29/07/1998 19:39|--a------|47384] - C:\katalog.hlp
[07/03/2007 20:11|--ah-----|8628] - C:\katalog.GID
[18/04/2005 15:38|---hs----|512] - C:\BOOTSECT.DOS
[13/04/2009 19:27|--a------|1506] - C:\error.log
[12/07/2007 12:41|--a------|90] - C:\Setup.log
[28/03/2009 14:03|--ah-----|244] - C:\sqmnoopt00.sqm
[?|?|?] - C:\hiberfil.sys
[25/12/2007 19:40|--a------|186] - C:\picsetup.log
[05/08/2004 05:00|-rahs----|4952] - C:\Bootfont.bin
[09/04/2009 09:38|-rahs----|252240] - C:
tldr
[05/08/2004 05:00|-rahs----|47564] - C:\NTDETECT.COM
[28/03/2009 14:03|--ah-----|268] - C:\sqmdata00.sqm
[12/04/2009 17:04|--a------|0] - C:\conmgr.log
[25/02/2009 16:16|--a------|230424] - C:\img2-001.raw
[04/07/2005 17:54|-rahs----|216] - C:\boot.ini
[09/04/2004 16:42|--a------|0] - C:\AUTOEXEC.BAT
[09/04/2004 16:22|--a------|0] - C:\CONFIG.SYS
[23/04/1999 22:22|-r-hs----|0] - C:\IO.SYS
[18/04/2005 15:29|-r-hs----|0] - C:\MSDOS.SYS
[15/09/2008 01:56|--ah-----|172] - C:\sqmnoopt01.sqm
[15/09/2008 01:56|--ah-----|172] - C:\sqmdata01.sqm
[09/08/2007 16:02|--a------|44545] - C:\playground.log
[15/09/2008 07:51|--ah-----|244] - C:\sqmnoopt02.sqm
[15/09/2008 07:51|--ah-----|268] - C:\sqmdata02.sqm
[15/09/2008 13:28|--ah-----|244] - C:\sqmnoopt04.sqm
[15/09/2008 13:28|--ah-----|268] - C:\sqmdata04.sqm
[15/09/2008 11:09|--ah-----|208] - C:\sqmdata03.sqm
[18/04/2005 16:06|--a------|171] - C:\iv5setup.log
[15/09/2008 11:09|--ah-----|172] - C:\sqmnoopt03.sqm
[15/09/2008 13:32|--ah-----|244] - C:\sqmnoopt05.sqm
[15/09/2008 13:32|--ah-----|268] - C:\sqmdata05.sqm
[18/09/2008 23:36|--ah-----|268] - C:\sqmdata07.sqm
[16/09/2008 00:38|--ah-----|244] - C:\sqmnoopt06.sqm
[16/09/2008 00:38|--ah-----|268] - C:\sqmdata06.sqm
[18/09/2008 23:36|--ah-----|244] - C:\sqmnoopt07.sqm
[19/09/2008 17:58|--ah-----|244] - C:\sqmnoopt08.sqm
[19/09/2008 17:58|--ah-----|268] - C:\sqmdata08.sqm
[19/09/2008 22:31|--ah-----|244] - C:\sqmnoopt09.sqm
[19/09/2008 22:31|--ah-----|268] - C:\sqmdata09.sqm
[21/09/2008 00:02|--ah-----|244] - C:\sqmnoopt10.sqm
[21/09/2008 00:02|--ah-----|268] - C:\sqmdata10.sqm
[21/09/2008 10:16|--ah-----|244] - C:\sqmnoopt11.sqm
[21/09/2008 10:16|--ah-----|268] - C:\sqmdata11.sqm
[20/10/2008 09:37|--ah-----|244] - C:\sqmnoopt12.sqm
[20/10/2008 09:37|--ah-----|268] - C:\sqmdata12.sqm
[05/11/2008 19:32|--ah-----|244] - C:\sqmnoopt13.sqm
[05/11/2008 19:32|--ah-----|268] - C:\sqmdata13.sqm
[21/11/2008 18:13|--ah-----|268] - C:\sqmdata15.sqm
[21/11/2008 18:12|--ah-----|244] - C:\sqmnoopt14.sqm
[21/11/2008 18:12|--ah-----|232] - C:\sqmdata14.sqm
[21/11/2008 18:13|--ah-----|244] - C:\sqmnoopt15.sqm
[21/11/2008 18:13|--ah-----|172] - C:\sqmnoopt16.sqm
[21/11/2008 18:13|--ah-----|172] - C:\sqmdata16.sqm
[17/02/2009 16:02|--ah-----|244] - C:\sqmnoopt17.sqm
[17/02/2009 16:02|--ah-----|268] - C:\sqmdata17.sqm
[25/02/2009 16:16|--ah-----|244] - C:\sqmnoopt18.sqm
[25/02/2009 16:16|--ah-----|268] - C:\sqmdata18.sqm
[26/02/2009 08:53|--ah-----|244] - C:\sqmnoopt19.sqm
[26/02/2009 08:53|--ah-----|268] - C:\sqmdata19.sqm
[05/01/2009 16:06|--a------|0] - C:\LOG2.tmp
[05/01/2009 16:06|--a------|475] - C:\LOG2.log
[05/01/2009 16:21|--a------|0] - C:\LOG3.tmp
[18/04/2005 17:00|--a------|48] - C:\AVVirus.log
[18/04/2005 17:00|--a------|48] - C:\AVApp.log
[18/04/2005 17:00|--a------|48] - C:\AVError.log
[05/01/2009 16:21|--a------|475] - C:\LOG3.log
[08/02/2009 11:01|--a------|0] - C:\LOG76E.tmp
[08/02/2009 11:01|--a------|475] - C:\LOG76E.log
[08/02/2009 11:07|--a------|0] - C:\LOG770.tmp
[22/01/2009 11:08|--a------|38050] - C:\AD-REPORT-SCAN-22.01.2009.LOG
[23/01/2009 09:52|--a------|9851] - C:\AD-REPORT-CLEAN-23.01.2009.LOG
[08/02/2009 11:07|--a------|475] - C:\LOG770.log
[08/02/2009 11:10|--a------|0] - C:\LOG774.tmp
[27/01/2009 16:16|--a------|84244846] - C:\Sauv.reg
[27/01/2009 16:17|--a------|1171] - C:\TCleaner.txt
[08/02/2009 11:10|--a------|475] - C:\LOG774.log
[08/02/2009 11:38|--a------|0] - C:\LOG775.tmp
[08/02/2009 11:38|--a------|475] - C:\LOG775.log
[08/02/2009 17:12|--a------|0] - C:\LOG86E.tmp
[08/02/2009 17:12|--a------|475] - C:\LOG86E.log
[21/02/2009 14:14|--a------|0] - C:\LOG136.tmp
[21/02/2009 14:14|--a------|475] - C:\LOG136.log
[21/02/2009 14:18|--a------|0] - C:\LOG137.tmp
[21/02/2009 14:18|--a------|475] - C:\LOG137.log
[22/02/2009 01:06|--a------|0] - C:\LOG2C8.tmp
[22/02/2009 01:06|--a------|475] - C:\LOG2C8.log
[22/02/2009 01:25|--a------|0] - C:\LOG2DE.tmp
[22/02/2009 01:25|--a------|475] - C:\LOG2DE.log
[22/02/2009 11:19|--a------|0] - C:\LOG2D.tmp
[22/02/2009 11:19|--a------|475] - C:\LOG2D.log
[02/03/2009 13:18|--a------|0] - C:\LOGCE.tmp
[02/03/2009 13:18|--a------|475] - C:\LOGCE.log
[02/03/2009 16:53|--a------|0] - C:\LOG5.tmp
[02/03/2009 16:53|--a------|475] - C:\LOG5.log
[02/03/2009 17:14|--a------|0] - C:\LOG1B.tmp
[02/03/2009 17:14|--a------|475] - C:\LOG1B.log
[14/05/2009 16:02|--a------|16541] - C:\Ad-Report-Scan-14.05.2009.log
[14/05/2009 18:47|--a------|16121] - C:\Ad-Report-Clean-14.05.2009.log
[15/05/2009 09:24|--a------|0] - C:\LOG4D.tmp
[15/05/2009 09:24|--a------|475] - C:\LOG4D.log
[16/05/2009 12:56|--a------|0] - C:\LOGB6F.tmp
[16/05/2009 12:56|--a------|475] - C:\LOGB6F.log
[16/05/2009 13:07|--a------|7852] - C:\UsbFix.txt
[24/04/2008 17:07|--a------|1410048] - O:\_DS_MENU.DAT
[21/03/2009 15:43|--a------|4194304] - O:\_DS_MENU.SYS

################## [ Vaccination ]

# C:\autorun.inf -> Folder created by UsbFix.  
# O:\autorun.inf -> Folder created by UsbFix.  

################## [ Cracks / Keygens / Serials ]

# -> Nothing found !  

################## [ ! Fin du rapport # UsbFix V3.019 ! ]

fraggle559 · Answer

Et enfin 


############################## [ UsbFix V3.019 # Scan ]

# User : 13 (Administrateurs) # LAURA
# Update on 13/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 09:29:38 | 15/05/2009

# AMD Sempron(tm)   2800+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ (!) Disabled | Updated ]

# C:\ # Disque fixe local # 37,26 Go (6,8 Go free) [ACER] # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque amovible
# H:\ # Disque amovible
# I:\ # Disque amovible
# J:\ # Disque amovible
# L:\ # Disque amovible # 1,84 Go (483,56 Mo free) # FAT

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\vVX1000.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\BboxUpdate\BTLiveUpdate.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre # Startup ]

HKCU_Main:  "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:  "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" 
HKCU_Main:  "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp" 
HKCU_Main:  "Start Page Redirect Cache_TIMESTAMP"=hex:0a,b6,ec,aa,04,b5,c9,01 
HKCU_Main:  "Start Page Redirect Cache AcceptLangs"="fr" 
HKCU_Main:  "Window Title"="" 
HKLM_logon: "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon: "DefaultUserName"="13" 
HKLM_logon: "AltDefaultUserName"="13" 
HKLM_logon: "LegalNoticeCaption"="" 
HKLM_logon: "LegalNoticeText"="" 
HKLM_Run:    SoundMan=SOUNDMAN.EXE 
HKLM_Run:    RemoteControl="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" 
HKLM_Run:    DXDllRegExe=dxdllreg.exe 
HKLM_Run:    NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe 
HKLM_Run:    InCD=C:\Program Files\Ahead\InCD\InCD.exe 
HKLM_Run:    PROMT Integrator="C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun 
HKLM_Run:    BluetoothAuthenticationAgent=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
HKLM_Run:    Logitech Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    Symantec PIF AlertEng="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" 
HKLM_Run:    avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min 
HKLM_Run:    Kernel and Hardware Abstraction Layer=KHALMNPR.EXE 
HKLM_Run:    LifeCam="C:\Program Files\Microsoft LifeCam\LifeExp.exe" 
HKLM_Run:    VX1000=C:\WINDOWS\vVX1000.exe 
HKLM_Run:    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
HKLM_Run:    BboxUpdate=C:\Program Files\BboxUpdate\BTLiveUpdate.exe 
HKLM_Run:    QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    LDM=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe  
HKCU_Run:    MsnMsgr=~"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background  
HKCU_Run:    MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background  
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  

################## [ Informations ]


################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{5c4563d2-e49e-11dd-b57f-000fead631fe}\Shell\AutoRun\command  
HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\Auto\command  
HKCU\Software\Microsoft\....\MountPoints2\{cefb4374-2802-11de-b5d1-000fead631fe}\Shell\AutoRun\command  

################## [ ! Fin du rapport # UsbFix V3.019 ! ]

fraggle559 · Answer

voici le rapport rsit, par contre, il ne m'a pas sorti de info.txt.
a la racine, je ne trouve que l'info txt du 14.05.09
Logfile of random's system information tool 1.06 (written by random/random)
Run by 13 at 2009-05-16 14:03:35
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 7 GB (18%) free of 38 GB
Total RAM: 735 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:03:40, on 16/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\BboxUpdate\BTLiveUpdate.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32undll32.exe
C:\Documents and Settings\13\Bureau\RSIT.exe
C:\Program Files	rend micro\13.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [PROMT Integrator] "C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BboxUpdate] C:\Program Files\BboxUpdate\BTLiveUpdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\ADOBE\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7" -"http://www8.agame.com/..."
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2a22063e1a6841fa860803837843fbd1
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2a22063e1a6841fa860803837843fbd1
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.acer.com/worldwide/selection.html
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - AppInit_DLLs: ixrhij.dll ofpfdj.dll  , 
O20 - Winlogon Notify: vtUkihHB - vtUkihHB.dll (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

fraggle559 · Answer

au sujet de sp3, l'ordinateur l'avait mis à jour je croyais d'ailleurs que je l'avais. Si je vérifie dans mes points de restauration, il m'affiche le pack 3 le 26 avril  et le 3 mai. 
Je devrai donc l'avoir. J'ai été étonné de ne plus le trouver dans mes scans
Que faut il faire ?
D'ailleurs il y avait eu une mise à jour le 17 avril qui s'était soldé par une mise en panne de certains programmes excel surtout.

fraggle559 · Answer

pourquoi désinstaller norton ?
 Il est vrai que je ne l'utilise pas mais il était présent lorsque j'ai eu l'ordinateur

fraggle559 · Answer

ok
je pense que antivir est mieux que norton n'est ce pas ?

fraggle559 · Answer

Voila j'ai désinstaller norton.
la désinfection est elle terminée ?
Qu'est ce qu'une infection vundo ?

fraggle559 · Answer

Bizare, 
Dans tous les programmes, l'ordinateur affiche toujours norton antivirus.
Comment cela se fait il ?

fraggle559 · Answer

le programme est toujours présent dans "ajout/suppression de programme" Est ce que je peux réessayer par ce chemin pour l'enlever ?

fraggle559 · Answer

oups avait pas vu ton message. le pc a fait son redémarrage tous seul pourtant. alors je le redémarre encore et je revérifie. ensuite on verra pour combofix

fraggle559 · Answer

non je confirme norton n'est pas désinstaller même après ce 2eme démarrage du pc. je le fais directement dans ajout/suppression ?

fraggle559 · Answer

ok a ce soir merci.
Je vais désinstaller norton manuellement.

fraggle559 · Answer

bonjour

Dois-je passer combofix ?

Utilisateur anonyme · Answer

je verrai cela ce soir car je dois partir

fraggle559 · Answer

ok


je vais essayer de le faire pour ce soir, tu pourras l'analyser. mais je serai absente ce soir.merci.
j'espère m'en sortir avec la console de récupération.

fraggle559 · Answer

je ne sais pas comment désactiver malwarebytes est il en fonction quand je ne le démarre pas ?

fraggle559 · Answer

J'ai enfin eu le temps de passer combofix. 

Avant, je voudrais savoir, j'ai une liste de 69 infections en quarantaine dans antimalwarebytes même après le passage de combofix. Que dois-je en faire ? Les laisser ? les supprimer ? Je n'ai peut être pas bien utilisé malwarebytes ?


voilà le rapport COMBOFIX

ComboFix 09-05-19.08 - 13 20/05/2009 14:15.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.33.1036.18.735.459 [GMT 2:00]
Lancé depuis: c:\documents and settings\13\Bureau\jacobin.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\13\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\13\Local Settings\Temp\IadHide5.dll
c:\windows\N039_jpg.zip
c:\windows\system32\bajgntid.ini
c:\windows\system32\bcbrwqwb.ini
c:\windows\system32\Microsoft\backup.ftp
c:\windows\system32\Microsoft\backup.tftp
c:\windows\system32\qebeoiqu.ini
c:\windows\system32\uysrbwur.ini
c:\windows\system32\xkrmdkyv.ini
c:\windows\Tasks\hpptazlh.job

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PERFORMANCE_MONITOR
-------\Legacy_USERINIT_LOGON_APPLICATION


(((((((((((((((((((((((((((((   Fichiers créés du 2009-04-20 au 2009-05-20  ))))))))))))))))))))))))))))))))))))
.

2009-05-16 13:17 . 2009-05-16 13:17	--------	d-----w	c:\documents and settings\All Users\Application Data\NortonInstaller
2009-05-15 07:17 . 2009-05-15 07:17	--------	d-----w	C:\UsbFix
2009-05-14 13:34 . 2009-05-14 13:34	--------	d-----w	c:\program files\Ad-remover
2009-05-14 13:07 . 2009-05-14 13:07	--------	d-----w	C:sit
2009-05-07 17:45 . 2009-05-07 17:45	--------	d-----w	c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-05-05 07:58 . 2009-05-05 07:58	--------	d-----w	c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-04 06:54 . 2009-05-04 06:54	--------	d-----w	c:\documents and settings\13\Local Settings\Application Data\Apple
2009-05-04 06:54 . 2009-05-04 06:54	--------	d-----w	c:\program files\Apple Software Update
2009-05-04 06:54 . 2009-05-04 06:54	--------	d-----w	c:\documents and settings\All Users\Application Data\Apple
2009-04-28 17:57 . 2009-04-28 17:57	--------	d-----w	c:\documents and settings\13\Local Settings\Application Data\Apple Computer
2009-04-22 12:05 . 2009-04-22 12:05	--------	d-----w	c:\windows\InCD

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 12:16 . 2006-12-24 22:52	12	----a-w	c:\windows\bthservsdp.dat
2009-05-16 10:56 . 2009-05-16 10:56	0	----a-w	C:\LOGB6F.tmp
2009-05-15 07:24 . 2009-05-15 07:24	0	----a-w	C:\LOG4D.tmp
2009-04-26 08:54 . 2009-04-18 08:29	3240	----a-w	c:\windows\system32\PerfStringBackup.TMP
2009-04-26 08:54 . 1979-12-31 22:00	75562	----a-w	c:\windows\system32\perfc00C.dat
2009-04-26 08:54 . 1979-12-31 22:00	468828	----a-w	c:\windows\system32\perfh00C.dat
2009-04-20 09:15 . 2009-04-20 09:15	--------	d-----w	c:\program files\Fichiers communs\Nero
2009-04-12 15:20 . 2009-04-12 15:21	5632	----a-w	c:\windows\system32\drivers\StarOpen.sys
2009-04-10 17:20 . 2009-04-10 17:20	--------	d-----w	c:\program files\Kellogg's Asie
2009-04-10 12:05 . 2009-04-10 12:05	--------	d-----w	c:\program files\Bbox
2009-04-09 08:43 . 2006-05-12 16:24	32304	----a-w	c:\documents and settings\13\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-06 13:32 . 2009-01-22 07:27	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 13:32 . 2009-01-22 07:27	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-04-03 18:55 . 2009-04-03 18:55	--------	d-----w	c:\program files\Microsoft Silverlight
2009-04-03 13:47 . 2009-04-03 13:47	--------	d-----w	c:\program files\BboxUpdate
2009-04-01 14:51 . 2009-04-01 14:51	--------	d-----w	c:\program files\Techcity
2009-03-23 08:30 . 2009-03-23 08:30	--------	d-----w	c:\program files\Microsoft Sync Framework
2009-03-23 08:14 . 2009-03-23 08:14	--------	d-----w	c:\program files\Fichiers communs\Windows Live
2009-03-08 12:22 . 2009-03-08 12:22	1241088	----a-w	c:\windows\system32\SET10E.tmp
2009-03-08 12:21 . 2009-03-08 12:21	10240	------w	c:\windows\system32\SETFD.tmp
2009-03-08 12:09 . 2009-03-08 12:09	391536	------w	c:\windows\system32\SET10B.tmp
2009-03-08 02:41 . 2009-03-08 02:41	5937152	----a-w	c:\windows\system32\SET120.tmp
2009-03-08 02:39 . 2009-03-08 02:39	11063808	----a-w	c:\windows\system32\SET10D.tmp
2009-03-08 02:35 . 2009-03-08 02:35	385024	----a-w	c:\windows\system32\SET101.tmp
2009-03-08 02:34 . 1979-12-31 22:00	914944	----a-w	c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2009-03-08 02:34	1206784	----a-w	c:\windows\system32\SET12D.tmp
2009-03-08 02:34 . 2009-03-08 02:34	1469440	------w	c:\windows\system32\SET116.tmp
2009-03-08 02:34 . 2009-03-08 02:34	236544	----a-w	c:\windows\system32\SET12F.tmp
2009-03-08 02:34 . 2009-03-08 02:34	208384	------w	c:\windows\system32\SET130.tmp
2009-03-08 02:34 . 2009-03-08 02:34	43008	----a-w	c:\windows\system32\SET11A.tmp
2009-03-08 02:34 . 1979-12-31 22:00	43008	----a-w	c:\windows\system32\licmgr10.dll
2009-03-08 02:34 . 2009-03-08 02:34	105984	----a-w	c:\windows\system32\SET12C.tmp
2009-03-08 02:34 . 2009-03-08 02:34	193536	------w	c:\windows\system32\SET126.tmp
2009-03-08 02:34 . 2009-03-08 02:34	109568	------w	c:\windows\system32\SET129.tmp
2009-03-08 02:33 . 2009-03-08 02:33	18944	------w	c:\windows\system32\SETFE.tmp
2009-03-08 02:33 . 1979-12-31 22:00	18944	----a-w	c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2009-03-08 02:33	25600	------w	c:\windows\system32\SET119.tmp
2009-03-08 02:33 . 2009-03-08 02:33	726528	----a-w	c:\windows\system32\SET118.tmp
2009-03-08 02:33 . 2009-03-08 02:33	229376	------w	c:\windows\system32\SET107.tmp
2009-03-08 02:33 . 2009-03-08 02:33	420352	----a-w	c:\windows\system32\SET12E.tmp
2009-03-08 02:33 . 1979-12-31 22:00	420352	----a-w	c:\windows\system32\vbscript.dll
2009-03-08 02:33 . 2009-03-08 02:33	125952	------w	c:\windows\system32\SET106.tmp
2009-03-08 02:32 . 2009-03-08 02:32	72704	----a-w	c:\windows\system32\SETFB.tmp
2009-03-08 02:32 . 1979-12-31 22:00	72704	----a-w	c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2009-03-08 02:32	173056	------w	c:\windows\system32\SET103.tmp
2009-03-08 02:32 . 2009-03-08 02:32	163840	------w	c:\windows\system32\SET108.tmp
2009-03-08 02:32 . 2009-03-08 02:32	71680	----a-w	c:\windows\system32\SET112.tmp
2009-03-08 02:32 . 2009-03-08 02:32	55808	------w	c:\windows\system32\SET110.tmp
2009-03-08 02:32 . 1979-12-31 22:00	71680	----a-w	c:\windows\system32\iesetup.dll
2009-03-08 02:32 . 2009-03-08 02:32	128512	----a-w	c:\windows\system32\SETFC.tmp
2009-03-08 02:32 . 2009-03-08 02:32	94720	----a-w	c:\windows\system32\SET117.tmp
2009-03-08 02:32 . 2009-03-08 02:32	594432	----a-w	c:\windows\system32\SET11B.tmp
2009-03-08 02:32 . 2009-03-08 02:32	1985024	----a-w	c:\windows\system32\SET111.tmp
2009-03-08 02:32 . 2009-03-08 02:32	611840	------w	c:\windows\system32\SET128.tmp
2009-03-08 02:30 . 2009-03-08 02:30	66560	----a-w	c:\windows\system32\SET12B.tmp
2009-03-08 02:22 . 2009-03-08 02:22	164352	------w	c:\windows\system32\SET113.tmp
2009-03-08 02:22 . 2009-03-08 02:22	156160	----a-w	c:\windows\system32\SET125.tmp
2009-03-08 02:22 . 1979-12-31 22:00	156160	----a-w	c:\windows\system32\msls31.dll
2009-03-08 02:15 . 2009-03-08 02:15	57667	----a-w	c:\windows\system32\SET114.tmp
2009-03-08 02:11 . 2009-03-08 02:11	445952	----a-w	c:\windows\system32\SET10A.tmp
2009-03-06 14:46 . 1979-12-31 22:00	286208	----a-w	c:\windows\system32\pdh.dll
2009-03-02 15:14 . 2009-03-02 15:14	0	----a-w	C:\LOG1B.tmp
2009-03-02 14:53 . 2009-03-02 14:53	0	----a-w	C:\LOG5.tmp
2009-03-02 11:18 . 2009-03-02 11:18	0	----a-w	C:\LOGCE.tmp
2009-02-22 09:19 . 2009-02-22 09:19	0	----a-w	C:\LOG2D.tmp
2009-02-21 23:25 . 2009-02-21 23:25	0	----a-w	C:\LOG2DE.tmp
2009-02-21 23:06 . 2009-02-21 23:06	0	----a-w	C:\LOG2C8.tmp
2009-02-21 12:18 . 2009-02-21 12:18	0	----a-w	C:\LOG137.tmp
2009-02-21 12:14 . 2009-02-21 12:14	0	----a-w	C:\LOG136.tmp
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-12-26 32768]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-10-18 1315840]
"PROMT Integrator"="c:\program files\PROMT5\INTEGRAL\PinStart.exe" [2001-09-03 49152]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"BboxUpdate"="c:\program files\BboxUpdate\BTLiveUpdate.exe" [2008-08-06 103936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-05-14 67072]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\BTHPROPS.CPL [2004-08-05 110592]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-12-26 450560]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-14 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LBTWlgn]
2008-05-02 00:42	72208	----a-w	c:\program files\Fichiers communs\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Messenger\MSMSGS.EXE"=
"c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\WINDOWS\System32\rtcshare.exe"=
"c:\Program Files\NetMeeting\conf.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\Microsoft LifeCam\LifeCam.exe"=
"c:\Program Files\Microsoft LifeCam\LifeExp.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"=
"c:\Program Files\Windows Live\Messenger\livecall.exe"=
"c:\Program Files\Bbox\eSKernel.exe"=
"c:\Program Files\BboxUpdate\BTLiveUpdate.exe"=

R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [25/12/2007 19:40 15172]
.
Contenu du dossier 'Tâches planifiées'

2009-05-20 c:\windows\Tasks\User_Feed_Synchronization-{FF5DF99F-C204-45E8-9DC9-B60BD76EAA1D}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2009-05-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-RunOnce-Shockwave Updater - c:\windows\system32\ADOBE\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.7) Gecko/2009021910 Firefox/3.0.7
HKLM-Run-DXDllRegExe - dxdllreg.exe
Notify-vtUkihHB - vtUkihHB.dll


.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2a22063e1a6841fa860803837843fbd1
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2a22063e1a6841fa860803837843fbd1
IE: {{7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - c:\program files\PROMT5\PROMTIE4\promtie5.htm
IE: {{7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - c:\program files\PROMT5\PROMTIE4\options.htm
FF - ProfilePath - c:\documents and settings\13\Application Data\Mozilla\Firefox\Profiles\9ka9hnr1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://fr.msn.com/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-20 14:18
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(528)
c:\program files\fichiers communs\logitech\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2896)
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\AHEAD\INCD\INCDSRV.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE
c:\program files\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE
c:\program files\MICROSOFT LIFECAM\MSCAMS32.EXE
c:\windows\SYSTEM32\RUNDLL32.EXE
c:\program files\PROMT5\INTEGRAL\PINMENU.EXE
c:\program files\FICHIERS COMMUNS\LOGISHRD\KHAL2\KHALMNPR.EXE
c:\windows\SYSTEM32\WSCNTFY.EXE
.
**************************************************************************
.
Heure de fin: 2009-05-20 14:21 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-05-20 12:21

Avant-CF: 7 321 354 240 octets libres
Après-CF: 7 670 431 744 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

249	--- E O F ---	2009-05-13 16:03

fraggle559 · Answer

Je te poste le dernier scan malwarebytes fait il y a quelques jours ou je le refais ?

fraggle559 · Answer

non j'ai fait le scan le 14 mai . (je te le poste). Mais je m'en suis aperçu il y a quelques jours et j'ai donc revérifié après combofix pour voir s'il les avait fait disparaitre.

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2128
Windows 5.1.2600 Service Pack 2

14/05/2009 09:22:31
mbam-log-2009-05-14 (09-22-31).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 165917
Temps écoulé: 25 minute(s), 49 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\msnmsgrss.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

fraggle559 · Answer

oui effectivement, je ne comprends pas, ce rapport, je l'ai trouvé lorsque j'ouvre malwarebyte  dans rapport mais en le lisant, j'ai vu qu'il ne reflète pas la liste de la quarantaine apparente dans malwarebytes onglet quarantaine.
est que je peux trouver un autre rapport ailleurs ?
j'ai trouvé celui du 13 mai qui semble plus infecté. je te le poste. Sinon, je refais un nouveau scan malwarebytes mais pourquoi ces infections sont  encore listées  dans la quarantaine ?

Malwarebytes' Anti-Malware 1.35
Version de la base de données: 1917
Windows 5.1.2600 Service Pack 2

13/05/2009 21:16:17
mbam-log-2009-05-13 (21-16-17).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 154626
Temps écoulé: 41 minute(s), 56 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 4
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 6
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\kugeyugu.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\yizesoko.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vabofoka.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\pogobiwu.dll (Trojan.Vundo.H) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{499e9650-0baa-4087-9c29-6a5000dba20c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{499e9650-0baa-4087-9c29-6a5000dba20c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{499e9650-0baa-4087-9c29-6a5000dba20c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\320d18a1 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm313e2b3d (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rirawapola (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\vabofoka.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\vabofoka.dll  -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\vabofoka.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\pogobiwu.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\pogobiwu.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\system32\kugeyugu.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\uguyeguk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\pogobiwu.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\yizesoko.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vabofoka.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0108179.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

fraggle559 · Answer

ok

fraggle559 · Answer

voici le rapport malwarebytes.(l'onglet quarantaine dans programme malwarebytes contient toujours les 69 éléments, je les supprime ? C'est peut etre juste la liste de ce qu'il avait mis en quarantaine précédement ?) 


mais antivir, pendant le scan de malwerbytes vient de me signaler 2 alertes. Comment est ce possible alors que le rapport ici n'indique rien ?



Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2157
Windows 5.1.2600 Service Pack 2

20/05/2009 15:33:52
mbam-log-2009-05-20 (15-33-52).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 157960
Temps écoulé: 35 minute(s), 23 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

fraggle559 · Answer

j'ai fait un scan antivir le voila



Avira AntiVir Personal
Report file date: mercredi 20 mai 2009  15:40

Scanning for 1410306 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    LAURA

Version information:
BUILD.DAT     : 8.2.0.348      16934 Bytes  23/03/2009 13:44:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  26/11/2008 17:34:24
AVSCAN.DLL    : 8.1.4.0        40705 Bytes  26/05/2008 07:56:42
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 12:44:20
LUKERES.DLL   : 8.1.4.0        12033 Bytes  26/05/2008 07:58:54
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  27/10/2008 16:38:28
ANTIVIR1.VDF  : 7.1.2.12     3336192 Bytes  11/02/2009 12:09:22
ANTIVIR2.VDF  : 7.1.3.185    2010112 Bytes  12/05/2009 17:29:08
ANTIVIR3.VDF  : 7.1.3.231     325632 Bytes  19/05/2009 17:19:28
Engineversion : 8.2.0.168 
AEVDF.DLL     : 8.1.1.1       106868 Bytes  03/05/2009 17:18:28
AESCRIPT.DLL  : 8.1.2.0       389497 Bytes  15/05/2009 17:21:34
AESCN.DLL     : 8.1.2.3       127347 Bytes  15/05/2009 17:21:32
AERDL.DLL     : 8.1.1.3       438645 Bytes  05/11/2008 17:33:36
AEPACK.DLL    : 8.1.3.16      397686 Bytes  08/05/2009 17:19:58
AEOFFICE.DLL  : 8.1.0.36      196987 Bytes  27/02/2009 12:07:28
AEHEUR.DLL    : 8.1.0.129    1761655 Bytes  15/05/2009 17:21:32
AEHELP.DLL    : 8.1.2.2       119158 Bytes  27/02/2009 12:07:28
AEGEN.DLL     : 8.1.1.44      348532 Bytes  15/05/2009 17:21:24
AEEMU.DLL     : 8.1.0.9       393588 Bytes  15/10/2008 17:23:26
AECORE.DLL    : 8.1.6.9       176500 Bytes  14/04/2009 17:08:52
AEBB.DLL      : 8.1.0.3        53618 Bytes  15/10/2008 17:23:18
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 08:40:06
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 09:28:02
AVREP.DLL     : 8.0.0.3       155688 Bytes  22/04/2009 17:09:24
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 11:26:42
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 08:29:24
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 12:27:50
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 17:28:04
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 12:49:42
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 12:05:12
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  12/06/2008 13:48:08
RCTEXT.DLL    : 8.0.52.0       86273 Bytes  27/06/2008 13:34:38

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: mercredi 20 mai 2009  15:40

Starting search for hidden objects.
'54735' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'PINMENU.EXE' - '1' Module(s) have been scanned
Scan process 'CTFMON.EXE' - '1' Module(s) have been scanned
Scan process 'MSMSGS.EXE' - '1' Module(s) have been scanned
Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned
Scan process 'BTLiveUpdate.exe' - '1' Module(s) have been scanned
Scan process 'AVGNT.EXE' - '1' Module(s) have been scanned
Scan process 'RUNDLL32.EXE' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'ALG.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'MSCamS32.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SCHED.EXE' - '1' Module(s) have been scanned
Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'InCDsrv.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
36 processes with 36 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!
Master boot sector HD1
    [INFO]      No virus was found!
    [WARNING]   System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD2
    [INFO]      No virus was found!
    [WARNING]   System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
    [INFO]      No virus was found!
    [WARNING]   System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
    [INFO]      No virus was found!
    [WARNING]   System error [21]: Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '64' files ).


Starting the file scan:

Begin scan in 'C:\' <ACER>
C:\pagefile.sys
    [WARNING]   The file could not be opened!
C:\hiberfil.sys
    [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP649\A0107195.EXE
    [DETECTION] Contains recognition pattern of the DR/Sdbot.100864 dropper
    [NOTE]      The file was moved to '4a450f8a.qua'!
C:\System Volume Information\_restore{4081E8B6-077E-420E-8973-EE0643E83BA3}\RP650\A0109229.exe
    [DETECTION] Contains recognition pattern of the WORM/SdBot.44082 worm
    [NOTE]      The file was moved to '4a450f90.qua'!


End of the scan: mercredi 20 mai 2009  16:11
Used time: 30:26 Minute(s)

The scan has been done completely.

   6306 Scanning directories
 187653 Files were scanned
      2 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      2 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 187649 Files not concerned
   6969 Archives were scanned
      6 Warnings
      2 Notes
  54735 Objects were scanned with rootkit scan
      0 Hidden objects were found

fraggle559 · Answer

J'ai fait les suppressions. Que va t'il falloir faire maintenant ?
Donne moi les instructions et je le ferais demain matin car là je vais arrêter. Bonsoir.

fraggle559 · Answer

je n'ai pas bien compris, je dois faire sdfix avant de désactiver la restauration  ?

D'après le guide sdfix, des malwares peuvent modifier l'ordinateur, je te confirme que j'ai constaté ça car le  centre de sécurité avait désactivé des parametres(MAJ automatique) que j'avais remis actifs et en plus, le pack SP3 était installé sur mon ordinateur depuis mi avril.

fraggle559 · Answer

bonjour,
tout c'est bien passé. Voila le rapport sdfix. dois-je désactiver les points de restauration maintenant (comme expliqué dans ton message 61) ?


[b]SDFix: Version 1.240 [/b]
Run by 13 on 21/05/2009 at 15:24

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\W139_jpg.zip - Deleted
C:\WINDOWS\Nokia_19_jpg.zip - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-21 15:29:07
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\MSMSGS.EXE"="C:\Program Files\Messenger\MSMSGS.EXE:*:Enabled:Windows Messenger"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\WINDOWS\System32\rtcshare.exe"="C:\WINDOWS\System32\rtcshare.exe:*:Disabled:Partage de l'application RTC"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows© NetMeeting©"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox"
"C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"="C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Bbox\eSKernel.exe"="C:\Program Files\Bbox\eSKernel.exe:*:Enabled:Bbox assistant d'installation"
"C:\Program Files\BboxUpdate\BTLiveUpdate.exe"="C:\Program Files\BboxUpdate\BTLiveUpdate.exe:*:Enabled:Bbox - Bouygues Telecom - Utilitaire de mise … jour"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"="C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 18 Apr 2005         1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Mon 18 Apr 2005         1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK32.dll"
Mon 18 Apr 2005         1,024 ...HR --- "C:\WINDOWS\system32
tiembed.dll"
Wed 22 Oct 2008       949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Wed 22 Oct 2008       962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Mon 15 Sep 2008     1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Sun 12 Mar 2006    10,311,680 ..SH. --- "C:\Program Files\AVIConverter\MENCODER.EXE"
Sat 31 Dec 2005     8,578,048 ..SH. --- "C:\Program Files\AVIConverter\mencoder1.exe"
Tue  5 Jun 2007         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 14 Mar 2005       299,008 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe"
Mon 25 Apr 2005        61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll"
Wed  1 Aug 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 28 Jun 2007     3,096,576 A..H. --- "C:\Documents and Settings\13\Application Data\U3	emp\Launchpad Removal.exe"

[b]Finished![/b]

fraggle559 · Answer

voila, c'est fait, j'ai activé puis désactivé la restauration.

Il semble que les 2 fichiers supprimés par SDfix soient des photos, c'est bien ça ? car extention jpg

fraggle559 · Answer

ils cachent donc autre chose ?

fraggle559 · Answer

Voila le rapport 

Logfile of random's system information tool 1.06 (written by random/random)
Run by 13 at 2009-05-21 16:26:06
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 12 GB (31%) free of 38 GB
Total RAM: 735 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:26:11, on 21/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\BboxUpdate\BTLiveUpdate.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\PROMT5\INTEGRAL\pinmenu.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Documents and Settings\13\Bureau\RSIT.exe
C:\Program Files	rend micro\13.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [PROMT Integrator] "C:\Program Files\PROMT5\INTEGRAL\PinStart.exe" /autorun
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BboxUpdate] C:\Program Files\BboxUpdate\BTLiveUpdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?2a22063e1a6841fa860803837843fbd1
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?2a22063e1a6841fa860803837843fbd1
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT5\PROMTIE4\promtie5.htm
O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra 'Tools' menuitem: Personnaliser les options de traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT5\PROMTIE4\options.htm
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://GLOBAL.ACER.COM/
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

fraggle559 · Answer

voila c'est fait. Je n'ai pas fait de scan après le "fix checked" j'ai fermé directement.  C'est correct ?

^^Marie^^ · Answer

Slt

Tu peux supprimer toutes ces lignes



O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll       
 O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll       
 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE       
 O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"       
 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe       
 O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"       
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime       
 O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe       
 O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe       
 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')       
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')       
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE       
 O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe      

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab 
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB 
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab 
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab 
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab 
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab 
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab



++

fraggle559 · Answer

avec "fix fhecked" ?

fraggle559 · Answer

ok merci

fraggle559 · Answer

Maintenant je fais toolscleaner. Rien d'autre avant ?

fraggle559 · Answer

Voila, j'ai passé toolscleaner mais il a laissé jacobin et le raccourci de  hitjackthis sur le bureau. Je les mets à la poubelle ? ET je pourrai désinstaller toolscleaner après ?

fraggle559 · Answer

j'avais pas vu apparaitre le rapport. Le voici. pour les raccourci, le programme hitjackthis est toujours présent car l'ordinateur me l'a signaler quand j'ai voulu supprimer le raccourci. Je peux aussi le désinstaller avant ccleaner ? 


[ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\SDFIX: trouvé !
C:\Qoobox: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\13\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\13\Menu Démarrer\Programmes\Ad-remover: trouvé !
C:\Documents and Settings\13\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\13\Bureau\Ad-remover.lnk: trouvé !
C:\Documents and Settings\13\Bureau\Rsit.exe: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\Trend Micro\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\hijackthis.log: trouvé !
C:\Program Files\Ad-remover\BACKUP\Ad-R.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\13\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\13\Bureau\Ad-remover.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis.exe: supprimé !
C:\Program Files\Ad-remover\BACKUP\Ad-R.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\Documents and Settings\13\Bureau\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\Qoobox: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\13\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Documents and Settings\13\Menu Démarrer\Programmes\Ad-remover: supprimé !
C:\Program Files\Ad-remover: supprimé !

fraggle559 · Answer

non, ce doit juste être le message habituel pour raccourci de hitjackthis.

fraggle559 · Answer

j'ai bessoin d'une confirmation avant de "lancer le nettoyage" de ccleaner.
Les cases à cocher sont toutes les cases cochées automatiquement  dans "nettoyeur -windows" plus la case avancé et vielles données du perfetch  ?

Car habituellement, j'utilise ccleaner avec toutes les cases cochées sauf les cases avancées

fraggle559 · Answer

Je n'ai pas bien compris justement,
 je dois donc décocher toutes les cases cochées automatiquement dans  "internt explorer" "windows explorer" et "système" et ne laisser que "vieille données du perfect" dans nettoyeur- windows

fraggle559 · Answer

ok c'est donc les caches automatique plus case avancé

fraggle559 · Answer

oui;Merci.

Voila, j'ai passé ccleaner.
il y avait beaucoup d'erreur à réparer dans le registre !

fraggle559 · Answer

C'est quoi un fichier à double extention  et un keygens ?

Par contre, je n'ai pas avast, j'ai  antivir, je pense qu'il est mieux.

fraggle559 · Answer

je ne connaissais pas les fichiers à double extension. Donc si j'en trouve un, je dois le supprimer tout de suite. Mais quand est ce qu'ils se chargent ? En douce avec d'autres programmes ?

Je suis très contente que mon pc soit ok.

Merci infiniment de ton aide.

Je peux donc marquer résolu !
j'ai beaucoup de dossiers log à la racine. Faut il tout garder car il y en a beaucoup ? 



Encore merci de ton aide.
Bonsoir.

Trojan + 23 infections

56 réponses

Discussions similaires

Newsletters