Pc infecté

Résolu/Fermé
nicos03 Messages postés 6 Date d'inscription jeudi 14 mai 2009 Statut Membre Dernière intervention 21 mai 2009 - 14 mai 2009 à 07:53
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 - 21 mai 2009 à 22:49
Bonjour,

J'ai des gros ennuis avec internet explorer qui m'ouvre des tas de pages ; s'eteint tout seul et me lance des dicours audio de Obama . . .

Mon pc a été infecté par un virus il y a 2,3 jours :

-Gestionnaire de tache desactivé.
-Restauration systéme effacé.
-Fond d'ecran bleu.

J'ai réussi à me depanner grâce à vos différents posts pour les problémes ci-dessus;mais là pour le fonctionnement de internet explorer je cale et fais donc appel à votre aide.
A voir également:

29 réponses

jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
14 mai 2009 à 08:05
slt





Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit
0
nicos03 Messages postés 6 Date d'inscription jeudi 14 mai 2009 Statut Membre Dernière intervention 21 mai 2009
14 mai 2009 à 08:15
fichier log :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Nico et marion at 2009-05-14 08:11:28
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 8 GB (11%) free of 69 GB
Total RAM: 1279 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:11:53, on 14/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\CAP3RSK.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\qttask.exe
C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Documents and Settings\Nico et marion\Bureau\RSIT.exe
C:\Program Files\trend micro\Nico et marion.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.msn.com/fr-fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.msn.com/fr-fr/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: CPV - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\WWShow\WWShow.dll
O2 - BHO: {65feff7d-c4e5-0048-bf54-e6e6de193133} - {331391ed-6e6e-45fb-8400-5e4cd7ffef56} - C:\WINDOWS\system32\jvfnez.dll
O2 - BHO: (no name) - {65F5A866-E091-4476-A427-CC14EEEE1639} - (no file)
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\cbXNdbyA.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {D0D6FA41-94FC-4641-97CA-CEA05478ADFE} - C:\WINDOWS\system32\hgGyaaYo.dll
O2 - BHO: HelloWorldBHO - {D88E1558-7C2D-407A-953A-C044F5607CEA} - C:\Program Files\Jcore\Jcore2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
O4 - HKLM\..\Run: [CAP3ON] C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: cbXNdbyA - C:\WINDOWS\SYSTEM32\cbXNdbyA.dll
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
0
nicos03 Messages postés 6 Date d'inscription jeudi 14 mai 2009 Statut Membre Dernière intervention 21 mai 2009 > nicos03 Messages postés 6 Date d'inscription jeudi 14 mai 2009 Statut Membre Dernière intervention 21 mai 2009
14 mai 2009 à 08:20
je tai mis deux fois le fichier log ...

voici le fichier info :

info.txt logfile of random's system information tool 1.06 2009-05-14 08:11:55

======Uninstall list======

-->C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 5.0 Sprint-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
Ad-Aware SE Professional-->C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Acrobat 5.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Advanced RAR Password Recovery (remove only)-->C:\Program Files\ElcomSoft\ARPR\uninstall.exe
Agere Systems PCI Soft Modem-->agrsmdel
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Canon LASER SHOT LBP-1120-->C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3UNIK.EXE
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Creative Modem Blaster V.92 DI5733-1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C1C0717C-546A-11D7-9963-00A0C92C4EC3}\setup.exe" -l0x40c /remove
eMule-->"C:\Program Files\eMule\Uninstall.exe"
Ensemble clavier et souris sans fil Labtec-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A369B607-5BAF-4AB3-B18A-1017ED19902D}\Setup.exe" -l0x040c
Favorit-->"c:\documents and settings\nico et marion\local settings\application data\smiky.exe" -uninstall
FenAffiche (C:\Program Files\FenAffiche\)-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\FenAffiche\ST6UNST.000"
FenAffiche-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\FenAffiche\ST6UNST.LOG"
Gestionnaire Internet-->C:\PROGRA~1\Wanadoo\uninstall.exe
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Hercules WebCam Station-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D208F4A7-6B73-4C2A-8B1E-8756FCBA831E}\Setup.exe" -l0x40c
Hercules Webcam-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A250D351-A07F-4D5D-AB6C-693C69B9BFAF}\Setup.exe" -l0x40c
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Language pack for Ad-Aware SE-->C:\PROGRA~1\Lavasoft\AD-AWA~1\Plugins\Langs\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\Plugins\Langs\INSTALL.LOG
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Lexmark 1200 Series-->C:\WINDOWS\system32\spool\drivers\w32x86\3\LXCZUN5C.EXE -dLexmark 1200 Series
LimeWire PRO 4.16.4-->"C:\Program Files\LimeWire\uninstall.exe"
McAfee SecurityCenter-->c:\PROGRA~1\mcafee.com\shared\mcappins.exe /v=3 /uninstall=1 /appid=msc /interact=1 /script_proactive=0 /start=c:\PROGRA~1\mcafee.com\agent\uninst\screm.ui::uninstall.htm
McAfee VirusScan-->c:\PROGRA~1\mcafee.com\shared\mcappins.exe /v=3 /uninstall=1 /interact=1 /script_proactive=1 /start=c:\PROGRA~1\mcafee.com\agent\uninst\vsoremui.dll::uninstall.htm
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office PowerPoint Viewer 2007 (French)-->MsiExec.exe /X{95120000-00AF-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB968220)-->"C:\WINDOWS\ie8updates\KB968220-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Moniteur WiFi OLITEC-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE06F9AA-6C9D-4D64-A028-41B6340200AF}\setup.exe" -l0x40c -removeonly
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 8 Trial-->MsiExec.exe /X{5FCCD531-1B38-4A94-924C-127F722F1036}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
PCI Audio Driver-->cmuninst.exe
PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
Quicktime Browser Plug-In-->C:\WINDOWS\uninst.exe -f"C:\Program Files\Netscape\Navigator\Program\Plugins\npqtw\DeIsL1.isu"
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
RamBoost XP 4.0.6-->"C:\Program Files\RamBoost XP\unins000.exe"
Recover Pro-->C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\un_vback.exe
S3 S3Info2-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Info2'
S3 S3Overlay-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Overlay'
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung\SS_Uninstall.exe
Samsung PC Studio 3 USB Driver Installer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -l0x40c -removeonly
Samsung PC Studio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -l0x40c -removeonly
Samsung Samples Installer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7AC15160-A49B-4A89-B181-D4619C025FFF}\setup.exe" -l0x40c -removeonly
ShopperReports-->C:\Program Files\ShoppingReport\Uninst.exe
Sina Web TV-->C:\PROGRA~1\sina\SINAWE~1\304~1.2\UNWISE.EXE C:\PROGRA~1\sina\SINAWE~1\304~1.2\Install.LOG
TMPGEnc DVD Author 1.5-->MsiExec.exe /I{4A8A0AE0-8F80-4621-AD2F-E2F8FE0CC7FD}
TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}
TVAnts 1.0-->C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Veetle TV Player 0.9.11-->C:\Program Files\Veetle\VLC\uninstall.exe
Veetle TV Player 0.9.11-->C:\WINDOWS\UninstVeetleTVPlayer.exe
VIA Audio Driver Setup Program-->RunDll32.exe UnAudioNT.dll,UninstallAudio C:\WINDOWS\IsUninst.exe -y-f"C:\PROGRA~1\VIAudioi\SBASetup\Uninst.isu"
VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Visionneuse Journal Windows Microsoft-->MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA7}
WinAVI Video Converter 7.7-->"C:\Program Files\WinAVI Video Converter\unins000.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Live Toolbar-->MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Security center information======

AV: McAfee VirusScan (outdated)

======System event log======

Computer Name: NICOLAS
Event Code: 7036
Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.

Record Number: 108469
Source Name: Service Control Manager
Time Written: 20090413233839.000000+120
Event Type: Informations
User:

Computer Name: NICOLAS
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : en cours d'exécution.

Record Number: 108468
Source Name: Service Control Manager
Time Written: 20090413233839.000000+120
Event Type: Informations
User:

Computer Name: NICOLAS
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

Record Number: 108467
Source Name: Service Control Manager
Time Written: 20090413233839.000000+120
Event Type: Informations
User: AUTORITE NT\SYSTEM

Computer Name: NICOLAS
Event Code: 7036
Message: Le service Explorateur d'ordinateur est entré dans l'état : arrêté.

Record Number: 108466
Source Name: Service Control Manager
Time Written: 20090413233839.000000+120
Event Type: Informations
User:

Computer Name: NICOLAS
Event Code: 7036
Message: Le service Service de la passerelle de la couche Application est entré dans l'état : en cours d'exécution.

Record Number: 108465
Source Name: Service Control Manager
Time Written: 20090413233836.000000+120
Event Type: Informations
User:

=====Application event log=====

Computer Name: NICOLAS
Event Code: 2003
Message:
Record Number: 11321
Source Name: EAPOL
Time Written: 20090222151412.000000+060
Event Type: Informations
User:

Computer Name: NICOLAS
Event Code: 1000
Message: Application défaillante temp2.exe, version 0.0.0.0, module défaillant temp2.exe, version 0.0.0.0, adresse de défaillance 0x0000126e.

Record Number: 11320
Source Name: Application Error
Time Written: 20090222151343.000000+060
Event Type: erreur
User:

Computer Name: NICOLAS
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 11319
Source Name: SecurityCenter
Time Written: 20090222151335.000000+060
Event Type: Informations
User:

Computer Name: NICOLAS
Event Code: 0
Message:
Record Number: 11318
Source Name: Nero BackItUp Scheduler 3
Time Written: 20090222151334.000000+060
Event Type: Informations
User:

Computer Name: NICOLAS
Event Code: 0
Message:
Record Number: 11317
Source Name: gusvc
Time Written: 20090222151334.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=0801
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
14 mai 2009 à 08:19
utilise pour supprimer tes traces

CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo
(dans les options puis avancé :désactive la case: effacer les fichiers de plus de 48 heures)
https://www.malekal.com/tutoriel-ccleaner/
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
-----------------------

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.


déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


_____________________________


scanne rapide avec
MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
_____________________________

remets un rapport RSIT neuf et dis tes soucis actuels
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
14 mai 2009 à 08:23
up
0
nicos03 Messages postés 6 Date d'inscription jeudi 14 mai 2009 Statut Membre Dernière intervention 21 mai 2009
14 mai 2009 à 11:28
Desolé mais combofix ne se lance pas sur mon pc ...

Je ne comprend pas pourquoi ... J'ai pourtant suivi tes instructions a la lettre ..
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
14 mai 2009 à 11:31
essaie avec ce combofix:


télécharge combofix (par sUBs) ici : (=killfix)

http://sd-1.archive-host.com/membres/up/193094576412487685/Killfix.exe


et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

http://www.bleepingcomputer.com/combofix/fr/comment-utiliser­-combofix
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Voici le rapport de combofix :



omboFix 09-05-14.02 - Nico et marion 14/05/2009 21:45.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1279.975 [GMT 2:00]
Lancé depuis: c:\documents and settings\Nico et marion\Bureau\Killfix2.exe
AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.bat
C:\autorun.vbs
C:\copy.exe
c:\documents and settings\Nico et marion\Application Data\ShoppingReport
c:\documents and settings\Nico et marion\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\Nico et marion\Application Data\twain\Twain.exe
c:\documents and settings\Nico et marion\Local Settings\Application Data\smiky.dat
c:\documents and settings\Nico et marion\Local Settings\Application Data\smiky.exe
c:\documents and settings\Nico et marion\Local Settings\Application Data\smiky_nav.dat
c:\documents and settings\Nico et marion\Local Settings\Application Data\smiky_navps.dat
c:\documents and settings\Nico et marion\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\Nico et marion\RavMonLog
c:\documents and settings\nico\RavMonLog
C:\host.exe
c:\program files\Jcore
c:\program files\Jcore\Jcore2.dll
c:\program files\QUAD Utilities
c:\program files\QUAD Utilities\QUAD Registry Cleaner\Vista Scheduler.dll
c:\program files\ShoppingReport
c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
c:\program files\ShoppingReport\Uninst.exe
c:\program files\WWShow
c:\program files\WWShow\WWShow.dll
c:\windows\autorun.inf
c:\windows\svchost.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\autorun.reg
c:\windows\system32\autorun.vbs
c:\windows\system32\bhpowj.dll
c:\windows\system32\cbXNdbyA.dll
c:\windows\system32\config\47799240.Evt
c:\windows\system32\cwawcy.dll
c:\windows\system32\dcnlrs.dll
c:\windows\system32\dlkiinwo.dll
c:\windows\system32\drivers\UACqbuwmexmprmbsxv.sys
c:\windows\system32\fdjxpw.dll
c:\windows\system32\ghkpnidf.dll
c:\windows\system32\hgGyaaYo.dll
c:\windows\system32\hyaalnci.ini
c:\windows\system32\icnlaayh.dll
c:\windows\system32\jvfnez.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\msclock32.dll
c:\windows\system32\msegcompid.dll
c:\windows\system32\msplock32.dll
c:\windows\system32\nvctrl.exe
c:\windows\system32\oYaayGgh.ini
c:\windows\system32\oYaayGgh.ini2
c:\windows\system32\pafkdxav.dll
c:\windows\system32\prdygiyf.dll
c:\windows\system32\ptufnssk.ini
c:\windows\system32\rwiatooh.dll
c:\windows\system32\temp1.exe
c:\windows\system32\temp2.exe
c:\windows\system32\UACcpqlaorpiqwmwer.dll
c:\windows\system32\UACepnfhtglcpotmxs.dll
c:\windows\system32\UAChowberftyxabcbn.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACkvpbbnauqhldfya.log
c:\windows\system32\UACkvterrwxaqbpdpk.dll
c:\windows\system32\UACmseefhtruwxspos.log
c:\windows\system32\UACpaspbanvacceptx.dll
c:\windows\system32\UACqmkyxuwkmrdkvoo.dll
c:\windows\system32\UACsaisuetoxxxribl.log
c:\windows\system32\UACweyejmielivytbo.db
c:\windows\system32\UACylltivasdxvaefq.dat
c:\windows\system32\vcilch.dll
c:\windows\system32\vpymfqfk.dll
c:\windows\xcopy.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys
-------\Legacy_BOONTY_GAMES
-------\Service_asc3550p
-------\Service_Boonty Games


((((((((((((((((((((((((((((( Fichiers créés du 2009-04-14 au 2009-05-14 ))))))))))))))))))))))))))))))))))))
.

2009-05-14 19:24 . 2009-05-14 19:25 -------- d-----w C:\Killfix
2009-05-14 06:11 . 2009-05-14 09:11 -------- d-----w c:\program files\trend micro
2009-05-14 06:11 . 2009-05-14 06:11 -------- d-----w C:\rsit
2009-05-11 16:00 . 2009-05-14 19:47 -------- d-----w c:\documents and settings\Nico et marion\Application Data\Twain
2009-05-10 17:00 . 2009-05-10 17:00 -------- d-----w c:\program files\CCleaner
2009-05-10 14:26 . 2009-05-10 14:26 7 ----a-w c:\windows\sbacknt.bin
2009-05-10 14:25 . 2009-05-10 14:31 -------- d-----w c:\program files\vghd
2009-05-10 14:25 . 2009-05-10 14:27 -------- d-----w c:\documents and settings\Nico et marion\Application Data\vghd
2009-05-10 11:57 . 2009-05-10 11:57 -------- d-----w c:\documents and settings\All Users\Application Data\Babylon
2009-05-10 11:57 . 2009-05-10 11:57 -------- d-----w c:\documents and settings\Nico et marion\Application Data\Babylon
2009-04-27 09:24 . 2009-05-09 13:16 -------- d-sh--w c:\documents and settings\All Users\Application Data\MPK
2009-04-16 17:39 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 17:39 . 2009-03-06 14:20 286720 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-16 17:39 . 2009-02-09 11:23 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-16 17:39 . 2009-02-09 10:53 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 17:39 . 2009-02-09 10:53 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 17:39 . 2009-02-09 10:53 685568 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 17:39 . 2009-02-09 10:53 735744 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 17:39 . 2009-02-09 10:53 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 17:39 . 2009-02-09 10:53 739840 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 17:39 . 2008-12-16 12:31 354304 -c----w c:\windows\system32\dllcache\winhttp.dll
2009-04-16 17:39 . 2008-04-21 21:15 219136 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-16 05:42 . 2009-04-16 05:42 -------- d-sh--w c:\documents and settings\Nico et marion\IECompatCache

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 03:55 . 2005-02-02 17:14 -------- d-----w c:\program files\eMule
2009-05-10 17:21 . 2004-11-25 09:14 -------- d-----w c:\program files\Fichiers communs\Real
2009-05-10 17:19 . 2006-12-17 12:06 -------- d-----w c:\program files\DivX
2009-05-02 13:05 . 2004-11-24 17:19 85696 ----a-w c:\windows\system32\perfc00C.dat
2009-05-02 13:05 . 2004-11-24 17:19 513492 ----a-w c:\windows\system32\perfh00C.dat
2009-04-11 09:15 . 2009-04-10 16:02 -------- d-----w c:\program files\Microsoft Silverlight
2009-03-15 22:07 . 2009-03-15 22:07 -------- d-----w c:\program files\Fichiers communs\Windows Live
2009-03-08 02:34 . 2004-11-24 17:19 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2004-11-24 17:19 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2004-11-24 17:19 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2004-11-24 17:19 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2004-11-24 17:19 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2004-11-24 17:19 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 02:31 . 2004-11-24 17:19 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 02:31 . 2004-11-24 17:19 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 02:31 . 2004-11-24 17:19 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 02:22 . 2004-11-24 17:19 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-11-24 17:19 286720 ----a-w c:\windows\system32\pdh.dll
2006-02-16 14:37 . 2006-02-16 14:37 278528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
2006-12-19 21:18 . 2006-12-19 21:18 14 -csh--w c:\windows\mswtpdxp.dll
2006-12-19 21:18 . 2006-12-19 21:18 21 -csh--w c:\windows\prwttrxp.dll
2006-07-30 15:20 . 2007-05-15 14:28 959 -csha-r c:\windows\system32\autorun.bin
2006-12-19 21:18 . 2006-12-19 21:18 21 -csh--w c:\windows\system32\dpwttaxp.dll
2006-12-19 21:18 . 2006-12-19 21:18 14 -csh--w c:\windows\system32\mswtpaxp.dll
2006-12-19 21:18 . 2006-12-19 21:18 2 -csh--w c:\windows\system32\verwttxp.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\windows\system32\qttask.exe" [2006-05-22 98304]
"CAP3ON"="c:\windows\system32\spool\drivers\w32x86\3\CAP3ONN.EXE" [2002-07-30 22528]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
"C-Media Mixer"="Mixer.exe" - c:\windows\mixer.exe [2005-01-12 1216512]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Moniteur WiFi OLITEC.exe.lnk - c:\program files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe [2008-11-3 913408]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll
"wave2"= serwvdrv.dll
"wave3"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Activer l'ensemble clavier et souris sans fil Labtec.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Activer l'ensemble clavier et souris sans fil Labtec.lnk
backup=c:\windows\pss\Activer l'ensemble clavier et souris sans fil Labtec.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Fenêtre d'état de Canon LASER SHOT LBP-1120.LNK]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Fenêtre d'état de Canon LASER SHOT LBP-1120.LNK
backup=c:\windows\pss\Fenêtre d'état de Canon LASER SHOT LBP-1120.LNKCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Ralink Wireless Utility.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Ralink Wireless Utility.lnk
backup=c:\windows\pss\Ralink Wireless Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MCVSRte"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"McTskshd.exe"=2 (0x2)
"McShield"=3 (0x3)
"McDetect.exe"=2 (0x2)
"FTRTSVC"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AGRSMMSG"=AGRSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\eMule\\LinkCreator.exe"=
"c:\\Program Files\\RALINK\\Common\\RaUI.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\OLITEC\\Moniteur WiFi OLITEC\\Moniteur WiFi OLITEC.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:emulle
"4672:UDP"= 4672:UDP:emule
"16100:TCP"= 16100:TCP:NortonAV
"15598:TCP"= 15598:TCP:NortonAV
"14753:TCP"= 14753:TCP:NortonAV
"16994:TCP"= 16994:TCP:NortonAV
"16566:TCP"= 16566:TCP:NortonAV
"16383:TCP"= 16383:TCP:NortonAV
"14480:TCP"= 14480:TCP:NortonAV
"14271:TCP"= 14271:TCP:NortonAV
"12612:TCP"= 12612:TCP:NortonAV
"16103:TCP"= 16103:TCP:NortonAV
"14872:TCP"= 14872:TCP:NortonAV
"18567:TCP"= 18567:TCP:NortonAV
"16597:TCP"= 16597:TCP:NortonAV
"15336:TCP"= 15336:TCP:NortonAV
"14187:TCP"= 14187:TCP:NortonAV
"15462:TCP"= 15462:TCP:NortonAV

R0 RITCPT;RITCPT;c:\windows\system32\drivers\RITCPT.SYS [24/11/2004 18:47 43512]
R0 VVBackd5;VVBackd5;c:\windows\system32\drivers\VVBackd5.sys [02/02/2005 18:11 179482]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [02/02/2005 18:09 11776]
R2 FBAPI;FBAPI;c:\windows\system32\drivers\FBAPI.sys [24/11/2004 18:47 5088]
R3 ovt530;Webcam Deluxe;c:\windows\system32\drivers\ov530vid.sys [06/06/2008 17:37 161792]
S3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;c:\windows\system32\drivers\MRVW225.sys [08/09/2008 19:03 299904]
S3 NaiFiltr;NaiFiltr;c:\windows\system32\drivers\NaiFiltr.sys [24/11/2004 18:48 23296]
S3 PinnacleMicroTV;Pinnacle Systems MicroTV Device;c:\windows\system32\drivers\MicroTV.sys [17/12/2006 14:05 122368]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2009-05-14 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

2009-05-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-17 04:03]

2009-05-08 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 14:39]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{100EB1FD-D03E-47FD-81F3-EE91287F9465} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
BHO-{15421B84-3488-49A7-AD18-CBF84A3EFAF6} - c:\program files\WWShow\WWShow.dll
BHO-{65F5A866-E091-4476-A427-CC14EEEE1639} - (no file)
BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\cbXNdbyA.dll
BHO-{CB9C357B-C9ED-474D-80DE-DA941A919FA4} - c:\windows\system32\hgGyaaYo.dll
BHO-{D88E1558-7C2D-407A-953A-C044F5607CEA} - c:\program files\Jcore\Jcore2.dll
BHO-{e6292712-a69f-478a-b398-692964effe45} - c:\windows\system32\bhpowj.dll
Toolbar-Locked - (no file)
WebBrowser-{07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\cbXNdbyA.dll
ShellExecuteHooks-{34233f74-1c1b-43c2-bbfc-b65b270bde70} - c:\windows\system32\bhpowj.dll


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
IE: { - c:\progra~1\WANADO~1\Wanadoo Messager.exe
IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-14 21:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,18,eb,fa,98,f5,
65,87,9a,c8,28,51,af,b0,29,a3,98,59,76,66,8c,03,a7,2b,68,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,bc,1a,95,60,77,
6b,bf,cf,71,3b,04,66,8b,46,0d,96,e5,2d,d6,59,a7,02,f3,37,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,19,73,d8,82,3c,
a9,0b,f3,25,da,ec,7e,55,20,c9,26,81,cb,1f,20,4b,63,7d,08,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,84,52,a5,98,48,
53,39,a7,3e,1e,9e,e0,57,5a,93,61,c2,b4,20,51,d8,32,b5,c4,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,fe,96,13,53,51,
08,d5,56,cd,44,cd,b9,a6,33,6c,cd,cd,24,07,d2,d8,24,da,9c,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,97,ec,37,30,1e,
ef,71,c4,b0,18,ed,a7,3f,8d,37,a4,b5,1a,67,ce,1c,09,8b,9e,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,1f,d8,94,43,6e,
3a,34,82,31,77,e1,ba,b1,f8,68,02,a8,eb,91,de,2e,41,d8,d7,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,e6,4e,9e,90,f2,
f7,b3,ac,83,6c,56,8b,a0,85,96,ab,03,1a,db,12,f1,d9,1e,0f,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,b5,ad,d1,9f,fe,
ad,1a,76,51,fa,6e,91,28,9e,14,cc,c5,89,05,52,0b,58,ea,38,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,86,29,05,73,8b,
68,89,78,b1,cd,45,5a,a8,c4,f8,b9,9d,bc,71,93,d9,c2,d8,6f,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,b9,86,f7,74,79,
1a,90,08,e3,0e,66,d5,eb,bc,2f,6b,9d,16,e8,39,80,f3,58,4f,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,07,83,51,b8,ff,
cd,c5,3b,fa,ea,66,7f,d4,3b,6b,70,5a,07,df,f2,a1,21,6a,57,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3576)
c:\windows\system32\ieframe.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Hercules\WebCam Station\PhotoImpression\share\pihook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\CAP3RSK.EXE
c:\windows\system32\spool\drivers\w32x86\3\CAP3SWK.EXE
.
**************************************************************************
.
Heure de fin: 2009-05-14 22:00 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-14 20:00

Avant-CF: 8 292 077 568 octets libres
Après-CF: 9 424 547 840 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

361 --- E O F --- 2009-04-17 09:18
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
14 mai 2009 à 22:14
refais un coup de ccleaner

puis



scanne rapide avec
MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­
_____________________________

remets un rapport RSIT neuf et dis tes soucis actuels
0
RAPPORT RSIT




Logfile of random's system information tool 1.06 (written by random/random)
Run by Nico et marion at 2009-05-14 22:37:55
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 9 GB (13%) free of 69 GB
Total RAM: 1279 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:37:58, on 14/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\qttask.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\CAP3RSK.EXE
C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Nico et marion\Bureau\RSIT.exe
C:\Program Files\trend micro\Nico et marion.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.msn.com/fr-fr/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CAP3ON] C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
0
RAPPORT MALWARE



Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2132
Windows 5.1.2600 Service Pack 3

14/05/2009 22:26:03
mbam-log-2009-05-14 (22-26-03).txt

Type de recherche: Examen rapide
Eléments examinés: 84288
Temps écoulé: 3 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 8
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 234

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\AppID\{26a98aa8-07fe-46e6-b6df-26704f3b895f} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Casino Tropez (Adware.Casino) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BHO_CPV.DLL (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\DomPlayer (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\Nico et marion\Application Data\Twain (Trojan.Matcash) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\Nico et marion\Application Data\Microsoft\Windows\jncyu.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\M0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4832817824 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4867540046 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4902264120 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4936988194 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4971712153 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5006434375 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5041158449 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5075882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5249493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5284215856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5318938079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5353660301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5457826968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5492549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5527271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5561993634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5596715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5631438079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5666160301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5700882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5735604745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5770326968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5805049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5839771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5874493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6048104745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6082826968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6117549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6152271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6430049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6464771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6499493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6534215856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6603660301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6638382523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6673104745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6707826968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6777271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6811993634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6846715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6881438079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6916160301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6950882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6985604745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7020326968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7055050926 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7089771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7124493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7159215856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7193938079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7298104745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7332826968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7367549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7402271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7471715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7506438079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7541160301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7575882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7645326968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7680049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7714771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7749493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7992549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8027271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8061993634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8096715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8235604745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8270326968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8305049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8339771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8513384259 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8548104745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8583036690 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8617549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8652271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8686993634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8721715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8756438079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8791160301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8825882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8860935648 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8895912847 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8930049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8964771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8999493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_9034215856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_9068938079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3440883449 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3475605671 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3510327894 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3545050116 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3579772338 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3614494560 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3649216782 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3683939005 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3718661227 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3753383449 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3788109259 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4378385301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4413107523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4447829745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4482551968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4551996412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4586718634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4621440856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4656163079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4690885301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4725607523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4760329745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4795051968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4829774190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4864496412 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4899218634 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4933940856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4968663079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5003385301 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5038107523 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5072829745 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5107551968 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5142274190 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5558940856 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5593663079 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5628387037 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5663111111 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5697835069 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5906170255 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5940892477 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5975614699 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6010336921 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6149225810 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6183948032 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6218670255 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6253392477 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6288114699 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6322836921 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6357559144 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6392281366 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6947836921 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6982559144 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7017283218 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7052005440 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7086727662 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7121449884 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7746449884 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7781172106 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7815894329 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7850616551 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7885338773 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7920060995 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7954783218 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8024227662 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8058949884 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8232560995 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8267283218 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8302005440 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8336727662 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8440894329 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8475616551 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8510338773 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8545060995 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8579783218 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8614505440 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8649229398 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8683951620 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8753396065 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8788118287 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8822840509 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8857562732 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8892284954 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8961729398 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9028417940 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9063141898 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9097864120 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9132586343 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9167308565 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9202030787 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9236753009 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9271475232 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9306197454 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9340919676 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9445086343 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9479808565 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9514530787 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39932_2930087153 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39932_2964809375 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39933_3114892477 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39933_3149616551 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_7888407755 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_7923119213 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_7957841435 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_7992563657 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8027287616 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8062011690 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8096733912 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8131456134 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8166178356 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8200900579 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8235622801 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8305067245 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8339789468 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8374511690 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8409233912 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8895345023 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8930067245 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8964789468 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8999511690 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_9381456134 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_9416178356 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_9450900579 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_9485622801 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0596733912 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0631456134 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0666178356 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0700900579 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0735622801 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0770345023 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0805067245 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0943956134 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0978678356 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1013400579 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1048122801 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1083027662 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1117567245 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1152289468 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_6295247338 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_6329969560 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_6364691782 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39939_2097495255 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39939_2132217477 (Refog.Keylogger) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\MPK\1\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
0
Mon pc va beaucoup mieux !!!

Rien a voir!!!

Comment te remercier .... tu reponds 5 min apres mes post .. encore mieux qu'un professionnel (payant);)


Pour info tu fais ca toute la journée ???

Donc mon pc va mieux mais comment le proteger maintenant ...


Encore merci
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
15 mai 2009 à 11:56
ok vire ce qui est en quarantaine dans malwarebyte puis remets un rapport avec . Puis pour dernière vérification colle un scan en ligne de chez panda ou bitdefender ou kaspersky . Comme tu avais un keylogger qui récurrère ce que tu tape sur ton clavier il est préférable de modifier tes codes
0
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2132
Windows 5.1.2600 Service Pack 3

15/05/2009 21:54:56
mbam-log-2009-05-15 (21-54-56).txt

Type de recherche: Examen rapide
Eléments examinés: 86104
Temps écoulé: 4 minute(s), 37 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


rapport kapersky


KASPERSKY ON-LINE SCANNER REPORT
Saturday, May 16, 2009 12:20:15 AM
Système d'exploitation : Microsoft Windows XP Home Edition, Service Pack 3 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 15/05/2009
Enregistrements dans la base antivirus Kaspersky : 1975811
-------------------------------------------------------------------------------

Paramètres d'analyse:
Analyser avec la base antivirus suivante: standard
Analyser les archives: vrai
Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
C:\
D:\
E:\
F:\
I:\
J:\
K:\

Statistiques de l'analyse:
Total d'objets analysés: 63056
Nombre de virus trouvés: 20
Nombre d'objets infectés: 82 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 01:20:45

Nom de l'objet infecté / Nom du virus / Dernière action
C:\AUTORUN.FCB Infecté : Virus.VBS.Small.a ignoré
C:\autorun.reg Infecté : Trojan.WinREG.AutoRun.a ignoré
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\each option.bk! Infecté : Packed.Win32.PolyCrypt.d ignoré
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\Open 16.bk! Infecté : Packed.Win32.PolyCrypt.d ignoré
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\program active.bk! Infecté : Trojan.Win32.Obfuscated.en ignoré
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\remote mail.bk! Infecté : Packed.Win32.PolyCrypt.d ignoré
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\Vga 32.exe Infecté : Packed.Win32.PolyCrypt.d ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\511a0f3f9e960fa97de3d0b74adfc574_9be7f5ca-9b56-4563-ac45-d648659ecf4f L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5a3b8b8198a9e44cb496ff42ccf8d99c_9be7f5ca-9b56-4563-ac45-d648659ecf4f L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Bureau\fixperl.exe Infecté : Trojan.Win32.Genome.bag ignoré
C:\Documents and Settings\Nico et marion\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\IETldCache\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{269B027B-4184-11DE-B3DB-F18D7ADC350E}.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E10D05E6-4186-11DE-B3DB-000A78A07432}.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\Historique\History.IE5\MSHist012009051520090516\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\temp\~DF71ED.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\temp\~DFB742.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\L0S26690\p_840749908=23[11].txt L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Nico et marion\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Program Files\FenAffiche\FenUnika.exe Infecté : Trojan.Win32.VB.fhg ignoré
C:\Program Files\Nero\Nero8\Nero BackItUp\BIU1.txt L'objet est verrouillé ignoré
C:\Qoobox\Quarantine\C\autorun.bat.vir Infecté : Virus.VBS.Small.a ignoré
C:\Qoobox\Quarantine\C\autorun.vbs.vir Infecté : Virus.VBS.Small.a ignoré
C:\Qoobox\Quarantine\C\copy.exe.vir Infecté : Worm.Win32.Perlovga.a ignoré
C:\Qoobox\Quarantine\C\Documents and Settings\Nico et marion\Application Data\Twain\Twain.exe.vir Infecté : Trojan.Win32.Agent.ccwx ignoré
C:\Qoobox\Quarantine\C\host.exe.vir Infecté : Trojan-Dropper.Win32.Small.apl ignoré
C:\Qoobox\Quarantine\C\WINDOWS\svchost.exe.vir Infecté : Trojan-Dropper.Win32.Small.apl ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\autorun.reg.vir Infecté : Trojan.WinREG.AutoRun.a ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\autorun.vbs.vir Infecté : Virus.VBS.Small.a ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\bhpowj.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\cbXNdbyA.dll.vir Infecté : Trojan.Win32.Monder.aanc ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\config\47799240.Evt.vir Infecté : Trojan.Win32.Pakes.miu ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\cwawcy.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\dcnlrs.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\dlkiinwo.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\fdjxpw.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\ghkpnidf.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\hgGyaaYo.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\icnlaayh.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\jvfnez.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\nvctrl.exe.vir Infecté : Trojan-Downloader.Win32.Zlob.ik ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\pafkdxav.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\prdygiyf.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\rwiatooh.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\temp1.exe.vir Infecté : Worm.Win32.Perlovga.f ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\temp2.exe.vir Infecté : Backdoor.Win32.Small.lo ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACcpqlaorpiqwmwer.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACepnfhtglcpotmxs.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\UAChowberftyxabcbn.dll.vir Infecté : Trojan.Win32.TDSS.acbv ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACkvterrwxaqbpdpk.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACpaspbanvacceptx.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACqmkyxuwkmrdkvoo.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\vcilch.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\vpymfqfk.dll.vir Infecté : Packed.Win32.Krap.q ignoré
C:\Qoobox\Quarantine\C\WINDOWS\xcopy.exe.vir Infecté : Worm.Win32.Perlovga.a ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000002.dll Infecté : Trojan.Win32.TDSS.acbv ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000003.dll Infecté : Packed.Win32.Tdss.f ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000004.dll Infecté : Packed.Win32.Tdss.f ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000005.dll Infecté : Packed.Win32.Tdss.f ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000006.dll Infecté : Packed.Win32.Tdss.f ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000007.dll Infecté : Packed.Win32.Tdss.f ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000024.exe Infecté : Trojan-Dropper.Win32.Small.apl ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000031.exe Infecté : Trojan-Dropper.Win32.Small.apl ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000033.reg Infecté : Trojan.WinREG.AutoRun.a ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000034.vbs Infecté : Virus.VBS.Small.a ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000038.exe Infecté : Trojan-Downloader.Win32.Zlob.ik ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000039.exe Infecté : Worm.Win32.Perlovga.f ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000040.exe Infecté : Backdoor.Win32.Small.lo ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000042.exe Infecté : Worm.Win32.Perlovga.a ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000044.exe Infecté : Trojan.Win32.Agent.ccwx ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000046.bat Infecté : Virus.VBS.Small.a ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000047.vbs Infecté : Virus.VBS.Small.a ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000048.exe Infecté : Worm.Win32.Perlovga.a ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000049.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000050.dll Infecté : Trojan.Win32.Monder.aanc ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000051.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000052.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000053.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000054.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000055.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000056.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000058.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000059.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000060.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000061.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000063.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000064.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000065.dll Infecté : Packed.Win32.Krap.q ignoré
C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP1\change.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\1024\ld6138.tmp Infecté : Hoax.Win32.Renos.dv ignoré
C:\WINDOWS\system32\1024\ldC4C9.tmp Infecté : Hoax.Win32.Renos.dv ignoré
C:\WINDOWS\system32\AUTORUN.FCB Infecté : Virus.VBS.Small.a ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\ODiag.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\OSession.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\hp1886.tmp Infecté : Trojan-Downloader.Win32.Zlob.ik ignoré
C:\WINDOWS\system32\hpC47A.tmp Infecté : Trojan-Downloader.Win32.Zlob.gu ignoré
C:\WINDOWS\system32\ldA5E9.tmp Infecté : Trojan-Downloader.Win32.Zlob.in ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

Analyse terminée.
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
16 mai 2009 à 19:02
iok c'est en bonne voie!


télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
(attention bien mettre :files)

:processes
explorer.exe
:files
C:\AUTORUN.FCB
C:\autorun.reg
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\each option.bk!
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\Open 16.bk!
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\program active.bk!
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\remote mail.bk!
C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\Vga 32.exe
C:\Documents and Settings\Nico et marion\Bureau\fixperl.exe
C:\Program Files\FenAffiche\FenUnika.exe
C:\Qoobox\Quarantine
C:\WINDOWS\system32\1024\ld6138.tmp
C:\WINDOWS\system32\1024\ldC4C9.tmp
C:\WINDOWS\system32\AUTORUN.FCB
C:\WINDOWS\system32\hp1886.tmp
C:\WINDOWS\system32\hpC47A.tmp
C:\WINDOWS\system32\ldA5E9.tmp
:commands
[purity]
[emptytemp]
[start explorer]

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.


__________________________

vire le fichier moved files en allant dans psote de travail puis C puis otmovit

_________________________

utilise pour supprimer tes traces

CCLEANER: (lance un nettoyage et répare 3 fois le registre)
-----------------------

Désactive ta restauration systeme puis redemarre ton ordi puis réactive là comme ceci:
https://www.informatruc.com

______________________


Télécharge et install UsbFix de C_XX & Chiquitine29

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau .

# Choisis l'option 1 ( Recherche )

# Laisse travailler l'outil.

# Ensuite post le rapport UsbFix.txt qui apparaitra.

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

# Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
0
Désolé pour le retard ; j'étais persuadé de t'avoir répondu ...

Du coup j'ai perdu le rapport OTMoveIt en effacant le fichier fichier moved files .... je pensai te l'avoir déjà envoyé ...

Voici quand meme le rapport usbfix :



############################## [ UsbFix V3.021 # Scan ]

# User : Nico et marion (Administrateurs) # NICOLAS
# Update on 16/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 01:15:23 | 17/05/2009

# AMD Sempron(tm) 2600+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : McAfee VirusScan [ Enabled | (!) Outdated ]

# C:\ # Disque fixe local # 67,25 Go (11,85 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque amovible
# F:\ # Disque amovible
# G:\ # Disque fixe local # 111,78 Go (11,7 Go free) [Nicolas] # NTFS
# I:\ # Disque amovible
# J:\ # Disque CD-ROM
# K:\ # Disque amovible

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\qttask.exe
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
C:\WINDOWS\system32\CAP3RSK.EXE
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre # Startup ]

HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKCU_Main: "Start Page"="https://www.google.fr/?gws_rd=ssl"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Nico et marion"
HKLM_logon: "AltDefaultUserName"="Nico et marion"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: QuickTime Task="C:\WINDOWS\system32\qttask.exe" -atboottime
HKLM_Run: CAP3ON=C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
HKLM_Run: C-Media Mixer=Mixer.exe /startup
HKLM_Run: PinnacleDriverCheck=C:\WINDOWS\system32\PSDrvCheck.exe
HKLM_Run: MCUpdateExe=C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
HKLM_Run: MCAgentExe=C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
HKLM_Run: VirusScan Online="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
HKLM_Run: VSOCheckTask="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
HKCU_Run: MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background

################## [ Fichiers # Dossiers infectieux ]

Found ! G:\autorun.bat
Found ! G:\autorun.reg
Found ! G:\autorun.vbs
Found ! G:\copy.exe
Found ! G:\ravmone.exe
Found ! G:\autorun.inf
Found ! G:\copy.exe
Found ! G:\host.exe
Found ! G:\msvcr71.dll

################## [ Registre # Clés Run infectieuses ]

Found ! HKLM\software\microsoft\security center\\ "AntiVirusDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
Found ! HKLM\software\microsoft\security center\\ "FirewallDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )

################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\{c033d376-ad05-11db-8940-0011098d624a}\Shell\AutoRun\Command

################## [ ! Fin du rapport # UsbFix V3.021 ! ]





Je n'est toujours pas rectivé ma restauration système .
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
21 mai 2009 à 12:39
Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau

# choisis l'option 2 ( Suppression )

# Ton bureau disparaitra et le pc redémarrera .

# Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

# Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
0
voici le rapport usb fix


############################## [ UsbFix V3.021 # Cleaning ]

# User : Nico et marion (Administrateurs) # NICOLAS
# Update on 16/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 13:05:00 | 21/05/2009

# AMD Sempron(tm) 2600+
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : McAfee VirusScan [ Enabled | (!) Outdated ]

# C:\ # Disque fixe local # 67,25 Go (14,1 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque amovible
# F:\ # Disque amovible
# G:\ # Disque fixe local # 111,78 Go (11,7 Go free) [Nicolas] # NTFS
# I:\ # Disque amovible
# J:\ # Disque CD-ROM
# K:\ # Disque amovible

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\CAP3RSK.EXE
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE

################## [ Fichiers # Dossiers infectieux ]

Deleted ! G:\autorun.bat
Deleted ! G:\autorun.reg
Deleted ! G:\autorun.vbs
Deleted ! G:\copy.exe
Deleted ! G:\ravmone.exe
Deleted ! G:\autorun.inf
Deleted ! G:\host.exe
Deleted ! G:\msvcr71.dll

################## [ Registre # Clés Run infectieuses ]

# HKLM\software\microsoft\security center\\ "AntiVirusDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
# HKLM\software\microsoft\security center\\ "FirewallDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !

################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\...\Explorer\MountPoints2\{c033d376-ad05-11db-8940-0011098d624a}\Shell\AutoRun\Command

################## [ Listing des fichiers présent ]

[24/11/2004 18:37|--a------|0] - C:\AUTOEXEC.BAT
[30/07/2006 17:20|-rahs----|959] - C:\autorun.bin
[14/06/2006 04:26|-rahs----|24] - C:\autorun.txt
[06/07/2006 13:58|-rahs----|72] - C:\autorun.wsh
[11/05/2009 23:20|--a------|216] - C:\Boot.bak
[14/05/2009 21:35|-rahs----|286] - C:\boot.ini
[05/08/2004 14:00|-rahs----|4952] - C:\Bootfont.bin
[27/07/2008 11:39|--a------|536] - C:\checkrun.txt
[03/08/2004 23:00|--a------|263488] - C:\cmldr
[14/05/2009 22:00|--a------|21187] - C:\ComboFix.txt
[24/11/2004 18:37|--a------|0] - C:\CONFIG.SYS
[06/03/2007 16:46|--a------|0] - C:\DBS.TXT
[09/06/2008 09:25|--a------|14682] - C:\debug.log
[?|?|?] - C:\hiberfil.sys
[24/11/2004 18:37|-rahs----|0] - C:\IO.SYS
[25/11/2004 16:50|--ah-----|741] - C:\IPH.PH
[24/11/2004 18:37|-rahs----|0] - C:\MSDOS.SYS
[05/08/2004 14:00|-rahs----|47564] - C:\NTDETECT.COM
[21/10/2008 07:21|-rahs----|252240] - C:\ntldr
[?|?|?] - C:\pagefile.sys
[27/07/2008 12:17|--a------|5632] - C:\PclePctv60ePreview.failed.grf
[02/02/2005 18:30|--a------|90] - C:\Setup.log
[08/09/2008 18:18|--a------|168] - C:\setupfax.log
[18/11/2008 22:23|--ah-----|268] - C:\sqmdata00.sqm
[03/12/2008 08:04|--ah-----|268] - C:\sqmdata01.sqm
[19/12/2008 14:46|--ah-----|268] - C:\sqmdata02.sqm
[17/01/2009 19:04|--ah-----|268] - C:\sqmdata03.sqm
[05/05/2009 22:11|--ah-----|268] - C:\sqmdata04.sqm
[06/05/2009 13:38|--ah-----|268] - C:\sqmdata05.sqm
[21/05/2009 02:10|--ah-----|268] - C:\sqmdata06.sqm
[23/08/2008 15:43|--ah-----|268] - C:\sqmdata07.sqm
[07/09/2008 02:52|--ah-----|268] - C:\sqmdata08.sqm
[17/09/2008 19:03|--ah-----|268] - C:\sqmdata09.sqm
[16/10/2008 11:16|--ah-----|268] - C:\sqmdata10.sqm
[20/10/2008 15:29|--ah-----|292] - C:\sqmdata11.sqm
[20/10/2008 15:37|--ah-----|268] - C:\sqmdata12.sqm
[20/10/2008 15:45|--ah-----|280] - C:\sqmdata13.sqm
[20/10/2008 16:03|--ah-----|268] - C:\sqmdata14.sqm
[20/10/2008 16:19|--ah-----|268] - C:\sqmdata15.sqm
[20/10/2008 16:38|--ah-----|268] - C:\sqmdata16.sqm
[03/11/2008 19:22|--ah-----|268] - C:\sqmdata17.sqm
[03/11/2008 19:32|--ah-----|268] - C:\sqmdata18.sqm
[03/11/2008 19:40|--ah-----|268] - C:\sqmdata19.sqm
[18/11/2008 22:23|--ah-----|244] - C:\sqmnoopt00.sqm
[03/12/2008 08:04|--ah-----|244] - C:\sqmnoopt01.sqm
[19/12/2008 14:46|--ah-----|244] - C:\sqmnoopt02.sqm
[17/01/2009 19:04|--ah-----|244] - C:\sqmnoopt03.sqm
[05/05/2009 22:11|--ah-----|244] - C:\sqmnoopt04.sqm
[06/05/2009 13:38|--ah-----|244] - C:\sqmnoopt05.sqm
[21/05/2009 02:10|--ah-----|244] - C:\sqmnoopt06.sqm
[23/08/2008 15:43|--ah-----|244] - C:\sqmnoopt07.sqm
[07/09/2008 02:52|--ah-----|244] - C:\sqmnoopt08.sqm
[17/09/2008 19:03|--ah-----|244] - C:\sqmnoopt09.sqm
[16/10/2008 11:16|--ah-----|244] - C:\sqmnoopt10.sqm
[20/10/2008 15:29|--ah-----|244] - C:\sqmnoopt11.sqm
[20/10/2008 15:37|--ah-----|244] - C:\sqmnoopt12.sqm
[20/10/2008 15:45|--ah-----|244] - C:\sqmnoopt13.sqm
[20/10/2008 16:03|--ah-----|244] - C:\sqmnoopt14.sqm
[20/10/2008 16:19|--ah-----|244] - C:\sqmnoopt15.sqm
[20/10/2008 16:38|--ah-----|244] - C:\sqmnoopt16.sqm
[03/11/2008 19:22|--ah-----|244] - C:\sqmnoopt17.sqm
[03/11/2008 19:32|--ah-----|244] - C:\sqmnoopt18.sqm
[03/11/2008 19:40|--ah-----|244] - C:\sqmnoopt19.sqm
[21/05/2009 13:06|--a------|5807] - C:\UsbFix.txt
[13/02/2009 19:23|--a------|3230033] - G:\- Alesha Dixon - The boys does nothing.mp3
[13/02/2009 19:05|--a------|3041616] - G:\01-Sherifa Luna- Ce qu'ils aiment.mp3
[04/04/2009 06:52|--a------|1467097088] - G:\AUSTRALIA.DVDRIP.FR.VVF.COOLI.[emule-island.com].avi
[30/07/2006 17:20|-rahs----|959] - G:\autorun.bin
[14/06/2006 11:06|-rahs----|203] - G:\AUTORUN.FCB
[14/06/2006 04:26|-rahs----|24] - G:\autorun.txt
[06/07/2006 13:58|-rahs----|72] - G:\autorun.wsh
[13/02/2009 19:10|--a------|5414799] - G:\Copie de [0] Peps - Liberta.mp3
[04/04/2009 17:17|--a------|652908544] - G:\Daryl - Fooler Doolers - vol 4.avi
[07/10/2008 17:59|--a------|734021632] - G:\Hancock.FRENCH.DVDRiP.XviD-ULTRASON.caline012.LcKt.[emule-island.com].avi
[17/11/2008 19:52|--a------|364407108] - G:\Heroes.3x08.Villains.VOSTFR.HDTV.XviD-GDXFD.[emule-island.com].avi
[04/04/2009 02:46|--a------|365227104] - G:\Heroes.S03E20.VOSTFR.HDTV.XviD-Bjork.[emule-island.com].avi
[04/04/2009 03:38|--a------|364317126] - G:\Heroes.S03E21.VOSTFR.HDTV.XviD-Bjork.[emule-island.com].avi
[15/12/2008 03:17|--a------|735913984] - G:\Les.Rebelles.De.La.Foret.2.TRUEFRENCH.DVDRIP.XVID-SYR.avi
[04/04/2009 16:38|--a------|361854112] - G:\Lost.5x11.Whatever.Happened.Happened.VOSTFR.PROPER.HDTV.XviD-AlFleNi-TeaM.[emule-island.com].avi
[31/01/2009 23:20|--a------|387262556] - G:\lost.s05e03.vostf.avi
[13/02/2009 19:15|--a------|5611648] - G:\Neyo - Miss Independant.mp3
[22/01/2009 10:41|--a------|734423040] - G:\Nick.And.Noahs.Infinite.Playlist.FRENCH.DVDRip.XViD-NERD.FUCK.[emule-island.com].avi
[04/04/2009 02:45|--a------|692202970] - G:\OUTLANDER.2008.FRENCH.DVDRiP.XViD-OLi82.FUCK.[emule-island.com].avi
[15/12/2008 03:52|--a------|733849600] - G:\Sans.Arme.Ni.Haine.Ni.Violence.FRENCH.DVDRiP.XViD-PROD.LcKtM.[emule-island.com].avi
[08/10/2008 02:16|--a------|737957888] - G:\Strays.2008.STV.FRENCH.DVDRiP.XViD-iPS.LcKtM.[emule-island.com].avi
[04/04/2009 20:02|--a------|733990912] - G:\The.Andromeda.Strain.Part.1.FRENCH.DVDRiP.XviD-BaLLanTeAm.[emule-island.com].avi
[04/04/2009 19:52|--a------|734052352] - G:\The.Andromeda.Strain.Part.2.FiNAL.FRENCH.DVDRiP.XviD-BaLLanTeAm.[emule-island.com].avi
[01/04/2009 01:35|--a------|718018560] - G:\The.Broken.2008.LiMiTED.FRENCH.DVDRiP.XviD-ULTRASON.FUCK.[emule-island.com].avi
[02/03/2009 08:30|--a------|732710912] - G:\The.Day.The.Earth.Stood.Still.2008.FRENCH.DVDRiP.XviD-ULTRASON.FUCK.[emule-island.com].avi
[01/04/2009 03:01|--a------|370401214] - G:\The.Legend.of.the.Seeker.1x16.Bloodline.VOstFR.HDTV.XviD-AlFleNi-TeaM-.[emule-island.com].avi
[15/02/2009 20:19|--ahs----|17920] - G:\Thumbs.db

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# G:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.

################## [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! Fin du rapport # UsbFix V3.021 ! ]
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
21 mai 2009 à 13:53
remets un rapport RSIT

et dis tes soucis actuels
0
RAPPORT RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Nico et marion at 2009-05-21 13:56:59
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 16 GB (23%) free of 69 GB
Total RAM: 1279 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:57:02, on 21/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\CAP3RSK.EXE
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Nico et marion\Bureau\RSIT.exe
C:\Program Files\trend micro\Nico et marion.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CAP3ON] C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
21 mai 2009 à 14:25
malwarebyte ?


scanne rapide avec
MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­­



____________


colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
0
rapport ot move it

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
G:\AUTORUN.FCB moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\YG94I9UH\01[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\YG94I9UH\im[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\VZNJHBIT\default[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\VZNJHBIT\InboxLight[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\VZNJHBIT\ToastFull[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\VZNJHBIT\ToastMini[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\B0KIQQNM\2G30WCA667S39CAWS2HPKCA5Q991TCAF88PBPCAAEOQZJCA4WOEZQCAPGRIPTCAXX1SR3CASKPYMUCADD5FBDCAATATQ9CAY7VMD1CABK6PDICAEIOVGNCAPDPFBZCA23BKH0CAMJFDJQCAHI8F66.htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\B0KIQQNM\google_fr[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\5B9HETOA\forum-7-virus-securite[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05212009_185429
0
rapport MalwareByte's Anti-Malware :
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2132
Windows 5.1.2600 Service Pack 3

21/05/2009 14:55:54
mbam-log-2009-05-21 (14-55-54).txt

Type de recherche: Examen rapide
Eléments examinés: 85004
Temps écoulé: 6 minute(s), 18 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
0
jlpjlp Messages postés 51580 Date d'inscription vendredi 18 mai 2007 Statut Contributeur sécurité Dernière intervention 3 mai 2022 5 040
21 mai 2009 à 18:42
colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
0