je recois trop de pop up Fermé

Question

Bonjour,

j'aurais besoin d'aide afin de savoir comment éliminer les pop up. J'utilise mozilla firefoz la nouvelle version. J'ai telecharger loop sd alors si quelqu'un peut m'aider ce serait TRES aprecié packe ils menervent royalement

toptitbal · Answer

Bonjour

Télécharge le fichier d’installation d’Hijackthis en cliquant sur ce lien 

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

* Enregistre HJTInstall.exe sur ton bureau. 

* Double-clique sur HJTInstall.exe pour lancer le programme

Tuto : https://www.malekal.com/tutoriel-hijackthis/
	http://pagesperso-orange.fr/rginformatique/section%20virus/Hijenr.gif
	http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm

* Accepte la license en cliquant sur le bouton "I Accept"
* Choisis l'option "Do a system scan and save a log file"
* Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
* Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

* Colle le rapport que tu viens de copier sur ce forum

PL59 · Answer

Bonjour télécharge malwarebyte  http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebytes anti malware + le tuto https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm


Cordialement PL59

geek321 · Answer

est ce que je met tout le contenu du bloc note

toptitbal · Answer

Oui, bien sûr.

geek321 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:14:00, on 2009-05-17
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\OEM03Mon.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\DELL\DELL Webcam Manager\DellWMgr.exe
C:\Users\salim\lsass.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32undll32.exe
C:\Program Files\Bell\Forfait sécurité d'affaires\RPS.exe
C:\Program Files\Bell\Bell Business Security Servicepoint\BBSS.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Users\salim\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://ca.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer fourni par Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [D-Link Wireless G WDA-1320] C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OEM03Mon.exe] C:\Windows\OEM03Mon.exe
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [Windows Service] C:\Users\salim\service.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [Lsass Service] C:\Users\salim\dCXxTaEm.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [Microsoft Windows Installer] C:\Users\salim\AppData\Roaming\msiexec.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [userinit] C:\Users\salim\AppData\Roaming\oembios.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [MSServer] rundll32.exe C:\Users\salim\AppData\Local\Temp\iifEwWPh.dll,#1 (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [Windows Logon] C:\Users\salim\winIogon.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [svchost] C:\Users\salim\AppData\Local\TempdlAD23.tmp.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [wutukahuni] Rundll32.exe "C:\ProgramData	utedolu	utedolu.dll",s (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [IExplorer] C:\Users\salim\inexplorer.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [5a688c07] rundll32.exe "C:\ProgramDataaromozoaromozo.dll",b (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [CPM595bbf9b] Rundll32.exe "C:\ProgramData\zukuzibi\zukuzibi.dll",a (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\RunOnce: [IndexCleaner] "C:\Program Files\Bell\Forfait sécurité d'affaires\IdxClnR.exe" (User 'salim')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Coffre-fort pour entreprise (VaultClientSRV) - BELL - C:\Program Files\Business Vault\VaultClientSRV.exe

geek321 · Answer

alors je fais quoi maintenant

geek321 · Answer

svp quelqu'un aidez moi !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

toptitbal · Answer

Oups, pardon geek321, ton topik n'était plus dans "Mes interventions".

Télécharges ComboFix : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

A lire 
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix 

Et important, enregistre le sur le bureau.


Lors de son exécution, ComboFix va vérifier si la Console de récupération Microsoft Windows est installée. Avec des infections comme celles d'aujourd'hui, il est fortement conseillé de l'avoir pré-installée sur votre PC avant toute suppression de nuisibles. Elle vous permettra de démarrer dans un mode spécial, de récupération (réparation), qui nous permet de vous aider plus facilement si jamais votre ordinateur rencontre un problème après une tentative de nettoyage. 
Suivez les invites pour permettre à ComboFix de télécharger et installer la Console de récupération Microsoft Windows, et lorsque cela vous est demandé, acceptez le Contrat de Licence Utilisateur Final pour installer la Console de récupération Microsoft Windows. 

Sous XP 
https://support.microsoft.com/en-us/help/310994 

Sous Vista 
https://www.commentcamarche.net/list 13735 console de recuperation vista sur cd bootable 
**Note importante: Si la Console de récupération Microsoft Windows est déjà installée, ComboFix continuera ses procédures de suppression de nuisibles.


Avant d'utiliser ComboFix : 

&#9658; Déconnecte-toi d'internet et referme les fenêtres de tous les programmes en cours. 

&#9658; Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. 


Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes, ne touche ni à la souris, ni au clavier.

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

&#9658; Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

&#9658; Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

geek321 · Answer

c bon je vais faire cela

geek321 · Answer

juste une petite question avant de commencer jai entendu parler que cela pouver supprimer des fichiers legitimes mais c'est quoi ?

geek321 · Answer

et voila

c:\temp\1cb
c:\temp\1cb\syscheck.log
c:\temp\FT62
c:\temp\FT62\teTU.log
c:\users\mustapha\AppData\Local\Microsoft\Windows\Temporary Internet Files\bestwiner.stt
c:\users\mustapha\AppData\Local\Microsoft\Windows\Temporary Internet Files\fbk.sts
c:\users\mustapha\AppData\Roaming\gadcom
c:\users\mustapha\AppData\Roaming\gadcom\gadcom.exe
c:\users\mustapha\AppData\Roaming\twain\Twain.exe
c:\users\mustapha\ctfmon.exe
c:\users\mustapha\lsass.exe
c:\users\salim\AppData\Roaming\Microsoft\Windows\lsass.exe
c:\users\salim\AppData\Roaming\sysproc64
c:\users\salim\AppData\Roaming\sysproc64\sysproc32.sys
c:\users\salim\AppData\Roaming\sysproc64\sysproc32.sys.cla
c:\users\salim\AppData\Roaming\sysproc64\sysproc86.sys
c:\users\salim\AppData\Roaming\twain_32
c:\users\salim\lsass.exe
c:\users\salim\services.exe
c:\windows\system32\atmtd.dll._
c:\windows\system32\dPI02
c:\windows\system32\dPI02\dPI022328.exe
c:\windows\system32\pac.txt

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-04-20 au 2009-05-20  ))))))))))))))))))))))))))))))))))))
.

2009-05-20 19:12 . 2009-05-20 19:12	--------	d-----w	c:\programdata\sunapija
2009-05-20 19:12 . 2009-05-20 19:12	--------	d-----w	c:\programdata\talefake
2009-05-20 19:12 . 2009-05-20 19:12	--------	d-----w	c:\users\All Users\sunapija
2009-05-20 19:12 . 2009-05-20 19:12	--------	d-----w	c:\users\All Users\talefake
2009-05-19 23:06 . 2009-05-19 23:06	--------	d-----w	c:\programdata\jenupiso
2009-05-19 23:06 . 2009-05-19 23:06	--------	d-----w	c:\programdata\vopeside
2009-05-19 23:06 . 2009-05-19 23:06	--------	d-----w	c:\users\All Users\jenupiso
2009-05-19 23:06 . 2009-05-19 23:06	--------	d-----w	c:\users\All Users\vopeside
2009-05-18 14:56 . 2009-05-18 14:56	--------	d-----w	c:\programdata\riyijuvu
2009-05-18 14:56 . 2009-05-18 14:56	--------	d-----w	c:\programdata\sobipore
2009-05-18 14:56 . 2009-05-18 14:56	--------	d-----w	c:\users\All Users\riyijuvu
2009-05-18 14:56 . 2009-05-18 14:56	--------	d-----w	c:\users\All Users\sobipore
2009-05-17 17:13 . 2009-05-17 17:13	--------	d-----w	c:\program files\Trend Micro
2009-05-17 13:18 . 2009-05-17 13:18	--------	d-----w	c:\programdata\kidoyera
2009-05-17 13:18 . 2009-05-17 13:18	--------	d-----w	c:\programdata\zukuzibi
2009-05-17 13:18 . 2009-05-17 13:18	--------	d-----w	c:\users\All Users\kidoyera
2009-05-17 13:18 . 2009-05-17 13:18	--------	d-----w	c:\users\All Users\zukuzibi
2009-05-16 18:29 . 2009-05-16 18:31	--------	d-----w	C:\Lop SD
2009-05-16 15:37 . 2009-05-16 15:37	--------	d-----w	c:\programdata\jisaleyu
2009-05-16 15:37 . 2009-05-16 15:37	--------	d-----w	c:\programdata\pegatijo
2009-05-16 15:37 . 2009-05-16 15:37	--------	d-----w	c:\users\All Users\jisaleyu
2009-05-16 15:37 . 2009-05-16 15:37	--------	d-----w	c:\users\All Users\pegatijo
2009-05-15 13:32 . 2009-05-15 13:32	--------	d-----w	c:\programdata\kejefuru
2009-05-15 13:32 . 2009-05-20 19:24	--------	d-----w	c:\programdata\raromozo
2009-05-15 13:32 . 2009-05-15 13:32	--------	d-----w	c:\users\All Users\kejefuru
2009-05-15 13:32 . 2009-05-20 19:24	--------	d-----w	c:\users\All Users\raromozo
2009-05-14 22:59 . 2009-05-14 23:20	--------	d-----w	c:\programdata\kabolape
2009-05-14 22:59 . 2009-05-14 23:20	--------	d-----w	c:\users\All Users\kabolape
2009-05-14 22:59 . 2009-05-14 22:59	--------	d-----w	c:\programdata\jayipesa
2009-05-14 22:59 . 2009-05-14 22:59	--------	d-----w	c:\users\All Users\jayipesa
2009-05-14 10:58 . 2009-05-14 22:27	--------	d-----w	c:\programdata\dofakase
2009-05-14 10:58 . 2009-05-14 22:27	--------	d-----w	c:\users\All Users\dofakase
2009-05-14 10:58 . 2009-05-14 10:58	--------	d-----w	c:\programdata\vubabuku
2009-05-14 10:58 . 2009-05-14 10:58	--------	d-----w	c:\users\All Users\vubabuku
2009-05-13 19:53 . 2009-05-13 19:53	--------	d-----w	c:\programdata\guhefawa
2009-05-13 19:53 . 2009-05-13 19:53	--------	d-----w	c:\programdata\kokemabo
2009-05-13 19:53 . 2009-05-13 19:53	--------	d-----w	c:\users\All Users\guhefawa
2009-05-13 19:53 . 2009-05-13 19:53	--------	d-----w	c:\users\All Users\kokemabo
2009-05-12 20:21 . 2009-05-12 20:21	--------	d-----w	c:\programdata\papevili
2009-05-12 20:21 . 2009-05-12 20:21	--------	d-----w	c:\users\All Users\papevili
2009-05-12 20:21 . 2009-05-12 20:21	--------	d-----w	c:\programdata\mafaguzu
2009-05-12 20:21 . 2009-05-12 20:21	--------	d-----w	c:\users\All Users\mafaguzu
2009-05-12 20:21 . 2009-05-12 20:21	--------	d-----w	c:\programdata\vewaboji
2009-05-12 20:21 . 2009-05-12 20:21	--------	d-----w	c:\users\All Users\vewaboji
2009-05-11 19:12 . 2009-05-11 19:12	--------	d-----w	c:\programdata\tijevilu
2009-05-11 19:12 . 2009-05-11 19:12	--------	d-----w	c:\users\All Users\tijevilu
2009-05-11 19:10 . 2009-05-12 20:03	20480	----a-w	c:\users\salim\msiexec.exe
2009-05-10 14:21 . 2009-05-10 14:21	--------	d-----w	c:\programdata\luravufa
2009-05-10 14:21 . 2009-05-10 14:22	--------	d-----w	c:\programdata\siriluje
2009-05-10 14:21 . 2009-05-10 14:21	--------	d-----w	c:\users\All Users\luravufa
2009-05-10 14:21 . 2009-05-10 14:22	--------	d-----w	c:\users\All Users\siriluje
2009-05-07 19:19 . 2009-05-07 19:19	--------	d-----w	c:\programdata\pugibevu
2009-05-07 19:19 . 2009-05-07 19:19	--------	d-----w	c:\users\All Users\pugibevu
2009-05-07 19:19 . 2009-05-07 19:19	--------	d-----w	c:\programdata\kikepomo
2009-05-07 19:19 . 2009-05-07 19:19	--------	d-----w	c:\users\All Users\kikepomo
2009-05-07 19:19 . 2009-05-07 19:19	--------	d-----w	c:\programdata\repeseza
2009-05-07 19:19 . 2009-05-07 19:19	--------	d-----w	c:\users\All Users\repeseza
2009-05-07 19:07 . 2009-05-07 19:07	--------	d-----w	c:\programdata\firahufu
2009-05-07 19:07 . 2009-05-07 19:07	--------	d-----w	c:\users\All Users\firahufu
2009-05-07 19:07 . 2009-05-07 19:07	--------	d-----w	c:\programdata\buyoyena
2009-05-07 19:07 . 2009-05-07 19:07	--------	d-----w	c:\programdata\kapekabo
2009-05-07 19:07 . 2009-05-07 19:07	--------	d-----w	c:\users\All Users\buyoyena
2009-05-07 19:07 . 2009-05-07 19:07	--------	d-----w	c:\users\All Users\kapekabo
2009-05-06 21:51 . 2009-05-06 21:51	23040	----a-w	c:\users\salim\sXzWpWOlncv.exe
2009-05-06 19:15 . 2009-05-06 19:15	--------	d-----w	c:\programdata\guniyiyu
2009-05-06 19:15 . 2009-05-06 19:15	--------	d-----w	c:\users\All Users\guniyiyu
2009-05-06 19:15 . 2009-05-06 19:15	--------	d-----w	c:\programdata\ribehige
2009-05-06 19:15 . 2009-05-06 19:15	--------	d-----w	c:\programdata\vekesuwo
2009-05-06 19:15 . 2009-05-06 19:15	--------	d-----w	c:\users\All Users\ribehige
2009-05-06 19:15 . 2009-05-06 19:15	--------	d-----w	c:\users\All Users\vekesuwo
2009-05-06 19:15 . 2009-05-06 19:15	23040	----a-w	c:\users\salim\tZbYrY.exe
2009-05-05 19:48 . 2009-05-05 19:48	--------	d-----w	c:\programdata\puzominu
2009-05-05 19:48 . 2009-05-05 19:48	--------	d-----w	c:\users\All Users\puzominu
2009-05-05 19:48 . 2009-05-05 19:48	--------	d-----w	c:\programdata\titohoru
2009-05-05 19:48 . 2009-05-05 19:48	--------	d-----w	c:\users\All Users\titohoru
2009-05-05 19:48 . 2009-05-05 19:48	--------	d-----w	c:\programdata\vetuyija
2009-05-05 19:48 . 2009-05-05 19:48	--------	d-----w	c:\users\All Users\vetuyija
2009-05-04 20:38 . 2009-05-04 20:38	--------	d-----w	c:\programdata\bikuhagu
2009-05-04 20:38 . 2009-05-04 20:38	--------	d-----w	c:\users\All Users\bikuhagu
2009-05-04 20:37 . 2009-05-04 20:37	--------	d-----w	c:\programdata\hagebuzi
2009-05-04 20:37 . 2009-05-04 20:37	--------	d-----w	c:\programdata\hikenile
2009-05-04 20:37 . 2009-05-04 20:37	--------	d-----w	c:\users\All Users\hagebuzi
2009-05-04 20:37 . 2009-05-04 20:37	--------	d-----w	c:\users\All Users\hikenile
2009-05-03 16:55 . 2009-05-03 16:55	--------	d-----w	c:\programdata\waritili
2009-05-03 16:55 . 2009-05-03 16:55	--------	d-----w	c:\users\All Users\waritili
2009-05-03 16:55 . 2009-05-03 16:55	--------	d-----w	c:\programdata\fatodogi
2009-05-03 16:55 . 2009-05-03 16:55	--------	d-----w	c:\programdata\yujodiju
2009-05-03 16:55 . 2009-05-03 16:55	--------	d-----w	c:\users\All Users\fatodogi
2009-05-03 16:55 . 2009-05-03 16:55	--------	d-----w	c:\users\All Users\yujodiju
2009-05-02 16:47 . 2009-05-02 16:47	--------	d-----w	c:\programdata\wivawira
2009-05-02 16:47 . 2009-05-02 16:47	--------	d-----w	c:\users\All Users\wivawira
2009-05-02 16:47 . 2009-05-02 16:47	--------	d-----w	c:\programdata\figepevo
2009-05-02 16:47 . 2009-05-02 16:47	--------	d-----w	c:\programdata\rusahene
2009-05-02 16:47 . 2009-05-02 16:47	--------	d-----w	c:\users\All Users\figepevo
2009-05-02 16:47 . 2009-05-02 16:47	--------	d-----w	c:\users\All Users\rusahene
2009-05-02 16:40 . 2009-05-02 16:44	--------	d--h--w	c:\users\TEMP.PC-de-mustapha.001\AppData
2009-05-02 16:40 . 2009-05-02 16:44	--------	d-----w	c:\users\TEMP.PC-de-mustapha.001
2009-04-30 21:20 . 2009-04-30 21:20	--------	d-----w	c:\users\salim\AppData\Roaming\tmp
2009-04-30 19:33 . 2009-04-30 19:33	--------	d-----w	c:\programdata\popifimi
2009-04-30 19:33 . 2009-04-30 19:33	--------	d-----w	c:\users\All Users\popifimi
2009-04-30 19:33 . 2009-04-30 19:33	--------	d-----w	c:\programdata\marewugo
2009-04-30 19:33 . 2009-04-30 19:33	--------	d-----w	c:\programdata\vebimayo
2009-04-30 19:33 . 2009-04-30 19:33	--------	d-----w	c:\users\All Users\marewugo
2009-04-30 19:33 . 2009-04-30 19:33	--------	d-----w	c:\users\All Users\vebimayo
2009-04-29 19:17 . 2009-05-13 20:05	--------	d-----w	c:\programdata\majubilu
2009-04-29 19:17 . 2009-05-13 20:05	--------	d-----w	c:\users\All Users\majubilu
2009-04-29 19:17 . 2009-04-29 19:17	--------	d-----w	c:\programdata\gevimasi
2009-04-29 19:17 . 2009-04-29 19:17	--------	d-----w	c:\users\All Users\gevimasi
2009-04-29 00:01 . 2009-04-29 00:23	--------	d-----w	c:\programdata\yuterahi
2009-04-29 00:01 . 2009-04-29 00:23	--------	d-----w	c:\users\All Users\yuterahi
2009-04-29 00:01 . 2009-04-29 00:01	--------	d-----w	c:\programdata\kimupabe
2009-04-29 00:01 . 2009-04-29 00:01	--------	d-----w	c:\users\All Users\kimupabe
2009-04-29 00:01 . 2009-04-29 00:01	--------	d-----w	c:\programdata\litugesi
2009-04-29 00:01 . 2009-04-29 00:01	--------	d-----w	c:\users\All Users\litugesi
2009-04-27 14:42 . 2003-02-19 04:01	40960	----a-w	c:\windows\system32\BRVPD95A.DLL
2009-04-27 14:42 . 2004-10-04 05:03	36864	----a-w	c:\windows\system32\BRVPDNTA.DLL
2009-04-27 14:42 . 2000-09-06 21:47	26624	----a-w	c:\windows\system32\BRGSRC32.DLL
2009-04-27 14:42 . 2000-09-06 21:11	4608	----a-w	c:\windows\system32\BRGSRC16.DLL
2009-04-27 14:42 . 2004-09-17 04:00	196608	----a-w	c:\windows\system32\Brdiag2.exe
2009-04-27 14:42 . 2004-09-24 04:00	24223	----a-w	c:\windows\system32\brlm03a.dll
2009-04-27 14:42 . 2004-08-16 04:00	73728	----a-w	c:\windows\system32\BRRBTOOL.EXE
2009-04-27 14:42 . 2003-08-21 05:00	77824	----a-w	c:\windows\system32\BROSNMP.DLL
2009-04-27 14:40 . 2009-04-27 14:40	34	----a-w	c:\windows\system32\BD2040.DAT
2009-04-27 14:40 . 2004-10-12 05:24	188416	----a-w	c:\windows\system32\Pdrvinst.dll
2009-04-27 14:40 . 2002-10-31 05:09	81920	----a-w	c:\windows\system32\BrWebIns.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-20 12:15 . 2007-11-28 16:41	12	----a-w	c:\windows\bthservsdp.dat
2009-05-13 20:08 . 2006-11-02 11:18	--------	d-----w	c:\program files\Windows Mail
2009-05-03 22:04 . 2008-03-26 02:15	680	----a-w	c:\users\salim\AppData\Local\d3d9caps.dat
2009-04-27 14:42 . 2007-12-15 14:21	--------	d-----w	c:\program files\Brownie
2009-04-27 14:40 . 2007-11-28 16:43	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-04-19 00:28 . 2009-02-05 02:22	--------	d-----w	c:\program files\iTunes
2009-04-19 00:28 . 2009-04-19 00:28	--------	d-----w	c:\program files\iPod
2009-04-19 00:28 . 2007-12-21 23:55	--------	d-----w	c:\program files\Common Files\Apple
2009-04-18 21:45 . 2009-04-18 21:45	48128	----a-w	c:\users\salim\otwSmSKijYr.exe
2009-04-08 22:50 . 2009-02-15 22:44	49234	----a-w	c:\windows\system32\perfh00C.dat
2009-04-08 22:50 . 2009-02-15 22:44	11514	----a-w	c:\windows\system32\perfc00C.dat
2009-03-27 00:22 . 2009-03-27 00:22	0	------w	c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-03-26 23:45 . 2009-03-26 23:45	--------	d-----w	c:\program files\Bonjour
2009-03-26 23:39 . 2009-03-26 23:39	--------	d-----w	c:\program files\Safari
2009-03-19 20:32 . 2009-04-19 00:28	23400	------w	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-17 03:38 . 2009-04-15 22:46	13824	----a-w	c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 22:46	24064	----a-w	c:\windows\system32\amxread.dll
2009-03-06 18:31 . 2009-03-06 18:31	7622336	----a-w	c:\users\salim\firefox(2).exe
2009-03-06 03:59 . 2009-03-06 03:59	36864	------w	c:\windows\system32\drivers\usbaapl.sys
2009-03-06 03:59 . 2009-03-06 03:59	1900544	----a-w	c:\windows\system32\usbaaplrc.dll
2009-03-03 04:46 . 2009-04-15 22:46	3599328	----a-w	c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-15 22:46	3547632	----a-w	c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-15 22:46	827392	----a-w	c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-15 22:46	183296	----a-w	c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-15 22:46	551424	----a-w	c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-15 22:46	26112	----a-w	c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-15 22:46	78336	----a-w	c:\windows\system32\ieencode.dll
2009-03-03 04:37 . 2009-04-15 22:46	98304	----a-w	c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-15 22:46	44032	----a-w	c:\windows\system32\iasdatastore.dll
2009-03-03 04:37 . 2009-04-15 22:46	54784	----a-w	c:\windows\system32\iasads.dll
2009-03-03 03:04 . 2009-04-15 22:46	666624	----a-w	c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-15 22:46	17408	----a-w	c:\windows\system32\iashost.exe
2009-03-03 02:28 . 2009-04-15 22:46	26624	----a-w	c:\windows\system32\ieUnatt.exe
2009-03-02 17:38 . 2009-02-22 19:33	29696	----a-w	c:\users\salim\setupapi.dll
2009-02-25 23:06 . 2008-03-23 01:58	680	----a-w	c:\users\mustapha\AppData\Local\d3d9caps.dat
2008-06-27 04:18 . 2006-11-02 12:50	174	--sha-w	c:\program files\desktop.ini
2008-12-12 16:09 . 2008-12-12 16:09	122880	----a-w	c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2007-12-23 15:46 . 2007-11-28 16:47	76	--sh--r	c:\windows\CT4CET.bin
2005-08-02 21:46 . 2008-11-28 14:44	187904	--sha-r	c:\windows\bXVzdGFwaGE\asappsrv.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-28 68856]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-12-12 29744]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656]
"D-Link Wireless G WDA-1320"="c:\program files\D-Link\Wireless G WDA-1320\AirGCFG.exe" [2005-12-14 2711552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"OEM03Mon.exe"="c:\windows\OEM03Mon.exe" [2007-06-18 36864]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	PDBoot.exe\[u]0/uautocheck autochk *

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logiciel Kodak EasyShare.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Logiciel Kodak EasyShare.lnk
backup=c:\windows\pss\Logiciel Kodak EasyShare.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1369148199-3131422182-2722478985-1000]
"EnableNotificationsRef"=dword:00000002

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7732FDE7-731E-4739-9094-86731082BBA1}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{06A5B10F-673B-4290-A350-ED4D9C17D0F7}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{D2A8CEEA-8063-4386-B913-A9ECA95C6A54}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{55D671FE-439B-460D-ABA2-C3D74D4C7D32}c:\program files\internet explorer\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{30553B5B-CF70-4FBC-AB03-60648BA9C8FA}c:\program files\internet explorer\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{2627858E-9A71-4483-8C42-B88A7EEB0B87}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{3D1BC2FB-79D8-47B5-9C6B-64AE7193882F}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{7AF8AEEC-FC93-4949-94F2-B735FED883EF}"= UDP:d:\limewire\LimeWire.exe:LimeWire
"{6F3582E2-241F-4B42-AE25-E25A1A38674E}"= TCP:d:\limewire\LimeWire.exe:LimeWire
"{CD01E9C6-58C0-4F26-AE42-195B3DE2CAD3}"= UDP:c:\users\salim\Desktop\LOGICIELS\LimeWire\LimeWire.exe:LimeWire
"{A6FD1F1A-B2CA-4695-A137-31E32D8D2041}"= TCP:c:\users\salim\Desktop\LOGICIELS\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{719A474D-3A1E-442F-8C94-BB2DC8EE0578}c:\users\salim\documents\limewire\limewire.exe"= UDP:c:\users\salim\documents\limewire\limewire.exe:limewire.exe
"UDP Query User{91F41AD5-8022-410B-A82B-6830DECC4691}c:\users\salim\documents\limewire\limewire.exe"= TCP:c:\users\salim\documents\limewire\limewire.exe:limewire.exe
"{2003B2F6-30EE-4C09-8480-7E977A7FF151}"= UDP:e:\sthiw\STSetup.exe:SpeedTouch Home Install Wizard
"{555F3D63-D7C4-447E-9913-BCDF15AABD27}"= TCP:e:\sthiw\STSetup.exe:SpeedTouch Home Install Wizard
"TCP Query User{11A6E3DB-8C83-441B-9E7B-07F0D027D7D9}c:\users\salim\documents\limewire\limewire.exe"= UDP:c:\users\salim\documents\limewire\limewire.exe:limewire.exe
"UDP Query User{F75DD257-B817-4951-8FEB-5B7614172FFB}c:\users\salim\documents\limewire\limewire.exe"= TCP:c:\users\salim\documents\limewire\limewire.exe:limewire.exe
"TCP Query User{372ED069-268D-438D-A9CD-B4C83240F519}c:\program files\limewire\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{380F49B8-5B3D-4FAC-A490-EFB7A40F79C2}c:\program files\limewire\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire
"{6FB10E8D-9B62-4AA2-BF54-273D0655CAE2}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{8B764C24-0950-435E-A98B-3E46872E0642}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{AA261548-09B0-44F2-9F16-852A37489A45}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F7B3422F-EDE6-4EEF-B729-34915179830B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{BA31EA90-6955-40A7-A6C1-C43D8C0B82F3}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 VaultClientSRV;Coffre-fort pour entreprise;c:\program files\Business Vault\VaultClientSRV.exe [2008-07-22 966656]
R3 OEM03Vfx;Creative Camera OEM003 Video VFX Driver;c:\windows\System32\drivers\OEM03Vfx.sys [2007-11-28 7424]
R3 OEM03Vid;Creative Camera OEM003 Driver;c:\windows\System32\drivers\OEM03Vid.sys [2007-11-28 235808]
R3 RLDesignVirtualAudioCableWdm;Live! Cam Virtual;c:\windows\System32\drivers\livecamv.sys [2007-11-28 31616]
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\System32\drivers\A3AB.sys [2005-08-25 466880]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [2009-03-19 55280]
S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-11-28 29744]
S3 OEM03Afx;Provides a software interface to control audio effects of OEM003 camera.;c:\windows\System32\drivers\OEM03Afx.sys [2007-11-28 141376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Contenu du dossier 'Tâches planifiées'

2009-05-20 c:\windows\Tasks\User_Feed_Synchronization-{5B0BA250-157A-4CCC-95C4-D711FD4B98E4}.job
- c:\windows\system32\msfeedssync.exe [2008-05-14 07:33]
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://ca.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: CabBuilder - hxxp://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\users\mustapha\AppData\Roaming\Mozilla\Firefox\Profiles\8igttuwn.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.redaction.be/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPInfotl.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-20 15:34
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-05-20 15:36
ComboFix-quarantined-files.txt  2009-05-20 19:36

Avant-CF: 149 749 014 528 octets libres
Après-CF: 150 030 499 840 octets libres

330	--- E O F ---	2009-05-18 15:03

toptitbal · Answer

Il manque un petit bout du début du rapport, essaie de le retrouver stp.

geek321 · Answer

ComboFix 09-05-19.08 - mustapha 2009-05-20 15:25.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6001.1.1252.2.1036.18.2036.1130 [GMT -4:00]
Lancé depuis: c:\users\salim\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 * Un nouveau point de restauration a été créé

toptitbal · Answer

Comme tu as vu, beaucoup de fichiers infectés ont été supprimés, c'est bien.

Télécharge Lop S&D.exe sur ton Bureau.

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 

* Double-clique dessus pour lancer l'installation 
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau 
* Séléctionne la langue souhaitée, puis choisis l'option 1 (Recherche) 
* Patiente jusqu'à la fin du scan 
* Poste le rapport généré (C:\lopR.txt) 


Tutorial ( aide ) : http://bibou0007.com/outils-specifiques-f78/tuto-lop-sd-t956.htm

geek321 · Answer

Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     E4400  @ 2.00GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : mustapha ( Not Administrator ! )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:222 Go (Free:139 Go)
   D:\ (Local Disk) - NTFS - Total:9 Go (Free:6 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 2009-05-21|15:19 )

   [ UAC => 1 ]
 
   --------------------\  Listing des dossiers dans Local

   [2007-12-16|13:18] C:\Users\mustapha\AppData\Local\Adobe
   [2007-12-21|19:56] C:\Users\mustapha\AppData\Local\Apple
   [2009-03-26|20:49] C:\Users\mustapha\AppData\Local\Apple Computer
   [2007-12-04|10:17] C:\Users\mustapha\AppData\Local\Application Data 
   [2009-02-25|19:06] C:\Users\mustapha\AppData\Local\d3d9caps.dat
   [2009-04-05|18:37] C:\Users\mustapha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [2008-02-10|13:01] C:\Users\mustapha\AppData\Local\GDIPFONTCACHEV1.DAT
   [2009-05-01|09:15] C:\Users\mustapha\AppData\Local\Google
   [2007-12-04|10:17] C:\Users\mustapha\AppData\Local\Historique 
   [2009-05-08|14:54] C:\Users\mustapha\AppData\Local\IconCache.db
   [2008-05-22|22:10] C:\Users\mustapha\AppData\Local\keyfile3.drm
   [2008-06-09|17:50] C:\Users\mustapha\AppData\Local\KodakGallery
   [2009-05-20|15:34] C:\Users\mustapha\AppData\Local\Microsoft
   [2007-12-04|10:57] C:\Users\mustapha\AppData\Local\Microsoft Games
   [2008-03-07|12:49] C:\Users\mustapha\AppData\Local\Microsoft Help
   [2007-12-25|18:07] C:\Users\mustapha\AppData\Local\Mozilla
   [2007-12-04|10:39] C:\Users\mustapha\AppData\Local\SupportSoft
   [2009-05-20|21:12] C:\Users\mustapha\AppData\Local\Temp
   [2007-12-04|10:17] C:\Users\mustapha\AppData\Local\Temporary Internet Files 
   [2008-08-04|17:05] C:\Users\mustapha\AppData\Local\TomTom
   [2007-12-16|13:54] C:\Users\mustapha\AppData\Local\VirtualStore
   [2009-02-13|13:38] C:\Users\mustapha\AppData\Local\Windows Live Writer
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [2009-05-21 15:15][--ah-----] C:\Windows	asks\User_Feed_Synchronization-{5B0BA250-157A-4CCC-95C4-D711FD4B98E4}.job
   [2009-05-21 15:13][--ah-----] C:\Windows	asks\SA.DAT
   [2009-05-20 21:14][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [2009-03-26|19:46] C:\ProgramData\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
   [2009-04-18|20:28] C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
   [2008-03-03|10:21] C:\ProgramData\Adobe
   [2007-12-21|19:55] C:\ProgramData\Apple
   [2007-12-21|19:58] C:\ProgramData\Apple Computer
   [2007-12-04|10:13] C:\ProgramData\Application Data 
   [2009-03-03|09:27] C:\ProgramData\bafuvisi
   [2009-04-25|17:39] C:\ProgramData\banesija
   [2007-12-16|13:31] C:\ProgramData\Bell
   [2009-04-19|11:52] C:\ProgramData\bepikize
   [2009-04-15|18:35] C:\ProgramData\betinuni
   [2009-03-23|15:04] C:\ProgramData\betipafe
   [2009-03-13|14:59] C:\ProgramData\bewihafe
   [2009-03-02|13:37] C:\ProgramData\bijapeka
   [2009-05-04|16:38] C:\ProgramData\bikuhagu
   [2009-04-26|11:46] C:\ProgramData\biyedepu
   [2009-03-18|15:03] C:\ProgramData\bodozanu
   [2007-12-04|10:13] C:\ProgramData\Bureau 
   [2009-05-07|15:07] C:\ProgramData\buyoyena
   [2009-04-15|18:34] C:\ProgramData\dakomira
   [2008-01-18|18:09] C:\ProgramData\Dell
   [2007-12-04|10:13] C:\ProgramData\Documents 
   [2009-05-14|18:27] C:\ProgramData\dofakase
   [2009-03-14|12:15] C:\ProgramData\dupekayi
   [2008-05-11|09:01] C:\ProgramData\ezsidmv.dat
   [2009-03-27|19:00] C:\ProgramData\falozogi
   [2009-05-09|17:08] C:\ProgramData\fareruta
   [2009-05-03|12:55] C:\ProgramData\fatodogi
   [2007-12-04|10:13] C:\ProgramData\Favoris 
   [2009-04-15|21:30] C:\ProgramData\febobafi
   [2009-03-17|15:01] C:\ProgramData\feyimupa
   [2009-05-02|12:47] C:\ProgramData\figepevo
   [2009-03-19|15:11] C:\ProgramData\figohele
   [2009-05-07|15:07] C:\ProgramData\firahufu
   [2009-03-13|14:59] C:\ProgramData\foburune
   [2009-05-09|17:08] C:\ProgramData\fogehile
   [2009-03-16|16:12] C:\ProgramData\fowerovo
   [2009-04-18|17:46] C:\ProgramData\fudoneze
   [2009-05-21|15:17] C:\ProgramData\fumupofo
   [2009-03-12|15:10] C:\ProgramData\gaduvoma
   [2009-03-04|12:02] C:\ProgramData\gajukilu
   [2009-03-14|09:19] C:\ProgramData\garowori
   [2009-04-29|15:17] C:\ProgramData\gevimasi
   [2009-03-17|15:01] C:\ProgramData\godidusa
   [2009-01-16|09:08] C:\ProgramData\Google
   [2009-03-08|10:41] C:\ProgramData\gopuvuja
   [2009-03-30|15:46] C:\ProgramData\gosagure
   [2009-05-13|15:53] C:\ProgramData\guhefawa
   [2009-03-28|10:57] C:\ProgramData\gunawedi
   [2009-05-06|15:15] C:\ProgramData\guniyiyu
   [2009-05-04|16:37] C:\ProgramData\hagebuzi
   [2009-05-09|17:07] C:\ProgramData\hakaduki
   [2009-05-04|16:37] C:\ProgramData\hikenile
   [2009-03-16|16:12] C:\ProgramData\hiyoluge
   [2009-03-16|16:12] C:\ProgramData\hulahake
   [2009-04-28|20:01] C:\ProgramData\huwifibe
   [2009-05-09|17:07] C:\ProgramData\huzisopo
   [2007-11-28|12:49] C:\ProgramData\InstallShield
   [2009-04-13|12:25] C:\ProgramData\jaduyodu
   [2009-05-14|18:59] C:\ProgramData\jayipesa
   [2009-03-18|15:03] C:\ProgramData\jazejumi
   [2009-04-19|11:52] C:\ProgramData\jemukuwo
   [2009-05-19|19:06] C:\ProgramData\jenupiso
   [2009-03-07|10:32] C:\ProgramData\jibuvuna
   [2009-05-16|11:37] C:\ProgramData\jisaleyu
   [2009-03-25|16:18] C:\ProgramData\jobapoja
   [2009-03-15|10:25] C:\ProgramData\jopiroka
   [2009-02-27|16:10] C:\ProgramData\jowuhese
   [2009-04-25|17:39] C:\ProgramData\joyiwila
   [2009-03-25|14:58] C:\ProgramData\joyiyoja
   [2009-04-15|18:35] C:\ProgramData\jufawome
   [2009-04-15|18:35] C:\ProgramData\juvilisi
   [2009-05-14|19:20] C:\ProgramData\kabolape
   [2009-05-07|15:07] C:\ProgramData\kapekabo
   [2009-04-08|17:07] C:\ProgramData\kapidapu
   [2009-03-11|14:57] C:\ProgramData\kayahusi
   [2009-05-15|09:32] C:\ProgramData\kejefuru
   [2009-05-17|09:18] C:\ProgramData\kidoyera
   [2009-02-26|16:07] C:\ProgramData\kiduruka
   [2009-05-07|15:19] C:\ProgramData\kikepomo
   [2009-04-28|20:01] C:\ProgramData\kimupabe
   [2008-11-04|16:52] C:\ProgramData\Kiwee Toolbar2
   [2008-02-19|11:21] C:\ProgramData\Kodak
   [2009-03-28|10:58] C:\ProgramData\kojoyapi
   [2009-05-13|15:53] C:\ProgramData\kokemabo
   [2009-04-08|17:07] C:\ProgramData\konowahu
   [2009-03-30|15:48] C:\ProgramData\lalolezi
   [2009-02-18|16:14] C:\ProgramData\lawireyo
   [2009-04-26|11:46] C:\ProgramData\lekefoji
   [2009-04-26|13:02] C:\ProgramData\lipewedi
   [2009-04-28|20:01] C:\ProgramData\litugesi
   [2009-03-15|10:26] C:\ProgramData\lufesoko
   [2009-05-10|10:21] C:\ProgramData\luravufa
   [2009-02-18|16:14] C:\ProgramData\luyenofe
   [2009-05-12|16:21] C:\ProgramData\mafaguzu
   [2009-05-13|16:05] C:\ProgramData\majubilu
   [2009-05-07|15:17] C:\ProgramData\makotumi
   [2009-04-30|15:33] C:\ProgramData\marewugo
   [2009-04-18|17:47] C:\ProgramData\mebetewu
   [2007-12-04|10:13] C:\ProgramData\Menu D‚marrer 
   [2009-03-20|20:46] C:\ProgramData\meridewa
   [2009-03-27|07:00] C:\ProgramData\merisemo
   [2009-02-24|16:13] C:\ProgramData\meseleru
   [2009-03-25|15:33] C:\ProgramData\Messenger Plus!
   [2009-03-19|16:16] C:\ProgramData\Microsoft
   [2009-05-13|16:10] C:\ProgramData\Microsoft Help
   [2009-04-15|18:34] C:\ProgramData\mivogeke
   [2007-12-04|10:13] C:\ProgramData\ModŠles 
   [2009-04-08|17:07] C:\ProgramData\moriwami
   [2009-04-08|17:06] C:\ProgramData\moyomego
   [2009-03-26|15:08] C:\ProgramData
amogizu
   [2009-02-25|16:06] C:\ProgramData
efaneji
   [2009-04-18|17:46] C:\ProgramData
ehafote
   [2009-05-21|15:17] C:\ProgramData
ogorike
   [2009-05-21|15:17] C:\ProgramData
udikuma
   [2009-03-20|20:46] C:\ProgramData\pabipihe
   [2009-03-21|09:11] C:\ProgramData\paloyihi
   [2009-05-12|16:21] C:\ProgramData\papevili
   [2009-05-16|11:37] C:\ProgramData\pegatijo
   [2009-03-06|10:01] C:\ProgramData\penipure
   [2009-04-30|15:33] C:\ProgramData\popifimi
   [2009-05-07|15:19] C:\ProgramData\pugibevu
   [2008-08-18|09:26] C:\ProgramData\Pure Networks
   [2009-05-05|15:48] C:\ProgramData\puzominu
   [2009-03-30|15:46] C:\ProgramDataadayogu
   [2009-05-09|17:08] C:\ProgramDataakevaka
   [2009-05-21|15:18] C:\ProgramDataaromozo
   [2009-03-09|15:33] C:\ProgramDataasawofu
   [2007-12-16|13:32] C:\ProgramData\Raxco
   [2009-04-15|18:35] C:\ProgramDataazusula
   [2009-02-28|11:13] C:\ProgramDataelipasi
   [2009-05-07|15:19] C:\ProgramDataepeseza
   [2009-02-22|13:08] C:\ProgramDataewuvafu
   [2009-05-06|15:15] C:\ProgramDataibehige
   [2009-03-17|15:01] C:\ProgramDataipagupa
   [2009-05-18|10:56] C:\ProgramDataiyijuvu
   [2009-03-23|15:29] C:\ProgramDataofegivu
   [2007-11-28|13:06] C:\ProgramData\Roxio
   [2009-05-02|12:47] C:\ProgramDatausahene
   [2009-03-25|14:59] C:\ProgramData\sibomado
   [2009-04-13|12:25] C:\ProgramData\sipaneya
   [2009-05-10|10:22] C:\ProgramData\siriluje
   [2008-05-13|19:07] C:\ProgramData\Skype
   [2009-05-18|10:56] C:\ProgramData\sobipore
   [2009-05-07|15:17] C:\ProgramData\sodiluha
   [2007-11-28|12:49] C:\ProgramData\Sonic
   [2008-12-01|17:21] C:\ProgramData\Sony
   [2009-04-08|17:06] C:\ProgramData\soremeno
   [2009-03-25|14:58] C:\ProgramData\soseyuma
   [2009-04-25|17:38] C:\ProgramData\sowimudu
   [2009-03-20|17:07] C:\ProgramData\soyopuvo
   [2009-05-20|15:12] C:\ProgramData\sunapija
   [2007-11-28|13:01] C:\ProgramData\SupportSoft
   [2009-04-15|18:34] C:\ProgramData\suwuwuha
   [2007-12-16|13:46] C:\ProgramData\Symantec
   [2009-05-20|15:12] C:\ProgramData	alefake
   [2009-03-23|15:04] C:\ProgramData	ebudati
   [2009-03-30|15:46] C:\ProgramData	egawula
   [2008-11-01|13:08] C:\ProgramData\TEMP
   [2009-03-21|09:11] C:\ProgramData	eyunufa
   [2009-05-11|15:12] C:\ProgramData	ijevilu
   [2009-05-05|15:48] C:\ProgramData	itohoru
   [2009-03-14|09:19] C:\ProgramData	izomahu
   [2008-08-04|17:05] C:\ProgramData\TomTom
   [2009-04-18|17:47] C:\ProgramData	uludave
   [2009-03-27|07:00] C:\ProgramData	uneyevi
   [2009-03-19|15:11] C:\ProgramData	usiheku
   [2009-05-09|17:08] C:\ProgramData	utedolu
   [2009-03-26|15:08] C:\ProgramData	uwejipe
   [2009-03-20|17:07] C:\ProgramData	uzeyopu
   [2009-04-30|15:33] C:\ProgramData\vebimayo
   [2009-05-06|15:15] C:\ProgramData\vekesuwo
   [2009-05-05|15:48] C:\ProgramData\vetuyija
   [2009-05-12|16:21] C:\ProgramData\vewaboji
   [2009-05-19|19:06] C:\ProgramData\vopeside
   [2009-04-18|17:47] C:\ProgramData\vovuzidi
   [2009-05-14|06:58] C:\ProgramData\vubabuku
   [2009-05-03|12:55] C:\ProgramData\waritili
   [2009-04-18|17:46] C:\ProgramData\wibopovo
   [2009-03-27|18:59] C:\ProgramData\winasara
   [2009-05-09|17:07] C:\ProgramData\wirubifa
   [2009-05-02|12:47] C:\ProgramData\wivawira
   [2009-04-19|11:52] C:\ProgramData\wivevevi
   [2008-02-08|17:49] C:\ProgramData\WLInstaller
   [2009-05-09|17:08] C:\ProgramData\wofomobu
   [2009-02-23|16:11] C:\ProgramData\wukaripa
   [2009-03-16|16:45] C:\ProgramData\wutakizu
   [2009-04-15|21:30] C:\ProgramData\wuturoho
   [2009-01-18|13:26] C:\ProgramData\Xerox
   [2009-03-28|10:57] C:\ProgramData\yavipeje
   [2009-04-15|18:47] C:\ProgramData\yemavema
   [2009-03-12|15:10] C:\ProgramData\yizimife
   [2009-05-03|12:55] C:\ProgramData\yujodiju
   [2009-05-09|17:08] C:\ProgramData\yumifesu
   [2009-04-28|20:23] C:\ProgramData\yuterahi
   [2009-03-20|17:07] C:\ProgramData\zavipava
   [2009-03-01|10:39] C:\ProgramData\zeladugu
   [2009-04-15|18:35] C:\ProgramData\zelojive
   [2009-05-07|15:17] C:\ProgramData\zifipari
   [2009-04-08|17:06] C:\ProgramData\zivahesu
   [2009-03-27|19:00] C:\ProgramData\zukidudu
   [2009-05-17|09:18] C:\ProgramData\zukuzibi

   --------------------\  Listing des dossiers dans C:\Program Files

   [2008-06-28|19:30] C:\Program Files\Adobe
   [2009-02-04|22:12] C:\Program Files\Apple Software Update
   [2007-12-16|13:31] C:\Program Files\Bell
   [2009-03-26|19:45] C:\Program Files\Bonjour
   [2007-12-15|10:21] C:\Program Files\Brother
   [2009-04-27|10:42] C:\Program Files\Brownie
   [2008-10-01|21:56] C:\Program Files\Business Vault
   [2007-12-16|13:32] C:\Program Files\CA
   [2009-05-20|15:27] C:\Program Files\Common Files
   [2007-12-23|11:28] C:\Program Files\Creative
   [2007-12-23|11:30] C:\Program Files\Creative Live! Cam
   [2007-12-23|11:28] C:\Program Files\DELL
   [2007-11-28|13:01] C:\Program Files\Dell Support Center
   [2007-12-15|09:51] C:\Program Files\D-Link
   [2008-09-20|11:46] C:\Program Files\ebrary
   [2007-12-04|10:13] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [2009-01-16|09:11] C:\Program Files\Google
   [2009-04-27|10:40] C:\Program Files\InstallShield Installation Information
   [2007-11-28|12:44] C:\Program Files\Intel
   [2009-04-16|09:08] C:\Program Files\Internet Explorer
   [2009-04-18|20:28] C:\Program Files\iPod
   [2009-04-18|20:28] C:\Program Files\iTunes
   [2007-11-28|12:42] C:\Program Files\Java
   [2008-02-19|11:20] C:\Program Files\Kodak
   [2008-02-10|11:34] C:\Program Files\LabelCreator Pro
   [2009-01-25|19:02] C:\Program Files\LimeWire
   [2009-03-19|16:19] C:\Program Files\Microsoft
   [2006-11-02|08:37] C:\Program Files\Microsoft Games
   [2007-12-04|20:47] C:\Program Files\Microsoft Office
   [2009-02-25|19:02] C:\Program Files\Microsoft Silverlight
   [2008-02-08|17:53] C:\Program Files\Microsoft SQL Server Compact Edition
   [2009-03-19|16:17] C:\Program Files\Microsoft Sync Framework
   [2007-12-04|20:47] C:\Program Files\Microsoft Visual Studio
   [2007-12-04|20:41] C:\Program Files\Microsoft Visual Studio 8
   [2008-09-11|07:24] C:\Program Files\Microsoft Works
   [2007-12-04|20:46] C:\Program Files\Microsoft.NET
   [2008-06-27|00:10] C:\Program Files\Movie Maker
   [2009-04-27|11:07] C:\Program Files\Mozilla Firefox
   [2007-12-04|20:47] C:\Program Files\MSBuild
   [2008-08-18|09:26] C:\Program Files\Pure Networks
   [2009-02-04|22:20] C:\Program Files\QuickTime
   [2009-03-04|13:46] C:\Program Files\RAR Password Cracker
   [2007-12-16|13:32] C:\Program Files\Raxco
   [2008-12-19|11:11] C:\Program Files\Real
   [2006-11-02|08:37] C:\Program Files\Reference Assemblies
   [2007-11-28|12:51] C:\Program Files\Roxio
   [2009-03-26|19:39] C:\Program Files\Safari
   [2008-12-01|17:21] C:\Program Files\Sony
   [2008-12-01|17:19] C:\Program Files\Sony Setup
   [2008-06-24|10:07] C:\Program Files\Tap'Touche
   [2008-08-04|17:03] C:\Program Files\TomTom DesktopSuite
   [2008-09-07|15:43] C:\Program Files\TomTom HOME 2
   [2009-05-17|13:13] C:\Program Files\Trend Micro
   [2006-11-02|09:01] C:\Program Files\Uninstall Information
   [2008-12-01|17:21] C:\Program Files\Vstplugins
   [2008-06-27|00:10] C:\Program Files\Windows Calendar
   [2008-06-27|00:10] C:\Program Files\Windows Collaboration
   [2008-06-27|00:10] C:\Program Files\Windows Defender
   [2008-06-27|00:10] C:\Program Files\Windows Journal
   [2009-03-19|16:19] C:\Program Files\Windows Live
   [2007-12-25|11:50] C:\Program Files\Windows Live Favorites
   [2009-03-19|16:11] C:\Program Files\Windows Live SkyDrive
   [2009-03-19|16:18] C:\Program Files\Windows Live Toolbar
   [2009-05-13|16:08] C:\Program Files\Windows Mail
   [2009-03-12|07:11] C:\Program Files\Windows Media Player
   [2007-12-04|10:13] C:\Program Files\Windows NT
   [2008-06-27|00:10] C:\Program Files\Windows Photo Gallery
   [2008-06-27|00:10] C:\Program Files\Windows Sidebar

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [2008-03-03|10:21] C:\Program Files\Common Files\Adobe
   [2009-04-18|20:28] C:\Program Files\Common Files\Apple
   [2007-12-16|13:33] C:\Program Files\Common Files\Authentium
   [2007-11-28|12:46] C:\Program Files\Common Files\Creative
   [2007-12-04|20:47] C:\Program Files\Common Files\DESIGNER
   [2008-10-01|21:57] C:\Program Files\Common Files\InstallShield
   [2007-11-28|12:42] C:\Program Files\Common Files\Java
   [2008-02-19|11:19] C:\Program Files\Common Files\Kodak
   [2009-03-06|11:30] C:\Program Files\Common Files\microsoft shared
   [2008-02-19|11:18] C:\Program Files\Common Files\MSSoap
   [2008-02-19|11:19] C:\Program Files\Common Files\PX Storage Engine
   [2008-12-19|11:11] C:\Program Files\Common Files\Real
   [2007-11-28|12:47] C:\Program Files\Common Files\Reallusion
   [2007-11-28|12:49] C:\Program Files\Common Files\Roxio Shared
   [2007-12-16|13:32] C:\Program Files\Common Files\Scanner
   [2006-11-02|07:18] C:\Program Files\Common Files\Services
   [2007-11-28|12:51] C:\Program Files\Common Files\Sonic Shared
   [2006-11-02|07:18] C:\Program Files\Common Files\SpeechEngines
   [2007-11-28|13:01] C:\Program Files\Common Files\supportsoft
   [2007-11-28|12:49] C:\Program Files\Common Files\SureThing Shared
   [2007-12-16|13:49] C:\Program Files\Common Files\Symantec Shared
   [2008-06-27|00:10] C:\Program Files\Common Files\System
   [2009-03-19|16:02] C:\Program Files\Common Files\Windows Live
   [2008-02-27|12:49] C:\Program Files\Common Files\WindowsLiveInstaller

   --------------------\  Process

   ( 74 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-05-21 15:19:13
   Windows 6.0.6001 Service Pack 1 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:3][D:24]-> C:\Users\mustapha\AppData\Local\Temp
   [F:198][D:1]-> C:\Users\mustapha\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:6][D:4]-> C:\Users\mustapha\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:2][D:2]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 2009-05-21|15:22 - Option : [1]

   --------------------\  Fin du rapport a 15:22:51
   [ UAC => 1 ]

geek321 · Answer

alors je fais quoi maintenant ?

toptitbal · Answer

Télécharge UsbFix  de chiquitine29 sur ton bureau

http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe 


--> Lance l installation avec les paramètres par défaut 

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir 

--> Double clic sur le raccourci UsbFix sur ton bureau 

--> Choisis l’option 1 (recherche)

--> Laisse travailler l’outil 

-->Poste le rapport UsbFix.txt 

Note : le rapport UsbFix.txt est sauvegardé a la racine du disque 

Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valide.

geek321 · Answer

ca me dit acces refusé tout le temps

toptitbal · Answer

L'UAC est bien désactivé ?
Tu lances bien les commandes par un clic droit "En tant qu'administrateur" ?

geek321 · Answer

ahh c bon c'est ce que je vais faire

geek321 · Answer

en fait je fais quoi la je fais juste En tant qu'administrateur et je fais le scan ?? ou il faut que je desactive le uac et apres je met En tant qu'administrateur ??

toptitbal · Answer

D'abord désactiver l'UAC, ensuite, lancer le scan en tant qu'administrateur.

geek321 · Answer

############################## [ UsbFix V3.024 # Scan ]

# User : mustapha (Administrateurs) # PC-DE-MUSTAPHA
# Update on 21/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 15:46:12 | 2009-05-22

# Intel(R) Core(TM)2 Duo CPU     E4400  @ 2.00GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 7.0.6001.18000
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 222,78 Go (137,63 Go free) [OS] # NTFS
# D:\ # Disque fixe local # 10 Go (6,1 Go free) [RECOVERY] # NTFS
# E:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Business Vault\VaultClientSRV.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\OEM03Mon.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\DELL\DELL Webcam Manager\DellWMgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32undll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## [  Registre # Startup ]

HKCU_Main:   "Local Page"="C:\Windows\system32\blank.htm" 
HKCU_Main:   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:   "Start Page"="https://ca.yahoo.com/" 
HKLM_logon:  "Userinit"="C:\Windows\system32\userinit.exe," 
HKLM_logon:  "LegalNoticeCaption"="" 
HKLM_logon:  "LegalNoticeText"="" 
HKLM_Run:    IgfxTray=C:\Windows\system32\igfxtray.exe 
HKLM_Run:    HotKeysCmds=C:\Windows\system32\hkcmd.exe 
HKLM_Run:    Google Desktop Search="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup 
HKLM_Run:    Windows Mobile Device Center=%windir%\WindowsMobile\wmdc.exe 
HKLM_Run:    Persistence=C:\Windows\system32\igfxpers.exe 
HKLM_Run:    D-Link Wireless G WDA-1320=C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe 
HKLM_Run:    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
HKLM_Run:    iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe" 
HKLM_Run:    OEM03Mon.exe=C:\Windows\OEM03Mon.exe 
HKLM_Run:    dellsupportcenter="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    ehTray.exe=C:\Windows\ehome\ehTray.exe  
HKCU_Run:    swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe  
HKCU_Run:    msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background  

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]

Found ! HKLM\software\microsoft\security center\Svc\ "AntiVirusOverride"  
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )  

################## [ Registre # Mountpoints2 ]


################## [ Informations ]


################## [ Cracks / Keygens / Serials ]

# -> Nothing found !  

################## [ ! Fin du rapport # UsbFix V3.024 ! ]

toptitbal · Answer

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau

# choisi l’option 2 ( Suppression )

# Ton bureau disparaitra et le pc redémarrera .

# Au redémarrage , UsbFix scannera ton pc , laisse travailler l’outil.

# Ensuite poste le rapport UsbFix.txt qui apparaitra avec le bureau .

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

geek321 · Answer

je fais ce que tu me dis et au redemarage ca ne fait rien du tout et ca démarre normalement

geek321 · Answer

ca fait disparaitre mon bureau et apres quand je redemarre ca fait rien sa demarre normalement

geek321 · Answer

############################## [ UsbFix V3.024 # Cleaning ]

# User : mustapha (Administrateurs) # PC-DE-MUSTAPHA
# Update on 21/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 18:32:36 | 2009-05-24

# Intel(R) Core(TM)2 Duo CPU     E4400  @ 2.00GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
# Internet Explorer 7.0.6001.18000
# Windows Firewall Status : Disabled

# C:\ # Disque fixe local # 222,78 Go (137,19 Go free) [OS] # NTFS
# D:\ # Disque fixe local # 10 Go (6,1 Go free) [RECOVERY] # NTFS
# E:\ # Disque CD-ROM # 4,15 Go (0 Mo free) [SONY_DVD_RECORDER_VOLUME] # UDF

############################## [ Processus actifs ]

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Business Vault\VaultClientSRV.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Windows\system32unonce.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\conime.exe
C:\Windows\system32	askeng.exe

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]

# HKLM\software\microsoft\security center\Svc\ "AntiVirusOverride"  
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !  

################## [ Registre # Mountpoints2 ]


################## [ Listing des fichiers présent ]

[2006-09-18 17:43|--a------|24] - C:\autoexec.bat
[2008-01-19 03:45|-rahs----|333203] - C:\bootmgr
[2006-11-13 04:42|-ra-s----|8192] - C:\BOOTSECT.BAK
[2009-05-20 15:36|--a------|24954] - C:\ComboFix.txt
[2006-09-18 17:43|---------|10] - C:\config.sys
[2007-11-28 20:26|-rah-----|4209] - C:\dell.sdr
[?|?|?] - C:\hiberfil.sys
[2008-06-24 09:12|-rahs----|0] - C:\IO.SYS
[2009-05-21 15:22|--a------|18867] - C:\lopR.txt
[2008-06-24 09:12|-rahs----|0] - C:\MSDOS.SYS
[?|?|?] - C:\pagefile.sys
[2007-12-23 11:46|--a------|174] - C:\Setup.log
[2009-05-24 18:33|--a------|3421] - C:\UsbFix.txt

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# D:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## [ Informations ]


################## [ Cracks / Keygens / Serials ]

# -> Nothing found !  

################## [ ! Fin du rapport # UsbFix V3.024 ! ]

geek321 · Answer

voila finalement c'est parce que je ne me connectais pas sur la session admin en touka merci de me donner les directives si il y en a

toptitbal · Answer

• Télécharge Random's System Information Tool (RSIT) de Random / Random et sauvegarde-le sur ton Bureau, 

-> http://images.malwareremoval.com/random/RSIT.exe

• Double-clique sur RSIT.exe pour lancer le programme, 
• Clique sur continuer sur l'écran Disclaimer, 
• Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence. 
• Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches). 

Tuto si besoin : https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm

geek321 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by mustapha at 2009-05-26 16:26:49
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 141 GB (62%) free of 228 GB
Total RAM: 2036 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:27:14, on 2009-05-26
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\OEM03Mon.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\DELL\DELL Webcam Manager\DellWMgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32undll32.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Users\salim\Desktop\RSIT.exe
C:\Program Files	rend micro\mustapha.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [D-Link Wireless G WDA-1320] C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OEM03Mon.exe] C:\Windows\OEM03Mon.exe
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [DELL Webcam Manager] "C:\Program Files\DELL\DELL Webcam Manager\DellWMgr.exe" /s (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [LSA Shellu] C:\Users\salim\lsass.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [Windows Service] C:\Users\salim\service.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [Lsass Service] C:\Users\salim\dCXxTaEm.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [Microsoft Windows Installer] C:\Users\salim\AppData\Roaming\msiexec.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [userinit] C:\Users\salim\AppData\Roaming\oembios.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [MSServer] rundll32.exe C:\Users\salim\AppData\Local\Temp\iifEwWPh.dll,#1 (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [Windows Logon] C:\Users\salim\winIogon.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [svchost] C:\Users\salim\AppData\Local\TempdlAD23.tmp.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [wutukahuni] Rundll32.exe "C:\ProgramData	utedolu	utedolu.dll",s (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [IExplorer] C:\Users\salim\inexplorer.exe (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [5a688c07] rundll32.exe "C:\ProgramData\kibivegi\kibivegi.dll",b (User 'salim')
O4 - HKUS\S-1-5-21-1369148199-3131422182-2722478985-1001\..\Run: [CPM595bbf9b] Rundll32.exe "C:\ProgramData\yapigifa\yapigifa.dll",a (User 'salim')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.vista.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Coffre-fort pour entreprise (VaultClientSRV) - BELL - C:\Program Files\Business Vault\VaultClientSRV.exe

geek321 · Answer

le 2ime affiche un numero de securité alors je ne sais ppas si je le post ou pas ?????

geek321 · Answer

par contre il indique qu'il y a un trojan ?? :0 je ne suis pas sur mais bon

toptitbal · Answer

Garde-le en réserve pour le moment.
Je regarde le premier, je te répondrai demain matin.

geek321 · Answer

parfait merci bcp

Je recois trop de pop up

34 réponses

Discussions similaires