Virus dans mon portable Fermé

Question

Bonjour,

Depuis quelque temps mon portable est devenu très très lent et quand je  fais les tests avec avg il détecte plein de virus style trojan.horse...je les mets en 40aine mais ca change rien jsuis certain que jai encore plein de virus ds mon ordi... qu'est-ce que je fais ? y'a t'il un bon antivirus qui pourrait maider ??? Merci

j'ai AVG 7.5 Free edition

jlpjlp · Answer

slt,


Télécharge ici : 

http://images.malwareremoval.com/random/RSIT.exe 

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau. 

Double-clique sur RSIT.exe afin de lancer RSIT. 

Clique Continue à l'écran Disclaimer. 

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. 

Poste le contenu de log.txt (<<qui sera affiché) 
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches). 

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

DDmaster · Answer

essaye avec spybot  

https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html

ca marche pas mal

et un cout de ccleanner

http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner

superman1221 · Answer

voila le log.txt

Logfile of random's system information tool 1.06 (written by random/random)
Run by Anthony at 2009-05-19 13:08:35
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 56 GB (58%) free of 95 GB
Total RAM: 1022 MB (29% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:09:08, on 2009-05-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\Toshiba\Toshiba Applet	hotkey.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\lphcp22j0etcp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\Program Files\DNA\btdna.exe
C:\Documents and Settings\Anthony\Application Data\ptidle\ptidle.exe
C:\Documents and Settings\Anthony\Application Data\Twain\Twain.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\RSIT[1].exe
C:\Program Files	rend micro\Anthony.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IE Privacy Keeper - Last IE Window Detector - {1201333E-BAD9-481C-BCF5-6904498CF85B} - C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPKbho.dll
O2 - BHO: CPV - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\WWShow\WWShow.dll
O2 - BHO: (no name) - {20D6CE25-BD74-42A0-9265-CC5E83147A79} - C:\WINDOWS\system32\pmkji.dll (file missing)
O2 - BHO: (no name) - {466AEDF3-FBAF-4297-98B5-B53E6FCF5864} - C:\WINDOWS\system32\sstqr.dll (file missing)
O2 - BHO: (no name) - {475b22fe-dec1-4c09-b813-8c8e4c430813} - C:\WINDOWS\system32\wanajiru.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {ECE8D5F8-0FE8-49CB-96D0-07CEDBE1C92E} - C:\WINDOWS\system32\xxyxvtt.dll (file missing)
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet	hotkey.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [lphcp22j0etcp] C:\WINDOWS\system32\lphcp22j0etcp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SM3] C:\Program Files\3\3.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [net] "C:\WINDOWS\system32
et.net"
O4 - HKLM\..\Run: [prnet] "C:\WINDOWS\system32\prnet.tmp"
O4 - HKLM\..\Run: [popijowazi] Rundll32.exe "C:\WINDOWS\system32\lefekeku.dll",s
O4 - HKLM\..\Run: [30ce02b2] rundll32.exe "C:\WINDOWS\system32\jibilidi.dll",b
O4 - HKLM\..\Run: [CPM33fd312e] Rundll32.exe "c:\windows\system32
ukatojo.dll",a
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Documents and Settings\Anthony\Bureau\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Dirty-AnyDVD-Loader] C:\Program Files\SlySoft\AnyDVD\^0^DRL^0^.exe
O4 - HKCU\..\Run: [D-A-L] C:\Program Files\SlySoft\AnyDVD\^0^DRL^0^.exe
O4 - HKCU\..\Run: [net] "C:\WINDOWS\system32
et.net"
O4 - HKCU\..\Run: [prnet] "C:\WINDOWS\system32\prnet.tmp"
O4 - HKCU\..\Run: [ptidle] "C:\Documents and Settings\Anthony\Application Data\ptidle\ptidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Anthony\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [DigiFast] C:\Documents and Settings\Anthony\Application Data\digifast\digifast.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.antimalwareguard.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - https://www.fileplanet.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://www.gamespy.com
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1221250643180&h=ea9f223e4fa3ee1e20288e085dfce19a/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B1953AD6-C50E-11D3-B020-00A0C9251384} (O2C-Player (ELECO Software GmbH)) - http://www.o2c.de/download/o2cplayer.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/SignIn?ReturnUrl=%2fFileNotFound.htm%3faspxerrorpath%3d%2fupload%2factivex%2fv2_0_0_9%2ferror.aspx&aspxerrorpath=/upload/activex/v2_0_0_9/error.aspx
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/SignIn?ReturnUrl=%2fFileNotFound.htm%3faspxerrorpath%3d%2fupload%2factivex%2fv2_0_0_10%2ferror.aspx&aspxerrorpath=/upload/activex/v2_0_0_10/error.aspx
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wusorevo.dll c:\windows\system32
ukatojo.dll c:\windows\system32\pinoteye.dll
O20 - Winlogon Notify: pmkji - C:\WINDOWS\system32\pmkji.dll (file missing)
O20 - Winlogon Notify: sstqr - C:\WINDOWS\system32\sstqr.dll (file missing)
O20 - Winlogon Notify: winydp32 - winydp32.dll (file missing)
O20 - Winlogon Notify: xxyxvtt - xxyxvtt.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32
ukatojo.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32
ukatojo.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe

jlpjlp · Answer

ok il y a du boulot!!!


pour AVG la version 8 est sortie!!!!!!


_______________________


utilise  pour supprimer tes traces 

CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo 
(dans les options puis avancé :désactive la case: effacer les fichiers de plus de 48 heures)
https://www.malekal.com/tutoriel-ccleaner/
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
----------------------- 

scanne RAPIDE  avec 
MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ 

__________________

télécharge combofix (par sUBs) ici : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

et enregistre le sur le bureau. 

[si je suspecte une infection bagle, j'ajoute : 

sous le nom de antibagle. Fais le avant que le fichier ne soit enregistré sur le bureau] 

déconnecte toi d'internet et ferme toutes tes applications. 

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware) 


double-clique sur combofix.exe et suis les instructions 

à la fin, il va produire un rapport C:\ComboFix.txt 

réactive ton parefeu, ton antivirus, la garde de ton antispyware 

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse. 

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi. 

Tu as un tutoriel complet ici : 

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

superman1221 · Answer

Combofix me dit tjrs que AVG est ouvert mais comment je fais pour le fermer ? .. il dit que c'est mon scanneur en temps réel ...

jlpjlp · Answer

vire completement avg de ton ordi de toute façon c'est une ancienne version , on remettra avg version 8 ensuite ou antivir

superman1221 · Answer

ok... 

voici malware :

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2155
Windows 5.1.2600 Service Pack 2

2009-05-19 13:43:59
mbam-log-2009-05-19 (13-43-59).txt

Type de recherche: Examen rapide
Eléments examinés: 90341
Temps écoulé: 7 minute(s), 58 second(s)

Processus mémoire infecté(s): 3
Module(s) mémoire infecté(s): 7
Clé(s) du Registre infectée(s): 31
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 7
Dossier(s) infecté(s): 16
Fichier(s) infecté(s): 41

Processus mémoire infecté(s):
C:\Documents and Settings\Anthony\Application Data\ptidle\ptidle.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Documents and Settings\Anthony\Application Data\Twain\Twain.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\WINDOWS\system32\lphcp22j0etcp.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\jibilidi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\lefekeku.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\wusorevo.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32
ukatojo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\wanajiru.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\pinoteye.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Program Files\WWShow\WWShow.dll (Trojan.BHO) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{475b22fe-dec1-4c09-b813-8c8e4c430813} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{475b22fe-dec1-4c09-b813-8c8e4c430813} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{475b22fe-dec1-4c09-b813-8c8e4c430813} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\TypeLib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_cpv.workhorse (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_cpv.workhorse.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{26a98aa8-07fe-46e6-b6df-26704f3b895f} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f919fbd3-a96b-4679-af26-f551439bb5fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWAREhct22j0etcp (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winydp32 (Dialer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\aldd (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> Quarantined and deleted successfully.
KHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\prnet (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BHO_CPV.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
et (Trojan.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\30ce02b2 (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\popijowazi (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm33fd312e (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ptidle (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	wain (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
et (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
et (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prnet (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prnet (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcp22j0etcp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\wusorevo.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\wusorevo.dll  -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32
ukatojo.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\pinoteye.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\Anthony\Application Data\ptidle (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Data\digifast (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\WWShow (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Datahct22j0etcp\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Jcore (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Data\Twain (Trojan.Matcash) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\hanuzuze.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ezuzunah.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jawegafa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\afagewaj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jibilidi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\idilibij.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kumeyoku.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ukoyemuk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lukuduni.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\inudukul.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
ifisito.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\otisifin.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	odorulo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\olurodot.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lefekeku.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\pinoteye.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\wanajiru.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\wusorevo.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32
ukatojo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\Anthony\Application Data\ptidle\ptidle.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Data\Twain\Twain.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\WWShow\WWShow.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32
et.net (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\prnet.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gepibura.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kavumefe.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
edekaje.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pemewoma.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\warekifu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zarebeba.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Data\ptidle\ptidle.exe8d1 (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Data\digifast\config.cfg (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winydp32.dll (Dialer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Anthony\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\ovfsthnkiqfikcrncbxjqekcmenciomjxsmhkr.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\ovfsthtrpvccrvjrvrvaxyqvbdfexuspulndrx.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ovfsthcxavmrsjslrthjfkkmxthpscqfqeweqj.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ovfsthnhergpxpdkenitgfiuqcfxoqjipfonhh.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zesanido.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lphcp22j0etcp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcp22j0etcp.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.


et ComboFix : 

ComboFix 09-05-19.04 - Anthony 2009-05-19 14:33.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.2.1036.18.1022.463 [GMT -4:00]
Lancé depuis: c:\documents and settings\Anthony\Bureau\ComboFix.exe
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
[color=purple]Les fichiers ci-dessous ont été désactivés pendant l'exécution:/color
c:\windows\system32
ukatojo.dll
c:\windows\system32\wusorevo.dll
c:\windows\system32\pinoteye.dll


((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Anthony\Application Data\inst.exe
c:\documents and settings\Anthony\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\Anthony\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\Anthony\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\WWShow
c:\program files\WWShow\WWShow.dll
c:\windows\system32\404Fix.exe
c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\CPV.stt
c:\windows\system32\dumphive.exe
c:\windows\system32\husosaza.dll
c:\windows\system32\idilibij.ini
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\ijkmp.bak1
c:\windows\system32\ijkmp.bak2
c:\windows\system32\ijkmp.ini
c:\windows\system32\ijkmp.ini2
c:\windows\system32\ijkmp.tmp
c:\windows\system32\jibilidi.dll
c:\windows\system32\lefekeku.dll
c:\windows\system32
fvtupyo.ini
c:\windows\system32\Process.exe
c:\windows\system32qtss.bak1
c:\windows\system32qtss.bak2
c:\windows\system32qtss.ini
c:\windows\system32\SrchSTS.exe
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\wanajiru.dll
c:\windows\system32\werolime.dll
c:\windows\system32\windll32.exe
c:\windows\system32\WS2Fix.exe

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-04-19 au 2009-05-19  ))))))))))))))))))))))))))))))))))))
.

2009-05-19 18:30 . 2009-05-19 18:30	--------	d-----w	c:\documents and settings\All Users\Application Data\Avg7
2009-05-19 17:33 . 2009-05-19 17:33	--------	d-----w	c:\documents and settings\Anthony\Application Data\Malwarebytes
2009-05-19 17:33 . 2009-04-06 19:32	15504	----a-w	c:\windows\system32\drivers\mbam.sys
2009-05-19 17:33 . 2009-04-06 19:32	38496	----a-w	c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-19 17:33 . 2009-05-19 17:33	--------	d-----w	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-19 17:33 . 2009-05-19 17:33	--------	d-----w	c:\program files\Malwarebytes' Anti-Malware
2009-05-19 17:21 . 2009-05-19 17:21	--------	d-----w	c:\program files\CCleaner
2009-05-19 17:08 . 2009-05-19 17:09	--------	d-----w	c:\program files	rend micro
2009-05-19 17:08 . 2009-05-19 17:09	--------	d-----w	C:sit
2009-05-12 19:33 . 2009-05-12 19:33	--------	d-----w	c:\windows\IP Changer
2009-05-12 19:33 . 2009-05-14 01:27	--------	d-----w	c:\program files\IP Changer
2009-04-29 16:38 . 2009-04-29 16:38	--------	d-----w	c:\program files\Thomson
2009-04-21 22:51 . 2009-04-21 22:51	--------	d-----w	C:\ConverterOutput
2009-04-21 22:51 . 2004-09-10 17:50	34820	----a-w	c:\windows\system32\ffdshow.reg
2009-04-21 22:51 . 2007-01-01 09:30	200704	----a-w	c:\windows\system32\TomsMoComp_ff.dll
2009-04-21 22:51 . 2007-03-25 04:51	114688	----a-w	c:\windows\system32\libmpeg2_ff.dll
2009-04-21 22:51 . 2007-03-25 04:51	404480	----a-w	c:\windows\system32\libmplayer.dll
2009-04-21 22:51 . 2007-03-25 04:51	3049984	----a-w	c:\windows\system32\libavcodec.dll
2009-04-21 22:51 . 2006-07-18 01:42	14909	----a-w	c:\windows\system32\A_reg.reg
2009-04-21 22:51 . 2006-09-27 21:46	348160	----a-w	c:\windows\system32\cdga.dll
2009-04-21 22:51 . 2007-06-26 22:55	364544	----a-w	c:\windows\system32\cdg.dll
2009-04-21 22:51 . 2009-04-21 22:51	--------	d-----w	c:\program files\Cucusoft
2009-04-20 02:18 . 2001-07-04 00:39	3654	----a-w	c:\windows\system32\drivers\Sonyhcp.dll
2009-04-20 02:18 . 2001-11-05 13:23	299923	----a-w	c:\windows\system32\drivers\sonyhcs.sys
2009-04-20 02:18 . 2001-11-05 13:23	6097	----a-w	c:\windows\system32\drivers\sonyhcb.sys
2009-04-20 02:18 . 2001-11-05 13:23	38739	----a-w	c:\windows\system32\drivers\sonyhcc.sys
2009-04-20 02:18 . 2002-10-16 02:41	102220	----a-w	c:\windows\system32\drivers\sonypvs1.sys
2009-04-20 02:18 . 2001-07-04 00:33	53248	----a-w	c:\windows\system32\SONYHCY.DLL
2009-04-20 02:18 . 2009-04-20 02:18	--------	d-----w	C:\Drivers

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 15:03 . 2008-09-16 03:30	--------	d-----w	c:\program files\DNA
2009-05-19 15:02 . 2009-02-19 15:02	87552	----a-w	c:\windows\system32\pinoteye.dll.vir
2009-05-19 02:24 . 2009-02-19 02:24	87552	----a-w	c:\windows\system32
ukatojo.dll.vir
2009-05-14 01:28 . 2006-10-19 02:07	--------	d-----w	c:\program files\BearShare
2009-05-07 02:43 . 2007-08-26 22:29	--------	d-----w	c:\program files\LimeWire
2009-04-20 02:18 . 2006-01-16 21:58	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-04-17 16:45 . 2006-01-16 15:31	77440	----a-w	c:\windows\system32\perfc00C.dat
2009-04-17 16:45 . 2006-01-16 15:31	474884	----a-w	c:\windows\system32\perfh00C.dat
2009-04-10 22:15 . 2009-04-10 22:15	--------	d-----w	c:\program files\Audacity 1.3 Beta (Unicode)
2009-04-06 21:04 . 2009-04-06 21:04	--------	d-----w	c:\program files\Audacity
2009-04-01 13:48 . 2009-03-30 18:43	--------	d-----w	c:\program files\Universal Shield 4.2
2009-03-31 21:00 . 2009-03-30 15:21	--------	d-----w	c:\program files\Everstrike Software
2009-03-30 18:18 . 2006-10-19 01:33	--------	d-----w	c:\program files\MSN Messenger
2009-03-30 15:21 . 2009-03-30 15:21	--------	d-----w	c:\program files\Fichiers communs\Everstrike Software
2009-03-06 14:00 . 2006-01-16 15:31	286720	----a-w	c:\windows\system32\pdh.dll
2009-03-03 00:13 . 2006-01-16 15:31	826368	----a-w	c:\windows\system32\wininet.dll
2009-02-20 17:10 . 2006-01-16 15:31	78336	----a-w	c:\windows\system32\ieencode.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD	oscdspd.exe" [2005-04-11 65536]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVD.exe" [2006-12-15 503296]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Gestionnaire Antidote.exe"="c:\program files\Druide\Antidote\Antidote\Gestionnaire Antidote.exe" [2003-09-20 368640]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 217544]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-16 342848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-10-06 122940]
"Tvs"="c:\program files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728]
"THotkey"="c:\program files\Toshiba\Toshiba Applet	hotkey.exe" [2006-01-05 352256]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2004-08-17 184320]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 94208]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-12 282624]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-05-14 35328]
"GGPN Agent"="c:\windows\Windll32\GGPN.exe" [2008-06-26 525312]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SmoothView"="c:\program files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 118784]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"TFncKy"="TFncKy.exe" [BU]
"TDispVol"="TDispVol.exe" - c:\windows\system32\TDispVol.exe [2005-09-15 73728]
"TPSMain"="TPSMain.exe" - c:\windows\system32\TPSMain.exe [2005-08-03 266240]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2005-12-09 15691264]
"NDSTray.exe"="NDSTray.exe" [BU]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\agrsmmsg.exe [2005-10-14 88203]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

c:\documents and settings\Anthony\Menu D‚marrer\Programmes\D‚marrage\
Lancement rapide de Microsoft Office OneNote 2003.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-4-19 64864]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2008-3-5 113664]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-1-17 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32
ukatojo.dll,c:\windows\system32\wusorevo.dll c:\windows\system32\pinoteye.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\MSN Messenger\msnmsgr.exe"=
"c:\Program Files\MSN Messenger\livecall.exe"=
"c:\WINDOWS\system32\winver.exe"=
"c:\Program Files\DNA\btdna.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=

.
Contenu du dossier 'Tâches planifiées'

2009-05-11 c:\windows\Tasks\Ad-Aware SE Personal.job
- c:\progra~1\Lavasoft\AD-AWA~1\Ad-Aware.exe [2006-12-19 19:22]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{20D6CE25-BD74-42A0-9265-CC5E83147A79} - (no file)
BHO-{466AEDF3-FBAF-4297-98B5-B53E6FCF5864} - (no file)
BHO-{ECE8D5F8-0FE8-49CB-96D0-07CEDBE1C92E} - (no file)
HKLM-Run-CPM33fd312e - c:\windows\system32
ukatojo.dll
ShellExecuteHooks-{ECE8D5F8-0FE8-49CB-96D0-07CEDBE1C92E} - (no file)
Notify-pmkji - c:\windows\system32\pmkji.dll
Notify-sstqr - c:\windows\system32\sstqr.dll
Notify-xxyxvtt - xxyxvtt.dll


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.ca/
uInternet Connection Wizard,ShellNext = iexplore
IE: Chercher avec Copernic Agent - c:\program files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: antimalwareguard.com
Trusted Zone: live.com\login
Trusted Zone: msn.com\by131fd.bay131.hotmail
Handler: copernicagent - {A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6} - c:\progra~1\COPERN~1\COPERN~1.DLL
Handler: copernicagentcache - {AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D} - c:\progra~1\COPERN~1\COPERN~1.DLL
DPF: {B1953AD6-C50E-11D3-B020-00A0C9251384} - hxxp://www.o2c.de/download/o2cplayer.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-19 14:38
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-3651597601-842898512-1207849988-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(908)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2144)
c:\windows\Windll32\GGPN.007
c:\windows\Windll32\GGPN.006
c:\windows\system32\TDispVol.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Toshiba\ConfigFree\CFSvcs.exe
c:\windows\system32\DVDRAMSV.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Toshiba\Commandes TOSHIBA\TFncKy.exe
c:\program files\Synaptics\SynTP\Toshiba.exe
c:\windows\system32\TPSBattM.exe
c:\program files\Toshiba\ConfigFree\NDSTray.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\windows\system32\hpzipm12.exe
c:\program files\HP\hpcoretech\comp\hpdarc.exe
.
**************************************************************************
.
Heure de fin: 2009-05-19 14:44 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-05-19 18:44

Avant-CF: 58 488 291 328 octets libres
Après-CF: 58 447 683 584 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

250	--- E O F ---	2009-05-13 14:37


en plus j'ai 3 dll qui me cause problème : C:\windows\system32
ukatojo.dll
                                                            C:\WINDOWS\system32\wusorevu.dll
                                                            C:\windows\system32\pinoteye.dll

jlpjlp · Answer

oui j'ai vu! pour les 3 fichiers!


vire ce qui est en quarantiane dans malwarebyte

puis

télécharge OTMoveIt 
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved. 
(attention bien mettre :files)

:processes
explorer.exe
:files
c:\windows\system32
ukatojo.dll
c:\windows\system32\wusorevo.dll
c:\windows\system32\pinoteye.dll
c:\windows\system32\pinoteye.dll.vir
c:\windows\system32
ukatojo.dll.vir
:commands
[purity]
[emptytemp]
[start explorer]

clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 
_______________________

Télécharge ToolsCleaner sur ton bureau. 
-->  http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

ps : pas besoin de m´envoyer le rapport si tout a été supprimé 

_______________________


 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

________________


a plus

superman1221 · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
LoadLibrary failed for c:\windows\system32
ukatojo.dll
c:\windows\system32
ukatojo.dll NOT unregistered.
c:\windows\system32
ukatojo.dll moved successfully.
LoadLibrary failed for c:\windows\system32\wusorevo.dll
c:\windows\system32\wusorevo.dll NOT unregistered.
c:\windows\system32\wusorevo.dll moved successfully.
LoadLibrary failed for c:\windows\system32\pinoteye.dll
c:\windows\system32\pinoteye.dll NOT unregistered.
c:\windows\system32\pinoteye.dll moved successfully.
File/Folder c:\windows\system32\pinoteye.dll.vir not found.
File/Folder c:\windows\system32
ukatojo.dll.vir not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\Perflib_Perfdata_710.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\Perflib_Perfdata_bc.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\Perflib_Perfdata_eb4.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF8F8F.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF9211.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF92BD.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF92C9.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF9F44.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF9F52.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DFD9BD.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Anthony\LOCALS~1\Temp\~WRF0000.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\PTH44PMC\01[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\affich-12525018-virus-dans-mon-portable[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\google_ca[2].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\LoadSession[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\Term[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\default[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\im[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\InboxLight[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\Term[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\ToastFull[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\ToastMini[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\9DAFGQZ1\Quitter[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05192009_152750

Files moved on Reboot...
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\Perflib_Perfdata_710.dat not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\Perflib_Perfdata_bc.dat not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\Perflib_Perfdata_eb4.dat not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF8F8F.tmp not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF9211.tmp not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF92BD.tmp not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF92C9.tmp not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF9F44.tmp not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DF9F52.tmp not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\~DFD9BD.tmp not found!
File C:\DOCUME~1\Anthony\LOCALS~1\Temp\~WRF0000.tmp not found!
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\PTH44PMC\01[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\affich-12525018-virus-dans-mon-portable[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\google_ca[2].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\LoadSession[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\OECZFR5K\Term[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\default[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\im[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\InboxLight[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\Term[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\ToastFull[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\JRPOMYWI\ToastMini[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\9DAFGQZ1\Quitter[1].htm moved successfully.
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully.


bitdefender:

BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Tue, May 19, 2009 - 16:08:33
 
 
  
  
 
Voie d'analyse: C:\;D:\;E:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 00:22:11
 
Fichiers
 148198
 
Directoires
 7232
 
Secteurs de boot
 0
 
Archives
 1259
 
Paquets programmes
 11425
 
  
  
 
Résultats
 
Virus identifiés
 13
 
Fichiers infectés
 32
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 33
 
  
  
 
Info sur les moteurs
 
Définition virus
 3004582
 
Version des moteurs
 AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)
 
Analyse des plugins
 17
 
Archive des plugins
 45
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 4
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F8581E.exe=>(Quarantine-2)=>wise0025
 Détecté avec: Adware.Whenu.BSR
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F8581E.exe=>(Quarantine-2)=>wise0025
 Supprimé
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F8581E.exe=>(Quarantine-2)
 Echec de la mise à jour
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F8581E.exe=>(Quarantine-2)=>(Embedded EXE r)=>wise0025
 Détecté avec: Adware.Whenu.BSR
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F8581E.exe=>(Quarantine-2)=>(Embedded EXE r)=>wise0025
 Supprimé
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F8581E.exe=>(Quarantine-2)=>(Embedded EXE r)
 Echec de la mise à jour
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7F47226C.exe=>(Quarantine-2)
 Détecté avec: Adware.Whenu.BSR
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7F47226C.exe=>(Quarantine-2)
 Supprimé
 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7F47226C.exe
 Supprimé
 
C:\Documents and Settings\Anthony\Mes documents\Nouveau dossier\Keymaker\Keymaker.exe
 Infecté par: Trojan.Generic.97050
 
C:\Documents and Settings\Anthony\Mes documents\Nouveau dossier\Keymaker\Keymaker.exe
 Supprimé
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>wise0027
 Détecté avec: Adware.180solutions.AO
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>wise0027
 Supprimé
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe
 Echec de la mise à jour
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>wise0028
 Infecté par: Trojan.Generic.886992
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>wise0028
 Supprimé
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe
 Echec de la mise à jour
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>wise0030
 Détecté avec: Adware.Toolbar.Mywebsearch.I
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>wise0030
 Supprimé
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe
 Echec de la mise à jour
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)=>wise0027
 Détecté avec: Adware.180solutions.AO
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)=>wise0027
 Supprimé
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)
 Echec de la mise à jour
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)=>wise0028
 Infecté par: Trojan.Generic.886992
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)=>wise0028
 Supprimé
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)
 Echec de la mise à jour
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)=>wise0030
 Détecté avec: Adware.Toolbar.Mywebsearch.I
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)=>wise0030
 Supprimé
 
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe=>(Embedded EXE r)
 Echec de la mise à jour
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0051893.sys
 Infecté par: Trojan.Generic.1622667
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0051893.sys
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0052911.sys
 Infecté par: Trojan.Generic.1622667
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0052911.sys
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054920.dll
 Infecté par: Trojan.Vundo.GNF
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054920.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054920.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054921.dll
 Infecté par: Trojan.Vundo.GNF
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054921.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054921.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054922.dll
 Infecté par: Trojan.Vundo.GNF
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054922.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP132\A0054922.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP135\A0055069.dll
 Infecté par: Trojan.Vundo.GNF
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP135\A0055069.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP135\A0055069.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055420.dll
 Infecté par: Gen:Trojan.Heur.P5008F7B7B7
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055420.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055420.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055421.dll
 Infecté par: Trojan.Vundo.GNF
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055421.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055421.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055422.dll
 Infecté par: Gen:Trojan.Heur.P5008F7B7B7
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055422.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055422.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.exe
 Infecté par: Trojan.Generic.1755797
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.exe
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)
 Echec de la mise à jour
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.003
 Détecté avec: Application.Keylog.Ardamax.DLO
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.003
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.003
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)
 Echec de la mise à jour
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.004
 Infecté par: Trojan.Dropper.Ardamax.P
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.004
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)
 Echec de la mise à jour
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.006
 Infecté par: Trojan.Keylog.Ardamax.NAL
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.006
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)
 Echec de la mise à jour
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.007
 Infecté par: Trojan.Keylog.Ardamax.NAL
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)=>Windll32\GGPN.007
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055447.exe=>(RAR Sfx o)
 Echec de la mise à jour
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055451.dll
 Infecté par: Gen:Trojan.Heur.P5008F7B7B7
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055451.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055451.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055454.dll
 Infecté par: Gen:Trojan.Heur.P4018E7A7A7
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055454.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055454.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055455.dll
 Infecté par: Trojan.Vundo.GNF
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055455.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055455.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055458.dll
 Infecté par: Trojan.Vundo.GNF
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055458.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055458.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055459.dll
 Infecté par: Gen:Trojan.Heur.P5008F7B7B7
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055459.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055459.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055564.dll
 Infecté par: Trojan.Vundo.GNF
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055564.dll
 Echec de la désinfection
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055564.dll
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055568.exe=>(Quarantine-2)
 Détecté avec: Adware.Whenu.BSR
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055568.exe=>(Quarantine-2)
 Supprimé
 
C:\System Volume Information\_restore{22191401-F8EB-403E-A525-F6F527A36804}\RP137\A0055568.exe
 Supprimé
 
C:\WINDOWS\Windll32\GGPN.exe
 Infecté par: Trojan.Generic.1755797
 
C:\WINDOWS\Windll32\GGPN.exe
 Echec de la suppression
 
  
 
 Alors tout est beau ?

jlpjlp · Answer

télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
(attention bien mettre :files)

:processes
explorer.exe
:files
C:\WINDOWS\Windll32\GGPN.exe 
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\10F8581E.exe
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7F47226C.exe
C:\Documents and Settings\Anthony\Mes documents\Nouveau dossier\Keymaker\Keymaker.exe
C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe
:commands
[purity]
[emptytemp]
[start explorer]

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
_______________________

Télécharge ToolsCleaner sur ton bureau.
--> https://www.commentcamarche.net/telecharger/ 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

_________________________


Désactive ta restauration systeme puis redemarre ton ordi puis réactive là comme ceci:
https://www.informatruc.com

_________________________

remets un rapport RSIT et dis si encore des soucis

a plus

superman1221 · Answer

Hey merci bcp mon portable est comme neuf !!! dernière petite question... comment faire pour ne pas ravoir ce problème et que je n'aie pas a refaire tjrs ces étapes... y'a t-il un programme pour que je puisse faire le ménage une fois de temps en temps ??

jlpjlp · Answer

tu peux remettre un rapport RSIT pour etre sûr!



________________

il faudra mettre a jour windows avec le sp3, internet explorer avec la version 8



sinon
pour protéger gratos ton ordi

https://www.commentcamarche.net/telecharger/ 4 securite


vacciner son ordi après avoir branché toutes ses clés usb avec usbfix ou flash disinfector ou rav antivirus car beaucoup actuellement transitent par les supports externes :
http://ww25.evosla.com/compteur.php?soft=rav_antivirus
http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe
http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

---------
mettre un antivirus

ANTIVIR ou AVG8 ou (AVAST )
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
https://www.avira.com/fr/free-antivirus-windows
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT +/- si tea timer non active de spybot:
WINDOWS DEFENDER ou SPYWARE TERMINATOR ou SPYWARE GUARD
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

Rq : spybot … sortent de nouvelles versions régulièrement, vérifiez que vous avez la dernière version
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO

https://www.commentcamarche.net/telecharger/ 34055356 online armor personal firewall
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
https://forum.pcastuces.com/sujet.asp?f=25&s=35606
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
https://www.01net.com/
https://www.zonealarm.com/software/free-firewall

-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/

superman1221 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Anthony at 2009-05-20 14:37:02
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 57 GB (60%) free of 95 GB
Total RAM: 1022 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:37:16, on 2009-05-20
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\Toshiba\Toshiba Applet	hotkey.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Axon Data\AxCrypt\1.6.4.4\AxCrypt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Documents and Settings\Anthony\Local Settings\Temporary Internet Files\Content.IE5\Y1OCRJM5\RSIT[1].exe
C:\Program Files	rend micro\Anthony.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IE Privacy Keeper - Last IE Window Detector - {1201333E-BAD9-481C-BCF5-6904498CF85B} - C:\Program Files\UnH Solutions\IE Privacy Keeper\IEPKbho.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet	hotkey.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] C:\Program Files\Druide\Antidote\Antidote\Gestionnaire Antidote.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.antimalwareguard.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/...
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.3.102.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B1953AD6-C50E-11D3-B020-00A0C9251384} (O2C-Player (ELECO Software GmbH)) - http://www.o2c.de/download/o2cplayer.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://costco.pnimedia.com/upload/activex/v2_0_0_9/PCAXSetupv2.0.0.9.cab?
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://costco.pnimedia.com/upload/activex/v2_0_0_10/PCAXSetupv2.0.0.10.cab?
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: c:\windows\system32
ukatojo.dll,C:\WINDOWS\system32\wusorevo.dll c:\windows\system32\pinoteye.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe

jlpjlp · Answer

télécharge OTMoveIt
http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
(attention bien mettre :files)

:processes
explorer.exe
:files
C:\WINDOWS\system32\oyputvfn.dll
:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\2chkdsk]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=-
:commands
[purity]
[emptytemp]
[start explorer]

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
_______________________

Télécharge ToolsCleaner sur ton bureau.
--> https://www.commentcamarche.net/telecharger/ 34055291 toolscleaner
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

ps : pas besoin de m´envoyer le rapport si tout a été supprimé

_______________________



mettre a jour internet explorer
pour XP
http://download.microsoft.com/...

pour VISTA:
http://download.microsoft.com/download/5/9/8/598CDBFA-4C11-45BA-8283-91439C7B8E5B/IE8-WindowsVista-x86-FRA.exe

_____________

mettre à jour adobe reader  puis supprimer les anciennes version via le panneau de configuration
https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html

ou passer a un navigateur alternatif ce qui évitera les virus circulant via les PDF comme foxit reader (ne pas metre les barres foxit, ask, ebay..)

http://www.commentcamarche.net/telecharger/telechargement 205 foxit reader


_____________

Mettre a jour java:
https://javara.fr.malavida.com/

Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries. 
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.) 
Double-clique sur le répertoire JavaRa obtenu. 
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher) 
Clique sur Search For Updates. 
Sélectionne Update Using jucheck.exe puis clique sur Search. 
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes. 
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions. 
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok. 
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse. 
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log 
(c:\JavaRa.log) 
Ferme l'application. 

si cela ne fonctionne pas 

https://www.java.com/fr/download/windows_manual.jsp?locale=fr&host=www.java.com:80 

tu peux désinstaller les vieilles versions. 

_______________

il faudrait mettre le sp3 de windows
__________

voilà c'est bon pour toi

superman1221 · Answer

hey merci bcp c'est vrm gentil !!! té un champion ;)

Virus dans mon portable

15 réponses

Discussions similaires