Au secours Antivir qui ne demarre plus

Fermé
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 - 19 mai 2009 à 22:09
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 - 1 juil. 2009 à 19:04
Bonjour,
j'ai malencontreusement chargé un fichier .exe qui, dans un premier temps, a été repéré par Antivir comme Trojan. Il m'a proposé 'deny acsess" que j'ai accepté. Ce que je n'avais pas vu c'est que, tout de suite après, Antivir s'est désactivé. Le temps que le message de Windows apparaisse j'avais déjà reçu le second .exe qui, je suppose, était aussi un virus.
Résultat : impossible de remettre en fonction Antivir. Je l'ai désinstallé et réinstallé sans succés.

J'ai, parallèlement, mis un coup de Malwarebytes' Anti-Malware qui a trouvé 32 éléments infectés dont 2 Trojan et des ???? machinchose Hiijack ????

Quelqu'un peut-il m'aider à remettre Antivir en place et en passer un coup sur mes disques car même si je ne note rien de visible sur l'ordi j'ai l'impression que c'est bien un virus qui m'empêche d'activer Antivir.

Merci beaucoup d'avance
MMCCC34

59 réponses

Ced_King Messages postés 3519 Date d'inscription lundi 2 mars 2009 Statut Contributeur Dernière intervention 10 octobre 2016 571
19 mai 2009 à 22:17
Salut,

* Peux tu poster le rapport Malwarebytes et faire ceci :

Telecharges RSIT " Random's System Information Tool " sur ton bureau : http://images.malwareremoval.com/random/RSIT.exe

- Fermes toutes les applications en cours et double clic sur RSIT.exe
- Selectionnes " Continue " à l'ecran >> RSIT va analyser le pc et verifier si l'outil hijackthis ( version à jour) est present sur le pc, si ce n'est pas le cas, RSIT le telechargera >> acceptes la license
- Une fois l'analyse terminée, 2 rapports.txt s'ouvrent, log.txt à l'écran et info.txt dans la barre des taches
- Postes le contenu des 2 rapports
.
0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
19 mai 2009 à 22:38
Voici :

Le Log.txt :
Logfile of random's system information tool 1.06 (written by random/random)
Run by Kiki at 2009-05-19 22:20:01
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 26 GB (22%) free of 117 GB
Total RAM: 2047 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:36, on 2009-05-19
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\xampplite\apache\bin\apache.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
C:\Program Files\CPUCooL\CooLSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\xampplite\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\xampplite\apache\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\iTunes\iTunesHelper.exe
C:\windows\ld08.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\CounterPath\X-Lite\x-lite.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\LaCie\Ethernet Agent\LaCie Ethernet Agent.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\SYS32DLL.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\bloc-notes.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\SYS32DLL.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\Documents and Settings\Kiki\Bureau\RSIT.exe
C:\Program Files\trend micro\Kiki.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://gamespace.daemon-tools.cc/fra/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: 796525 helper - {E7F15AC4-E0A9-43F0-921B-70DFEA621220} - C:\WINDOWS\system32\796525\796525.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [CanalPlayerHelper] C:\Program Files\Lecteur CANALPLAY\CanalPlayerHelper.exe
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Canal Widget] "C:\Program Files\Canal\Canal Widget\Launcher.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.21\RivaTuner.exe" /S
O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld08.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [avast] "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\CounterPath\X-Lite\x-lite.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [LaCie Ethernet Agent Startup] "C:\Program Files\LaCie\Ethernet Agent\LaCie Ethernet Agent.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [SYS32DLL] SYS32DLL
O4 - Startup: bloc-notes2081804553.lnk = C:\Program Files\bloc-notes.exe
O4 - Startup: bloc-notes705144848.lnk = C:\Program Files\bloc-notes.exe
O4 - Startup: Impulse Dock.lnk = C:\Program Files\Stardock\Impulse\ImpulseDock.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: Suitcase 11.0.lnk = C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe
O4 - Startup: widget_programmes.lnk = C:\Program Files\widget_programmes\widget_programmes.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Kiki\Application Data\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampplite\apache\bin\apache.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service FLEXnethkmsvc (FLEXnethkmsvc) - Unknown owner - C:\WINDOWS\system32\3com_dmiu.exe
O23 - Service: Google Update Service (gupdate1c987b4a28189d2) (gupdate1c987b4a28189d2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kwari.xLoader - Unknown owner - C:\Documents.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: mysql - Unknown owner - C:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Lettriq Drivers Auto Removal (pr2aqb2b) (pr2aqb2b) - Vocabelum Inc - C:\WINDOWS\system32\pr2aqb2b.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
0
Ced_King Messages postés 3519 Date d'inscription lundi 2 mars 2009 Statut Contributeur Dernière intervention 10 octobre 2016 571
19 mai 2009 à 23:05
+

Lances Hijackthis et cliques sur " Do a scan only "

--> Coches les cases devant les lignes suivantes :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O4 - HKLM\..\Run: [sysldtray] C:\windows\ld08.exe
O4 - HKCU\..\Run: [SYS32DLL] SYS32DLL
O23 - Service: Kwari.xLoader - Unknown owner - C:\Documents.exe (file missing)

- Deconnectes toi et fermes toutes les applications en cours

- cliques sur " Fix Checked ", puis refermes hijackthis

Si tu as firefox, fais ceci :

Sur Firefox, Menu Editions / Préférences puis onglet Avancés.
Cliques sur Réseau et Paramètres.
Choisis "Ne pas mettre de Proxy".

------------------------

Ensuite, Telecharges Combofix et enregistres le sur ton bureau

http://download.bleepingcomputer.com/sUBs/ComboFix.exe -

/!\ Desactives ton antivirus et la garde de ton antispyware ( si tu en as un) /!\

- Deconnectes toi et fermes toutes les applications en cours
- Double clic sur Combofix.exe >> un message apparait > réponds " oui "
- ( Il est conseillé d'installer la console de recuperations)
- Selectionnes la langue et presse la touche 1 ( yes) pour lancer le scan

/!\ Ne touche ni à la souris, ni au clavier durant le scan, cela pourrait figer l'ordi /!\

- A la fin du scan, Combofix aura besoin de redemarrer pour finir la desinfection, laisses le faire
- Une fois terminé, un rapport s'affiche, poste son contenu que tu peux aussi trouver à c:\combofix.txt

0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
19 mai 2009 à 23:29
Je ne parviens pas à ouvrir Hijackthis !!
idem Antivir
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
19 mai 2009 à 23:32
HA si c'est bon !!
0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
20 mai 2009 à 06:57
Voici le combaFix je n'ai pas installé la console de récupération car je n'était pas connecté (çà se télécharge non ?)



ComboFix 09-05-19.04 - Kiki 2009-05-19 23:43.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.2047.1469 [GMT 2:00]
Lancé depuis: c:\documents and settings\Kiki\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Kiki\LOCALS~1\Temp\mProjector4174629170\File.3.1.1e.mfx
c:\docume~1\Kiki\LOCALS~1\Temp\mProjector4174629170\Flash6MovieV2.3.1.1e.mvx
c:\docume~1\Kiki\LOCALS~1\Temp\mProjector4174629170\FlashPlayer.3.1.1e.ocx
c:\docume~1\Kiki\LOCALS~1\Temp\mProjector4174629170\mPlayer.3.1.1e.dll
c:\docume~1\Kiki\LOCALS~1\Temp\mProjector4174629170\Registry.3.1.1e.mfx
c:\docume~1\Kiki\LOCALS~1\Temp\mProjector4174629170\System.3.1.1e.mfx
c:\documents and settings\Kiki\Local Settings\Temp\mProjector4174629170\File.3.1.1e.mfx
c:\documents and settings\Kiki\Local Settings\Temp\mProjector4174629170\Flash6MovieV2.3.1.1e.mvx
c:\documents and settings\Kiki\Local Settings\Temp\mProjector4174629170\FlashPlayer.3.1.1e.ocx
c:\documents and settings\Kiki\Local Settings\Temp\mProjector4174629170\mPlayer.3.1.1e.dll
c:\documents and settings\Kiki\Local Settings\Temp\mProjector4174629170\Registry.3.1.1e.mfx
c:\documents and settings\Kiki\Local Settings\Temp\mProjector4174629170\System.3.1.1e.mfx
c:\windows\ld08.exe
c:\windows\SYSTEM32\796525
c:\windows\SYSTEM32\796525\796525.dll
c:\windows\system32\digiwet.dll
c:\windows\system32\dumphive.exe
c:\windows\system32\Ijl11.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\SYS32DLL.exe
c:\windows\system32\tmp.reg
c:\windows\system32\tmp89.tmp
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-04-19 au 2009-05-19 ))))))))))))))))))))))))))))))))))))
.

2009-05-19 20:20 . 2009-05-19 20:36 -------- d-----w C:\rsit
2009-05-19 19:49 . 2009-05-19 19:49 -------- d-----w c:\documents and settings\All Users\Application Data\Avira
2009-05-19 19:49 . 2009-05-19 19:49 -------- d-----w c:\program files\Avira
2009-05-19 18:12 . 2009-03-24 14:07 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-19 16:15 . 2009-05-19 16:15 2 ---h--w c:\windows\sto453250.dat
2009-05-19 16:02 . 2009-05-19 16:02 32 --s-a-w c:\windows\system32\1015804163.dat
2009-05-19 16:02 . 2009-05-19 16:01 53248 --sh--r c:\windows\system32\3com_dmiu.exe
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w c:\windows\system32\GPhotos.scr
2009-04-29 20:40 . 2009-04-29 20:40 -------- d-----w c:\program files\Zoo Digital Publishing
2009-04-29 20:18 . 2009-04-29 20:18 -------- d-----w c:\documents and settings\Kiki\Application Data\2K Sports
2009-04-24 19:28 . 2009-04-24 19:28 -------- d-----w c:\documents and settings\Kiki\Application Data\Capcom
2009-04-21 22:20 . 2009-04-21 22:20 14311680 ----a-w c:\windows\system32\xlive.dll
2009-04-21 22:20 . 2009-04-21 22:20 13642496 ----a-w c:\windows\system32\xlivefnt.dll
2009-04-20 10:50 . 2009-04-20 10:50 -------- d-----w c:\program files\iPod
2009-04-20 10:50 . 2009-04-20 10:50 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 21:51 . 2008-11-30 20:59 50 ----a-w c:\program files\notepadsettings.ini
2009-05-19 21:34 . 2008-05-28 20:51 -------- d-----w c:\program files\Trend Micro
2009-05-18 20:24 . 2008-09-11 15:53 -------- d-----w c:\program files\Lx_cats
2009-05-18 17:49 . 2008-10-01 17:57 -------- d-----w c:\program files\adslTV
2009-05-18 11:43 . 2007-02-11 15:32 -------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2009-05-18 11:42 . 2007-05-14 15:44 -------- d-----w c:\program files\AGEIA Technologies
2009-05-18 11:40 . 2005-01-02 23:44 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-28 20:00 . 2004-12-31 14:05 98304 ----a-w c:\windows\DUMPb863.tmp
2009-04-20 10:50 . 2007-09-19 22:08 -------- d-----w c:\program files\Fichiers communs\Apple
2009-04-17 15:26 . 2009-04-17 15:26 -------- d-----w c:\program files\Architecte 3D Platinium
2009-04-16 15:53 . 2009-01-30 22:16 -------- d-----w c:\program files\Lavalys
2009-04-16 04:25 . 2003-04-24 11:00 84818 ----a-w c:\windows\system32\perfc00C.dat
2009-04-16 04:25 . 2003-04-24 11:00 510736 ----a-w c:\windows\system32\perfh00C.dat
2009-04-12 16:04 . 2008-01-23 18:44 8 ----a-w c:\windows\system32\nvModes.dat
2009-04-12 14:36 . 2007-12-09 10:36 1324 ----a-w c:\windows\system32\d3d9caps.dat
2009-04-12 14:32 . 2009-04-12 14:32 552 ----a-w c:\windows\system32\d3d8caps.dat
2009-04-12 14:32 . 2009-04-12 14:32 -------- d-----w c:\program files\SystemRequirementsLab
2009-04-12 13:00 . 2007-04-01 17:01 115432 ----a-w c:\windows\system32\OpenAL32.dll
2009-04-12 08:46 . 2006-06-26 22:16 -------- d-----w c:\program files\Java
2009-04-04 08:26 . 2009-03-27 20:33 -------- d-----w c:\program files\Microsoft ActiveSync
2009-03-27 20:33 . 2009-03-27 20:33 -------- d-----w c:\program files\IGN
2009-03-27 08:03 . 2009-03-27 08:03 401408 ----a-w c:\windows\system32\nvcuvid.dll
2009-03-27 08:03 . 2007-12-05 00:41 1560576 ----a-w c:\windows\system32\nvcuda.dll
2009-03-27 07:53 . 2005-05-05 22:12 90384 ----a-w c:\documents and settings\Kiki\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-27 06:14 . 2008-02-03 10:20 453152 ----a-w c:\windows\system32\NVUNINST.EXE
2009-03-26 18:01 . 2009-03-26 18:01 -------- d-----w c:\program files\PowerISO
2009-03-19 14:32 . 2008-01-29 10:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-15 10:25 . 2009-03-15 10:25 56268 ----a-w c:\windows\system32\drivers\scdemu.sys
2009-03-09 03:19 . 2009-01-11 10:14 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:20 . 2003-04-24 11:00 286720 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:13 . 2005-02-18 15:36 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 17:10 . 2004-08-19 23:09 78336 ----a-w c:\windows\system32\ieencode.dll
2008-10-07 18:45 . 2008-11-30 20:59 1518103 ----a-w c:\program files\bloc-notes.exe
2007-03-03 10:13 . 2007-03-03 10:13 610304 ----a-w c:\program files\TCPOptimizer.exe
2004-12-29 17:06 . 2004-12-29 17:05 266 --sh--w c:\program files\desktop.ini
2006-05-29 14:40 . 2007-03-01 14:44 7296000 -c--a-w c:\program files\mozilla firefox\plugins\libvlc.dll
2007-05-02 20:09 . 2007-05-02 20:09 119 --sh--w c:\windows\cnerolf.bin
.

------- Sigcheck -------

[-] 2008-04-14 02:34 979968 3EFE912DD25D2586E6A0341DB0A66F69 c:\windows\explorer.exe
[-] 2007-06-13 13:10 1037312 B795475444D6D57A572C14B9E1A29839 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2007-06-13 13:22 1037312 D0288319660EDCFED07C7E74C4EA38A5 c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2004-08-19 23:09 1036288 2A7BD330924252A2FD80344FC949BB72 c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2008-04-14 02:34 979968 3EFE912DD25D2586E6A0341DB0A66F69 c:\windows\ServicePackFiles\i386\explorer.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"eyeBeam SIP Client"="c:\program files\CounterPath\X-Lite\x-lite.exe" [2008-04-22 22237184]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"LaCie Ethernet Agent Startup"="c:\program files\LaCie\Ethernet Agent\LaCie Ethernet Agent.exe" [2008-06-19 4091904]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 1211176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-07-16 1409136]
"ProfilerU"="c:\program files\Saitek\SD6\Software\ProfilerU.exe" [2007-10-02 233472]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-04-22 185896]
"LXCFCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 73728]
"AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"Canal Widget"="c:\program files\Canal\Canal Widget\Launcher.exe" [2009-04-22 170072]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.21\RivaTuner.exe" [2008-12-10 2732032]
"au"="c:\program files\Dealio\DealioAU.exe" [2008-05-26 595296]
"SearchSettings"="c:\program files\Search Settings\SearchSettings.exe" [2008-06-12 991584]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\SYSTEM32\bthprops.cpl [2008-04-14 110592]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]
"nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2007-10-04 1626112]

c:\documents and settings\Kiki\Menu D‚marrer\Programmes\D‚marrage\
bloc-notes2081804553.lnk - c:\program files\bloc-notes.exe [2008-11-30 1518103]
bloc-notes705144848.lnk - c:\program files\bloc-notes.exe [2008-11-30 1518103]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-11-19 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 ----a-w c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Gaming Zone\\zclient.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\CounterPath\\X-Lite\\x-lite.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\Program Files\\adslTV\\vlc.exe"=
"c:\\xampplite\\apache\\bin\\apache.exe"=
"d:\\FSX\\FSUIPC & WIDEFS\\WideFS\\WideClient.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\Warez\\Warez.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\HomePlayer\\HomePlayer.exe"=
"c:\\Program Files\\Cachya Software\\Cachya Head Tracking\\bin\\Cachya 2.1.exe"=
"c:\\Program Files\\adslTV\\adsltv.exe"=
"d:\\Program Files\\Vsk3\\Vsk3.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"e:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"e:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe"=
"e:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"=
"e:\\Program Files\\Electronic Arts\\Alerte Rouge 3\\Data\\ra3_1.0.game"=
"c:\\Program Files\\LaCie\\Ethernet Agent\\LaCie Ethernet Agent.exe"=
"c:\\Program Files\\HomePlayer\\VLC\\vlc.exe"=
"e:\\Program Files\\Artefacts Studio\\Petanque\\bin\\release\\Petanque.exe"=
"e:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"e:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"e:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"=
"e:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.0\\cnc3game.dat"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"e:\\Program Files\\Microsoft Games\\Microsoft Flight Simulator X\\fsx.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"e:\\Program Files\\Saints Row 2\\SR2_pc.exe"=
"e:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2ServerLauncher.exe"=
"e:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"e:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"e:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"e:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"e:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
"e:\\Games\\Mass Effect\\Binaries\\MassEffect.exe"=
"e:\\Games\\Mass Effect\\MassEffectLauncher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Program Files\\Ubisoft\\Tom Clancy's H.A.W.X\\HAWX.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"d:\\Program Files\\iTunes\\iTunes.exe"=
"e:\\Program Files\\Capcom\\MotoGP 08\\MotoGP 08\\Launcher.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
"25782:TCP"= 25782:TCP:BitComet 25782 TCP
"25782:UDP"= 25782:UDP:BitComet 25782 UDP
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 pe3aqb2b;Lettriq Environment Driver (pe3aqb2b);c:\windows\SYSTEM32\DRIVERS\pe3aqb2b.sys [2008-06-06 68720]
R0 pf2aqb2b;Lettriq File System Driver (pf2aqb2b);c:\windows\SYSTEM32\DRIVERS\pf2aqb2b.sys [2008-06-06 83568]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-19 108289]
R2 Apache2.2;Apache2.2;c:\xampplite\apache\bin\apache.exe [2008-01-09 17920]
R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe [2008-10-23 188416]
S2 FLEXnethkmsvc;FLEXnet Licensing Service FLEXnethkmsvc;c:\windows\system32\3com_dmiu.exe srv --> c:\windows\system32\3com_dmiu.exe srv [?]
S2 gupdate1c987b4a28189d2;Google Update Service (gupdate1c987b4a28189d2);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-05 133104]
S2 pr2aqb2b;Lettriq Drivers Auto Removal (pr2aqb2b);c:\windows\system32\pr2aqb2b.exe svc --> c:\windows\system32\pr2aqb2b.exe svc [?]
S3 CrystalSysInfo;CrystalSysInfo;c:\program files\MediaCoder\SysInfo.sys [2007-09-25 15152]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [2009-04-16 26224]
S3 G200;G200;c:\windows\SYSTEM32\DRIVERS\G200m.sys [2007-09-15 320512]
S3 gsplittm;gsplittm;\??\c:\docume~1\CHARLO~1\LOCALS~1\Temp\gsplittm.sys --> c:\docume~1\CHARLO~1\LOCALS~1\Temp\gsplittm.sys [?]
S3 LCcfltr;Logitech USB Filter Driver;c:\windows\SYSTEM32\DRIVERS\LCcfltr.sys [2008-10-09 14095]
S3 mgau;mgau;c:\windows\SYSTEM32\DRIVERS\mgaum.sys [2007-09-29 320384]
S3 SaiH0BAC;SaiH0BAC;c:\windows\SYSTEM32\DRIVERS\SaiH0BAC.sys [2007-12-25 135168]
S3 scsiscan;Pilote de scanneur SCSI;c:\windows\SYSTEM32\DRIVERS\scsiscan.sys [2006-01-12 11520]
S3 Tileproxy;Tileproxy;c:\windows\SYSTEM32\DRIVERS\tileproxy.sys [2007-04-20 14080]
S3 vhidmini;Cachya Virtual Joystick;c:\windows\SYSTEM32\DRIVERS\vhidmini.sys [2008-03-14 7168]
S4 Kwari.xLoader;Kwari.xLoader;c:\documents and settings\Kiki\Local Settings\Application Data\Micro Forte\Kwari\Kwari.xLoader.32 --> c:\documents and settings\Kiki\Local Settings\Application Data\Micro Forte\Kwari\Kwari.xLoader.32 [?]
.
Contenu du dossier 'Tâches planifiées'

2009-05-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2009-05-19 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2006-12-29 11:36]

2009-05-19 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-05 17:10]
.
- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
HKCU-Run-OM_Monitor - c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe
HKCU-Run-avast - c:\progra~1\ALWILS~1\Avast4\ashDisp.exe
HKLM-Run-CanalPlayerHelper - c:\program files\Lecteur CANALPLAY\CanalPlayerHelper.exe
HKLM-Run-LClock - c:\program files\LClock\LClock.exe
HKLM-Run-[webwiz] - (no file)
HKLM-Run-EoEngine - (no file)
HKLM-Run-EoSudoku - (no file)
HKLM-Run-iconcache - (no file)
HKLM-Run-cleanup - (no file)


.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter au fichier PDF existant - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Compare Prices with &Dealio - c:\documents and settings\Kiki\Application Data\Dealio\kb127\res\DealioSearch.html
IE: Convertir en Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien en un fichier PDF existant - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir la sélection en Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la sélection en un fichier PDF existant - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir les liens sélectionnés en fichier Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convertir les liens sélectionnés en un fichier PDF existant - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
Trusted Zone: canalplay.com
Trusted Zone: canalplusactive.com
DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} - hxxp://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\Kiki\Application Data\Mozilla\Firefox\Profiles\wrfgp7k9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1189885&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=fr&ie=UTF-8&oe=UTF-8&source=iglk
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-fr&FORM=MIMWA1&q=
FF - component: c:\documents and settings\Kiki\Application Data\Mozilla\Firefox\Profiles\wrfgp7k9.default\extensions\{49a22409-bdf6-44b7-962e-c5366282f1bc}\components\FFAlert.dll
FF - component: c:\documents and settings\Kiki\Application Data\Mozilla\Firefox\Profiles\wrfgp7k9.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - component: c:\program files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - plugin: c:\program files\Canal\Canal Widget\VOD\npCpVod.dll
FF - plugin: c:\program files\Fichiers communs\mpDRM\NPMPDRM.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMPDRM.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: d:\program files\iTunes\Mozilla Plugins\npitunes.dll

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-19 23:55
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCFCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Kwari.xLoader]
"ImagePath"="c:\documents and settings\Kiki\Local Settings\Application Data\Micro Forte\Kwari\Kwari.xLoader.32"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-1060284298-1965331169-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-1060284298-1965331169-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:3c,09,be,45,3a,49,d2,69,cf,c4,1f,3a,b6,08,7a,82,e8,70,d8,23,20,09,a0,
56,ab,35,2e,1b,d2,fc,da,77,34,c5,2b,9a,9a,3d,25,88,12,ab,27,ea,a0,49,2c,c7,\
"??"=hex:2c,1b,6d,05,c1,77,48,ea,ef,91,4c,25,aa,5d,32,dd

[HKEY_USERS\S-1-5-21-1060284298-1965331169-725345543-1004\Software\SecuROM\License information*]
"datasecu"=hex:fa,e1,29,bb,d6,c8,ef,c8,36,e1,91,b6,38,1c,9f,ea,38,5b,1f,28,91,
35,f7,01,65,04,ea,1d,ba,55,fa,a5,81,76,e8,ac,b2,2c,90,34,29,5a,64,02,c3,dc,\
"rkeysecu"=hex:4b,a5,a4,32,d1,49,53,92,b1,ed,de,cf,99,95,03,47

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:72,07,3b,3b,2c,67,fc,53,8b,8c,fb,2b,ce,67,74,97,f4,48,aa,fd,09,
b4,d0,15,4d,7d,60,7c,b3,2b,87,ce,cb,d5,f5,da,6e,ff,52,0a,ae,e0,07,4d,b0,88,\

[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:72,07,3b,3b,2c,67,fc,53,8b,8c,fb,2b,ce,67,74,97,f4,48,aa,fd,09,
b4,d0,15,4d,7d,60,7c,b3,2b,87,ce,cb,d5,f5,da,6e,ff,52,0a,ae,e0,07,4d,b0,88,\

[HKEY_LOCAL_MACHINE\software\mpDRM\LicenseStore*]
@DACL=
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(836)
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(6128)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\DRIVERS\CDAC11BA.EXE
c:\program files\CPUCooL\CooLSRV.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\xampplite\mysql\bin\mysqld-nt.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\windows\SYSTEM32\PnkBstrA.exe
c:\windows\SYSTEM32\PnkBstrB.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\SYSTEM32\rundll32.exe
c:\windows\SYSTEM32\rundll32.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\program files\widget_programmes\widget_programmes.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.exe
.
**************************************************************************
.
Heure de fin: 2009-05-19 0:06 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-05-19 22:06

Avant-CF: 26,841,730,560 octets libres
Après-CF: 31,835,988,480 octets libres

377 --- E O F --- 2009-05-17 22:37
0
Ced_King Messages postés 3519 Date d'inscription lundi 2 mars 2009 Statut Contributeur Dernière intervention 10 octobre 2016 571
20 mai 2009 à 15:43
Bonjour,

* Ton pc est bien infecté, donc il est necessaire d'installer la console de récupération, pour ceci il te suffit de suivre ces explications : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix#manual_recovery

---------------------
Une fois celle-ci installée( la console de récupération) ---> Impératif:

Télécharges ATF Cleaner par Atribune sur ton bureau : http://www.atribune.org/ccount/click.php?id=1
- Démarres ATF-Cleaner et coche toutes les cases.
- Cliques sur <Empty Selected> et au message "Done Cleaning" sur <Ok>
NB : Si tu utilises Firefox ou Opera :
- Cliques sur Firefox ou Opera en haut puis choisis <Select All>.
- Cliques sur le bouton <Empty Selected> (NB : Si tu veux conserver tes mots de passe sauvegardés alors cliques sur <No> à l'invite).
- Cliques sur <Main> pour revenir à menu principal
- Cliques sur <Exit>, du menu prinicipal, pour quitter ATFcleaner.
NB : Si le prefetch est nettoyé le redémarrage du PC sera plus lent.

-----------------------------

> Avec Combofix :
- Crée un nouveau document texte : clic droit de souris sur le bureau => Nouveau => Document Texte, et copie/colle dedans les lignes suivantes :


KILLALL::

Services::
Kwari.xLoader
gsplittm

Collect::
c:\documents and settings\Kiki\Local Settings\Application Data\Micro Forte\Kwari\Kwari.xLoader.32

Files::
c:\windows\system32\3com_dmiu.exe
c:\docume~1\CHARLO~1\LOCALS~1\Temp\gsplittm.sys
c:\windows\sto453250.dat
c:\windows\system32\1015804163.dat
c:\windows\DUMPb863.tmp
c:\program files\Dealio\DealioAU.exe
c:\program files\Search Settings\SearchSettings.exe




- Enregistres ce fichier sous le nom CFScript (Type du fichier : tous les fichiers)
- Fermes tous tes navigateurs web (donc copie ou imprime les instructions suivantes avant si besoin est).
- Désactives ton antivirus et tes autres protections résidentes (ex : Spybot) si tu en as (c'est important).
- Fais un glissé/déposé de ce fichier CFScript sur le programme ComboFix.exe comme sur le lien :
http://img517.imageshack.us/img517/8662/cfscript10uc2.gif

( Cliques sur le fichier CFScript, maintiens le doigt enfoncé et glisses la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relâches alors le bouton de la souris).
- Combofix va démarrer puis une fenêtre bleue va apparaître.
- Patientes le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal !
- Ne touches à rien tant que le scan n'est pas terminé sinon le PC peut planter !
- Une fois le scan achevé, un rapport va s'afficher: poste le stp.
0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
20 mai 2009 à 16:23
Bonjour,
Dans la procédure pour installer la console il est spécifier de faire glisser le fichiezr téléchargé chez Micosoft sur Combofix.exe. Pour ma part rien ne se passe il vient simplement dessus et y reste...
0
Utilisateur anonyme
20 mai 2009 à 16:28
Salut

/!\ Ne pas faire la manip demandée , le script est incorrect ..

surtout :

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
20 mai 2009 à 16:30
Alors que fais-je ?
0
Utilisateur anonyme
20 mai 2009 à 16:30
Attend Ced_King , il corrigera le script
0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
20 mai 2009 à 16:32
Ok merci beaucoup. Tu as une idée pour l'histoire du glisser déposer sur combifix qui ne fonctionne pas ?
0
Ced_King Messages postés 3519 Date d'inscription lundi 2 mars 2009 Statut Contributeur Dernière intervention 10 octobre 2016 571
20 mai 2009 à 22:26
Re, je suis de retour, Chiquitine avait raison, j'ai fais une erreur d'inattention, c'est pour cela qu'il est important d'installer la console de récupération...

* On va faire autrement, tu as passé ATFCleaner j'espère ?:

Telecharges OTMoveIt3 de Oldtimer et enregistres le sur le bureau

http://oldtimer.geekstogo.com/OTMoveIt3.exe

- Desactives la garde de ton antivirus
- Fermes toutes les applications en cours et double-cliques sur OTMoveIT
- Assures toi que la case " Unregister Dll's and ocx's " soit bien cochée et copie ( ctrl+ C) ce qui est ci dessous en gras " :



:Processes
explorer.exe

:Services
Kwari.xLoader
gsplittm

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"au"=-
"SearchSettings"=-

:Files
c:\windows\system32\3com_dmiu.exe
c:\docume~1\CHARLO~1\LOCALS~1\Temp\gsplittm.sys
c:\windows\sto453250.dat
c:\windows\system32\1015804163.dat
c:\windows\DUMPb863.tmp

:Folder
c:\program files\Dealio
c:\program files\Search Settings

:commands
[purity]
[emptytemp]
[reboot]




Colles (Ctrl+V) le texte précédemment copié dans le cadre " Paste Instructions for Items to be Moved "
Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

---> Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
---> Le nom du rapport correspond au moment de sa création : date_heure.log


* Postes aussi un nouveau rapport RSIT stp...

0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
20 mai 2009 à 22:47
Salut,
C'est Ok pour ATFCleaner par contre je n'ai pas pu installer la console car je ne peux pas glisser déposer le fameux fichier sur combofix je n'ai aucune réaction...
Que faire ?
0
Ced_King Messages postés 3519 Date d'inscription lundi 2 mars 2009 Statut Contributeur Dernière intervention 10 octobre 2016 571
20 mai 2009 à 23:09
Fais ceci : Clique sur Démarrer puis Exécuter. Tapes combofix /u dans la zone de saisie puis OK.
- ( il y a un espace entre combofix et /u)

Puis passe à Otmoveit comme précisé ICI
0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
20 mai 2009 à 23:40
J'ai suivi la procédure par le biais de démarrer => exécuter mais ai-je bien installé la console ?

rapport OT Moveit :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========

Service\Driver Kwari.xLoader deleted successfully.

Service\Driver gsplittm deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\au deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SearchSettings deleted successfully.
========== FILES ==========
File move failed. c:\windows\system32\3com_dmiu.exe scheduled to be moved on reboot.
File/Folder c:\docume~1\CHARLO~1\LOCALS~1\Temp\gsplittm.sys not found.
c:\windows\sto453250.dat moved successfully.
File move failed. c:\windows\system32\1015804163.dat scheduled to be moved on reboot.
c:\windows\DUMPb863.tmp moved successfully.
Error: Unable to interpret <:Folder> in the current context!
Error: Unable to interpret <c:\program files\Dealio> in the current context!
Error: Unable to interpret <c:\program files\Search Settings> in the current context!
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\File.3.1.1e.mfx scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\Flash6MovieV2.3.1.1e.mvx scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\FlashPlayer.3.1.1e.ocx scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\mPlayer.3.1.1e.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\Registry.3.1.1e.mfx scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\System.3.1.1e.mfx scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Kiki\LOCALS~1\Temp\etilqs_RJtxobaWbznrJZDpQkuW scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Kiki\LOCALS~1\Temp\WCESLog.log scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Kiki\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Kiki\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_148.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Kiki\Local Settings\Application Data\Mozilla\Firefox\Profiles\wrfgp7k9.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05202009_232414

Files moved on Reboot...
File move failed. c:\windows\system32\3com_dmiu.exe scheduled to be moved on reboot.
File move failed. c:\windows\system32\1015804163.dat scheduled to be moved on reboot.
C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\File.3.1.1e.mfx moved successfully.
C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\Flash6MovieV2.3.1.1e.mvx moved successfully.
C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\FlashPlayer.3.1.1e.ocx unregistered successfully.
C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\FlashPlayer.3.1.1e.ocx moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\mPlayer.3.1.1e.dll
C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\mPlayer.3.1.1e.dll NOT unregistered.
C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\mPlayer.3.1.1e.dll moved successfully.
C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\Registry.3.1.1e.mfx moved successfully.
C:\DOCUME~1\Kiki\LOCALS~1\Temp\mProjector4174629170\System.3.1.1e.mfx moved successfully.
File C:\DOCUME~1\Kiki\LOCALS~1\Temp\etilqs_RJtxobaWbznrJZDpQkuW not found!
C:\DOCUME~1\Kiki\LOCALS~1\Temp\WCESLog.log moved successfully.
C:\Documents and Settings\Kiki\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_148.dat not found!
C:\Documents and Settings\Kiki\Local Settings\Application Data\Mozilla\Firefox\Profiles\wrfgp7k9.default\urlclassifier3.sqlite moved successfully.


Et le RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Kiki at 2009-05-20 23:39:21
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 36 GB (31%) free of 117 GB
Total RAM: 2047 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:39:30, on 20/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\xampplite\apache\bin\apache.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
C:\Program Files\CPUCooL\CooLSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\xampplite\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\svchost.exe
C:\xampplite\apache\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\CounterPath\X-Lite\x-lite.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\LaCie\Ethernet Agent\LaCie Ethernet Agent.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\bloc-notes.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\widget_programmes\widget_programmes.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\Documents and Settings\Kiki\Bureau\RSIT.exe
C:\Program Files\Trend Micro\Kiki.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Canal Widget] "C:\Program Files\Canal\Canal Widget\Launcher.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.21\RivaTuner.exe" /S
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\CounterPath\X-Lite\x-lite.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [LaCie Ethernet Agent Startup] "C:\Program Files\LaCie\Ethernet Agent\LaCie Ethernet Agent.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Startup: bloc-notes2081804553.lnk = C:\Program Files\bloc-notes.exe
O4 - Startup: bloc-notes705144848.lnk = C:\Program Files\bloc-notes.exe
O4 - Startup: Impulse Dock.lnk = C:\Program Files\Stardock\Impulse\ImpulseDock.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: Suitcase 11.0.lnk = C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe
O4 - Startup: widget_programmes.lnk = C:\Program Files\widget_programmes\widget_programmes.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Kiki\Application Data\Dealio\kb127\res\DealioSearch.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.canalplay.com
O15 - Trusted Zone: *.canalplusactive.com
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - https://zone.msn.com/en/utility/handler404.aspx?404;http://zone.msn.com:80/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampplite\apache\bin\apache.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CanalPlus.VOD - Canal+ Active - C:\Program Files\Canal\Canal Widget\VOD\CanalPlus.VOD.exe
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service FLEXnethkmsvc (FLEXnethkmsvc) - Unknown owner - C:\WINDOWS\system32\3com_dmiu.exe
O23 - Service: Google Update Service (gupdate1c987b4a28189d2) (gupdate1c987b4a28189d2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: mysql - Unknown owner - C:\xampplite\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Lettriq Drivers Auto Removal (pr2aqb2b) (pr2aqb2b) - Vocabelum Inc - C:\WINDOWS\system32\pr2aqb2b.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
0
Ced_King Messages postés 3519 Date d'inscription lundi 2 mars 2009 Statut Contributeur Dernière intervention 10 octobre 2016 571
21 mai 2009 à 14:26
Bonjour,

Désolé mais pas trop de temps à moi actuellement...

- Télécharges ToolbarSD et enregistres le sur ton bureau :


- Désactives la garde résidente de ton antivirus et celle de ton antispyware

- Lances l'installation en exécutant le fichier téléchargé

- Fermes toutes les applications en cours et double cliques sur le raccourci de ton bureau

- Sélectionnes la langue et presse la touche " Entrée "

- Choisis l'option1 au menu et patientes le temps de la recherche

- A la fin de la recherche, un rapport s'affichera, postes son contenu
.
0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
21 mai 2009 à 19:58
Je ne parviens pas à poster le rapport ???
il me marque que le message est déjà posté
0
^^Marie^^ Messages postés 113929 Date d'inscription mardi 6 septembre 2005 Statut Membre Dernière intervention 28 août 2020 3 274
25 mai 2009 à 16:30
Salut

Pour avancer,
Ton rapport doit être trop long, donc coupe le en 2

++
0
MMCCC34 Messages postés 173 Date d'inscription jeudi 29 mai 2008 Statut Membre Dernière intervention 23 juillet 2018 1
28 mai 2009 à 19:48
1/3
-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 2.80GHz )
BIOS : BIOS Date: 04/27/04 20:18:06 Ver: 08.00.09
USER : Kiki ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.26 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:114 Go (Free:35 Go)
D:\ (Local Disk) - NTFS - Total:149 Go (Free:50 Go)
E:\ (Local Disk) - NTFS - Total:596 Go (Free:138 Go)
F:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD)
J:\ (CD or DVD)
K:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 21/05/2009|15:39 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\Kiki\APPLIC~1\Dealio
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\temp
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\alerts.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\alerts_over.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\alerts_rec.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\alerts_rec_over.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\chevron-small.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\DealioSearch.html
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\deals-leftcap.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\deal_report.jpg
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\ebay_login.jpg
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\err_mainwindow.html
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\err_toolbar.html
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\global_scripts.js
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\headerbgthin.jpg
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\highlight-bg.png
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\logo.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\logo_over.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\man_toolbar.css
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\man_toolbar.html
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\man_toolbar.js
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\man_toolbarl.js
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\post-this-deal.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\post-this-deal_over.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\scripts.js
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\scroller.js
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\search-chevron.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\search-chevron_over.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\search_bg_blink.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\separator.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\settings.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\settings_over.gif
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\res\yahoo-search.png
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\index.76.35
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.10.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.109.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.110.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.12.52
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.13.58
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.130.58
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.135.50
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.153.44
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.155.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.156.49
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.16.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.161.52
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.178.66
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.184.55
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.188.52
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.189.45
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.196.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.198.56
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.199.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.200.53
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.201.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.202.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.203.71
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.205.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.213.71
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.214.49
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.215.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.216.67
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.217.67
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.218.52
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.219.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.220.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.221.57
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.222.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.223.68
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.226.68
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.227.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.228.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.229.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.23.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.239.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.24.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.240.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.241.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.242.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.243.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.244.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.245.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.247.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.248.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.249.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.250.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.251.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.252.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.253.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.254.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.255.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.256.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.257.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.279.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.28.58
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.282.75
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.283.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.284.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.289.67
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.290.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.291.61
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.296.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.297.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.304.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.307.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.308.75
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.31.47
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.310.46
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.311.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.315.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.316.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.317.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.318.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.319.49
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.32.48
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.334.44
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.335.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.336.44
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.337.44
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.338.75
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.339.47
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.34.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.340.47
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.341.47
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.349.50
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.35.48
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.350.50
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.351.51
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.352.54
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.353.51
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.354.51
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.357.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.358.52
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.359.52
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.360.53
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.361.54
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.362.68
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.363.58
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.364.54
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.365.53
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.367.56
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.368.58
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.369.55
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.370.56
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.371.56
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.372.57
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.373.55
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.375.56
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.376.57
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.377.55
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.378.65
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.384.58
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.386.71
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.387.59
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.388.59
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.389.59
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.390.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.391.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.392.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.393.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.394.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.396.61
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.397.61
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.398.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.399.60
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.403.61
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.404.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.405.61
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.406.61
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.407.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.408.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.409.61
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.412.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.413.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.414.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.415.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.416.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.417.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.418.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.419.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.420.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.421.62
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.423.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.424.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.425.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.426.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.427.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.428.65
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.429.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.430.63
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.432.65
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.433.64
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.434.65
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.435.64
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.436.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.437.64
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.438.71
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.439.71
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.440.75
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.442.73
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.443.73
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.444.73
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.445.68
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.446.69
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.450.67
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.451.67
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.452.68
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.453.68
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.454.69
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.456.69
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.457.75
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.458.70
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.459.70
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.460.69
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.462.74
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.463.69
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.464.70
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.465.68
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.468.70
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.469.70
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.470.70
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.471.73
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.472.70
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.478.74
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.479.73
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.480.68
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.481.71
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.482.74
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.49.67
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.50.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.500.71
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.501.74
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.502.71
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.51.69
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.52.72
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.520.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.521.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.522.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.53.51
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.531.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.532.75
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.534.75
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.54.47
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.55.45
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.56.69
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.57.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.58.47
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.593.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.595.76
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.63.57
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.66.47
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.70.75
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\rules\rules.1.71.43
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\temp\dealio-14384.log
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\temp\installtype.ini
C:\DOCUME~1\Kiki\APPLIC~1\Dealio\kb127\temp\_toolbar_tmp_4740_348_3.html
0