[autorun] Résolu

Question

Bonjour,
j`ai un autorun qui m`enpoisonne la vie et avast ne s`arrete pas de le detecter mais il revient tout le temps et dans le fichier il est ecrit ceci :
[autorun]
shellexecute=Wscript.exe /e:vbs winfile.jpg
Configuration: Windows XP Internet Explorer 7.0
Avast 4.8

Destrio5 · Answer

Bonjour,

--> Télécharge UsbFix (de C_XX & Chiquitine29) sur ton Bureau.

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix sur ton Bureau.

--> Choisis l'option 1 (Recherche).

--> Laisse travailler l'outil.

--> Poste le rapport UsbFix.txt.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.

oelpmis · Answer

Merci la rapidite voici le texte :




############################## [ UsbFix V3.031 ]

# User : Med (Administrateurs) # MOAL
# Update on 13/06/09 by Chiquitine29
# Start at: 12:15:00 | 13/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

#         Intel(R) Pentium(R) M processor 1400MHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090612-0] 4.8.1335 [ (!) Disabled | Updated ]
# AV : McAfee VirusScan  [ (!) Disabled | (!) Outdated ]
# FW : McAfee Personal Firewall Plus[ Enabled ]

# C:\ # Disque fixe local # 17,37 Go (3,68 Go free) [System] # NTFS
# D:\ # Disque fixe local # 19,89 Go (2,25 Go free) [Stokage] # NTFS
# E:\ # Disque CD-ROM # 664,51 Mo (0 Mo free) [Mes Fichiers] # CDFS
# F:\ # Disque CD-ROM
# H:\ # Disque CD-ROM # 4,44 Mo (0 Mo free) [U3 System] # CDFS
# I:\ # Disque amovible # 495,01 Mo (75,59 Mo free) [MOAL] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wscript.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Med\Application Data\U3\0E3131614161F8D6\LaunchPad.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre Startup ]

HKCU_Main:   "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:   "Start Page"="http://google.atcomet.com/m/" 
HKCU_Main:   "Start Page Restore"="https://www.msn.com/fr-fr/?ocid=iehp" 
HKCU_Main:   "Start Page Redirect Cache"="https://www.msn.com/fr-fr?ocid=iehp" 
HKCU_Main:   "Start Page Redirect Cache_TIMESTAMP"=hex:c0,63,f9,9c,b0,b3,c9,01 
HKCU_Main:   "Start Page Redirect Cache AcceptLangs"="fr" 
HKLM_logon:  "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon:  "DefaultUserName"="Med" 
HKLM_logon:  "AltDefaultUserName"="Med" 
HKLM_logon:  "LegalNoticeCaption"="" 
HKLM_logon:  "LegalNoticeText"="" 
HKLM_Run:    AGRSMMSG=AGRSMMSG.exe 
HKLM_Run:    Babylon Client=C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart 
HKLM_Run:    LFAgent=C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30.exe -start 
HKLM_Run:    SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe" 
HKLM_Run:    CTFMON=C:\WINDOWS\system32\wscript.exe /E:vbs C:\WINDOWS\system32\winjpg.jpg 
HKLM_Run:    ISUSPM="C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -scheduler 
HKLM_Run:    avast!="C:\Program Files\Alwil Software\Avast4\ashDisp.exe" 
HKLM_Run:    regdiit=C:\WINDOWS\system32\winxp.exe 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    TuneUp MemOptimizer="C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe" autostart  
HKCU_Run:    IDMan=C:\Program Files\Internet Download Manager\IDMan.exe /onboot  
HKCU_Run:    ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe  
HKCU_Run:    RoboForm="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"  
HKCU_Run:    DAEMON Tools Lite="C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun  

################## [ Fichiers # Dossiers infectieux ]

Présent ! C:\WINDOWS\autorun.ini  
Présent ! C:\WINDOWS\system32\winjpg.jpg  
Présent ! C:\winfile.jpg  
Présent ! C:\autorun.inf  
Présent ! D:\winfile.jpg  
Présent ! D:\autorun.inf  
Présent ! H:\autorun.inf  
Présent ! I:\winfile.jpg  
Présent ! I:\autorun.inf  
Présent ! "I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013"  

################## [ Registre # Clés Run infectieuses ]

Présent ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "CTFMON"    
Présent ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "regdiit"    
Présent ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe    
Présent ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe    
Présent ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optionsegedit.exe    
Présent ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	askmgr.exe    
Présent ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\drwtsn32.exe    
Présent ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\dwwinxp.exe    
Présent ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\MSConfig.exe    
Présent ! HKLM\software\microsoft\windows nt\currentversion\image file execution optionsstrui.exe    
Présent ! HKLM\software\microsoft\security center "AntiVirusOverride" ( 0x1 )  

################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\C\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\D\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\H\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{1d666feb-19a4-11dd-bde1-cc2257132960}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{1d666fee-19a4-11dd-bde1-cc2257132960}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{6ea368d2-1fbc-11de-8164-0000f089921f}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{6ea368d2-1fbc-11de-8164-0000f089921f}\Shell\open\Command  
HKCU\...\Explorer\MountPoints2\{77787da0-a193-11dd-801c-806d6172696f}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{bc5436a3-2e23-11dd-be3e-0000f089921f}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{bc5436a3-2e23-11dd-be3e-0000f089921f}\Shell\ouvrir\Command  
HKCU\...\Explorer\MountPoints2\{e69d6815-0763-11de-8120-0000f089921f}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{e69d6815-0763-11de-8120-0000f089921f}\Shell\ouvrir\Command  

################## [ ! Fin du rapport # UsbFix V3.031 ! ]

Destrio5 · Answer

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix présent sur ton Bureau.

--> Choisis l'option 2 (Suppression).

--> Ton Bureau disparaîtra et le PC redémarrera.

--> Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.

--> Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

oelpmis · Answer

Voici le resultat apres suppression et redemarrage du pc .


############################## [ UsbFix V3.031 ]

# User : Med (Administrateurs) # MOAL
# Update on 13/06/09 by Chiquitine29
# Start at: 12:29:58 | 13/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

#         Intel(R) Pentium(R) M processor 1400MHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090612-0] 4.8.1335 [ (!) Disabled | Updated ]
# AV : McAfee VirusScan  [ (!) Disabled | (!) Outdated ]
# FW : McAfee Personal Firewall Plus[ Enabled ]

# C:\ # Disque fixe local # 17,37 Go (3,69 Go free) [System] # NTFS
# D:\ # Disque fixe local # 19,89 Go (2,25 Go free) [Stokage] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# H:\ # Disque CD-ROM # 4,44 Mo (0 Mo free) [U3 System] # CDFS
# I:\ # Disque amovible # 495,01 Mo (75,59 Mo free) [MOAL] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers # Dossiers infectieux ]

Supprimé ! C:\WINDOWS\autorun.ini  
Supprimé ! C:\WINDOWS\system32\winjpg.jpg  
Deleted ! C:\winfile.jpg    
Deleted ! C:\autorun.inf    
Deleted ! D:\winfile.jpg    
Deleted ! D:\autorun.inf    
(!) Not Deleted ! H:\autorun.inf   
Deleted ! I:\winfile.jpg    
Deleted ! I:\autorun.inf    
Deleted ! "I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013"    

################## [ Registre # Clés Run infectieuses ]

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "CTFMON"    
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "regdiit"    
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution 

Options\msconfig.exe    
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution 

Options\procexp.exe    
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution 

Optionsegedit.exe    
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution 

Options	askmgr.exe    
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution 

options\drwtsn32.exe    
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution 

options\dwwinxp.exe    
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution 

optionsstrui.exe    
# HKLM\software\microsoft\security center\ "AntiVirusOverride" # -> Reset sucessfully !  

################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\...\Explorer\MountPoints2\C\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\D\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\H\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{6ea368d2-1fbc-11de-8164-0000f089921f}

\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{bc5436a3-2e23-11dd-be3e-0000f089921f}

\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{e69d6815-0763-11de-8120-0000f089921f}

\Shell\AutoRun\Command  

################## [ Listing des fichiers présent ]

[10/10/2008 18:56|---hs----|212] - C:\boot.ini
[07/09/2002 01:00|-rahs----|4952] - C:\Bootfont.bin
[04/05/2008 04:49|--a------|0] - C:\CONFIG.SYS
[09/04/2008 21:07|--a------|1522] - C:\cyber.txt
[04/05/2008 04:49|-rahs----|0] - C:\IO.SYS
[03/09/2008 13:18|--a------|1595] - C:\msc.txt
[04/05/2008 04:49|-rahs----|0] - C:\MSDOS.SYS
[01/02/2009 19:24|--a------|649] - C:\NServer.log
[04/08/2004 03:38|-rahs----|47564] - C:\NTDETECT.COM
[30/09/2008 11:53|-rahs----|252240] - C:
tldr
[?|?|?] - C:\pagefile.sys
[11/03/2009 19:39|--ah-----|268] - C:\sqmdata00.sqm
[22/03/2009 16:56|--ah-----|268] - C:\sqmdata01.sqm
[11/03/2009 19:39|--ah-----|244] - C:\sqmnoopt00.sqm
[22/03/2009 16:56|--ah-----|244] - C:\sqmnoopt01.sqm
[13/06/2009 12:31|--a------|4688] - C:\UsbFix.txt
[04/05/2008 19:56|--a------|146] - C:\YServer.txt
[04/05/2008 04:57|--ahs----|6144] - D:\Thumbs.db
[04/12/2006 17:30|-r-------|1095224] - H:\LaunchU3.exe
[13/02/2007 15:57|-r-------|3182933] - H:\Launchpad.zip
[13/02/2007 15:55|-r-------|175] - H:\autorun.inf
[27/05/2009 11:57|--a------|1095224] - I:\LaunchU3.exe
[30/05/2009 21:33|--a------|159232] - I:\5.Service call flow.DOC
[23/05/2009 09:36|--a------|69120] - I:\Abonnees PDSN au 23052009.xls
[11/04/2009 12:34|--a------|26624] - I:\Alarme 07042009.xls
[23/05/2009 19:28|--a------|51200] - I:\Annexes.xls
[02/05/2009 14:19|--a------|30075904] - I:\avira_antivir_personal_en.exe
[10/05/2009 20:35|--a------|81408] - I:\B T S.xls
[22/08/2005 16:39|--a------|709632] - I:\CDMA 100K lines Data Network 

Topology20050822.VSD
[21/03/2009 09:23|--a------|85667] - I:\Commande DOS.txt
[23/05/2009 09:36|--a------|31876608] - I:\Export Data PDSN 23052009.XLS
[09/05/2009 16:28|--a------|2359350] - I:\FireWall Tizi-Ouzou.bmp
[12/04/2009 12:29|--a------|2359350] - I:\MSC041209.bmp
[14/04/2009 09:40|--a------|32256] - I:\Path_id BTS.doc
[28/05/2009 09:57|--a------|6212] - I:\Releve-CCP.xls
[26/05/2009 10:20|--a------|48128] - I:\Releve-CCP (Enregistr‚ automati).xls

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# D:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# I:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## [ ! Fin du rapport # UsbFix V3.031 ! ]

oelpmis · Answer

Voici le resultat apres suppression et redemarrage du pc .


############################## [ UsbFix V3.031 ]

# User : Med (Administrateurs) # MOAL
# Update on 13/06/09 by Chiquitine29
# Start at: 12:29:58 | 13/06/2009
# Website : http://pagesperso-orange.fr/NosTools/usbfix.html

#         Intel(R) Pentium(R) M processor 1400MHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090612-0] 4.8.1335 [ (!) Disabled | Updated ]
# AV : McAfee VirusScan  [ (!) Disabled | (!) Outdated ]
# FW : McAfee Personal Firewall Plus[ Enabled ]

# C:\ # Disque fixe local # 17,37 Go (3,69 Go free) [System] # NTFS
# D:\ # Disque fixe local # 19,89 Go (2,25 Go free) [Stokage] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM
# H:\ # Disque CD-ROM # 4,44 Mo (0 Mo free) [U3 System] # CDFS
# I:\ # Disque amovible # 495,01 Mo (75,59 Mo free) [MOAL] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers # Dossiers infectieux ]

Supprimé ! C:\WINDOWS\autorun.ini  
Supprimé ! C:\WINDOWS\system32\winjpg.jpg  
Deleted ! C:\winfile.jpg    
Deleted ! C:\autorun.inf    
Deleted ! D:\winfile.jpg    
Deleted ! D:\autorun.inf    
(!) Not Deleted ! H:\autorun.inf   
Deleted ! I:\winfile.jpg    
Deleted ! I:\autorun.inf    
Deleted ! "I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013"    

################## [ Registre # Clés Run infectieuses ]

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "CTFMON"    
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "regdiit"    
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution 

Options\msconfig.exe    
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution 

Options\procexp.exe    
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution 

Optionsegedit.exe    
Deleted ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution 

Options	askmgr.exe    
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution 

options\drwtsn32.exe    
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution 

options\dwwinxp.exe    
Deleted ! HKLM\software\microsoft\windows nt\currentversion\image file execution 

optionsstrui.exe    
# HKLM\software\microsoft\security center\ "AntiVirusOverride" # -> Reset sucessfully !  

################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\...\Explorer\MountPoints2\C\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\D\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\H\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{6ea368d2-1fbc-11de-8164-0000f089921f}

\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{bc5436a3-2e23-11dd-be3e-0000f089921f}

\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{e69d6815-0763-11de-8120-0000f089921f}

\Shell\AutoRun\Command  

################## [ Listing des fichiers présent ]

[10/10/2008 18:56|---hs----|212] - C:\boot.ini
[07/09/2002 01:00|-rahs----|4952] - C:\Bootfont.bin
[04/05/2008 04:49|--a------|0] - C:\CONFIG.SYS
[09/04/2008 21:07|--a------|1522] - C:\cyber.txt
[04/05/2008 04:49|-rahs----|0] - C:\IO.SYS
[03/09/2008 13:18|--a------|1595] - C:\msc.txt
[04/05/2008 04:49|-rahs----|0] - C:\MSDOS.SYS
[01/02/2009 19:24|--a------|649] - C:\NServer.log
[04/08/2004 03:38|-rahs----|47564] - C:\NTDETECT.COM
[30/09/2008 11:53|-rahs----|252240] - C:
tldr
[?|?|?] - C:\pagefile.sys
[11/03/2009 19:39|--ah-----|268] - C:\sqmdata00.sqm
[22/03/2009 16:56|--ah-----|268] - C:\sqmdata01.sqm
[11/03/2009 19:39|--ah-----|244] - C:\sqmnoopt00.sqm
[22/03/2009 16:56|--ah-----|244] - C:\sqmnoopt01.sqm
[13/06/2009 12:31|--a------|4688] - C:\UsbFix.txt
[04/05/2008 19:56|--a------|146] - C:\YServer.txt
[04/05/2008 04:57|--ahs----|6144] - D:\Thumbs.db
[04/12/2006 17:30|-r-------|1095224] - H:\LaunchU3.exe
[13/02/2007 15:57|-r-------|3182933] - H:\Launchpad.zip
[13/02/2007 15:55|-r-------|175] - H:\autorun.inf
[27/05/2009 11:57|--a------|1095224] - I:\LaunchU3.exe
[30/05/2009 21:33|--a------|159232] - I:\5.Service call flow.DOC
[23/05/2009 09:36|--a------|69120] - I:\Abonnees PDSN au 23052009.xls
[11/04/2009 12:34|--a------|26624] - I:\Alarme 07042009.xls
[23/05/2009 19:28|--a------|51200] - I:\Annexes.xls
[02/05/2009 14:19|--a------|30075904] - I:\avira_antivir_personal_en.exe
[10/05/2009 20:35|--a------|81408] - I:\B T S.xls
[22/08/2005 16:39|--a------|709632] - I:\CDMA 100K lines Data Network 

Topology20050822.VSD
[21/03/2009 09:23|--a------|85667] - I:\Commande DOS.txt
[23/05/2009 09:36|--a------|31876608] - I:\Export Data PDSN 23052009.XLS
[09/05/2009 16:28|--a------|2359350] - I:\FireWall Tizi-Ouzou.bmp
[12/04/2009 12:29|--a------|2359350] - I:\MSC041209.bmp
[14/04/2009 09:40|--a------|32256] - I:\Path_id BTS.doc
[28/05/2009 09:57|--a------|6212] - I:\Releve-CCP.xls
[26/05/2009 10:20|--a------|48128] - I:\Releve-CCP (Enregistr‚ automati).xls

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# D:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# I:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## [ ! Fin du rapport # UsbFix V3.031 ! ]

Destrio5 · Answer

--> Désinstalle UsbFix.

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

oelpmis · Answer

Voici le resultat avec apres installation de RSIT .

-------------------------------------------------------------------------

Logfile of random's system information tool 1.06 (written by random/random)
Run by Med at 2009-06-13 12:43:40
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 5 GB (31%) free of 18 GB
Total RAM: 758 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:45, on 13/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
d:\Documents and Settings\Med\Mes documents\Downloads\Programs\RSIT.exe
C:\Program Files\Med.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English	bmyB1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: precisead - {a4ec18f8-cc8a-fa45-33f9-b8d9717d8dfa} - C:\WINDOWS\system32
spD.dll (file missing)
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English	bmyB1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English	bmyB1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [LFAgent] C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30.exe -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/PopularScreenSaversInitialSetup1.0.1.1.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5E35CBC9-8AF2-41FC-BBB2-289A58FF3BCA}: NameServer = 194.2.0.50,193.251.169.83
O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

Destrio5 · Answer

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

oelpmis · Answer

La suite 
............................
info.txt logfile of random's system information tool 1.06 2009-06-13 12:43:47

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\unyt_wrap.exe
-->MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
AI RoboForm (All Users)-->"C:\Program Files\Siber Systems\AI RoboForm\rfwipeout.exe"
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Babylon-->C:\Program Files\Babylon\Babylon-Pro\Utils\uninstbb.exe
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Contextual Tool Precisead-->C:\WINDOWS\system32\1b13a672-5f3e-a9b6-baa7-66c7c4c7ddb3.exe
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Don't Panic! 3.0 Demo-->C:\PROGRA~1\Panicware\Don't Panic! 3 Demo\UNWISE.EXE C:\PROGRA~1\Panicware\Don't Panic! 3 Demo\INSTALL.LOG
HijackThis 2.0.2-->"C:\Program Files\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
Intel(R) Extreme Graphics 2 Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_3582
Intel(R) Network Connections 13.0.42.0-->MsiExec.exe /i{2223FC2F-B862-4F83-BC9E-DDF2DADF2859} ARPREMOVE=1
Internet Download Manager-->C:\Program Files\Internet Download Manager\Uninstall.exe
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
K-Lite Codec Pack 4.7.0 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
LimeWire 5.1.2-->"C:\Program Files\LimeWire\uninstall.exe"
Lock Folder XP 3.6-->"C:\Program Files\Everstrike Software\Lock Folder XP 3.6\Uninstall.exe" "C:\Program Files\Fichiers communs\Everstrike Software\Lock Folder XP 3.6\install.log"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour Microsoft Office Excel 2007 Help  (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Word 2007 Help  (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Mise à jour pour Windows Internet Explorer 8 (KB968220)-->"C:\WINDOWS\ie8updates\KB968220-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB971180)-->"C:\WINDOWS\ie8updates\KB971180-IE8\spuninst\spuninst.exe"
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
MpcStar 3.8-->C:\Program Files\MpcStar\uninst.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser-->MsiExec.exe /I{AEB9948B-4FF2-47C9-990E-47014492A0FE}
myBabylon_English Toolbar-->C:\PROGRA~1\myBabylon_English\UNWISE.EXE   /U C:\PROGRA~1\myBabylon_English\INSTALL.LOG  
Nero 9-->C:\Program Files\Fichiers communs\Nero\Nero ProductInstaller 4\SetupX.exe  REMOVESERIALNUMBER="9M03-01A1-PCX7-K31A-8A94-98PT-KT2E-522A"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
SENS LT56ADW Modem-->agrsmdel
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft Office Outlook 2007 Help (KB957246)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {80E46078-C1C5-4AE8-8744-3EAFC812E118}
Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Live Writer-->MsiExec.exe /X{2231CE39-B963-4B9D-823A-F412ECA637B1}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\unyt_wrap.exe
ZTE_USBDriver-->MsiExec.exe /I{01C155C3-2349-412E-8E51-7775CD195141}

======Hosts File======

0.0.0.0	123spywar.com
0.0.0.0	www.123spywar.com
0.0.0.0	1clickspyclean.com
0.0.0.0	www.1clickspyclean.com
0.0.0.0	1clicksuite.net
0.0.0.0	www.1clicksuite.net
0.0.0.0	1spyware-removal.com
0.0.0.0	www.1spyware-removal.com
0.0.0.0	1spywarekiller.com
0.0.0.0	www.1spywarekiller.com

======Security center information======

AV: avast! antivirus 4.8.1335 [VPS 090612-0] (disabled)
AV: McAfee VirusScan (disabled) (outdated)
FW: McAfee Personal Firewall Plus

======System event log======

Computer Name: MOAL
Event Code: 51
Message: Une erreur a été détectée sur le périphérique \Device\Harddisk1\D au cours d'une opération de pagination.

Record Number: 47449
Source Name: Disk
Time Written: 20090514053206.000000+060
Event Type: Avertissement
User: 

Computer Name: MOAL
Event Code: 51
Message: Une erreur a été détectée sur le périphérique \Device\Harddisk1\D au cours d'une opération de pagination.

Record Number: 47448
Source Name: Disk
Time Written: 20090514053206.000000+060
Event Type: Avertissement
User: 

Computer Name: MOAL
Event Code: 51
Message: Une erreur a été détectée sur le périphérique \Device\Harddisk1\D au cours d'une opération de pagination.

Record Number: 47447
Source Name: Disk
Time Written: 20090514053206.000000+060
Event Type: Avertissement
User: 

Computer Name: MOAL
Event Code: 16
Message: Connexion impossible : Windows ne parvient pas à se connecter au service Mises à jour automatiques et ne peut donc pas procéder au téléchargement et à l'installation des mises à jour définies par la planification. Windows continuera d'essayer d'établir la connexion.

Record Number: 47446
Source Name: Windows Update Agent
Time Written: 20090514050328.000000+060
Event Type: erreur
User: 

Computer Name: MOAL
Event Code: 7036
Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : arrêté.

Record Number: 47445
Source Name: Service Control Manager
Time Written: 20090514050307.000000+060
Event Type: Informations
User: 

=====Application event log=====

Computer Name: MOAL
Event Code: 11328
Message: Produit : TuneUp Utilities 2009 -- Erreur 1328. Erreur lors de l'application du programme correctif au fichier C:\Config.Msi\PTA0.tmp. Il a sans doute été mis à jour de manière différente et ne peut plus être modifié par ce programme correctif. Pour obtenir des informations complémentaires, contactez le revendeur de votre programme correctif. Erreur système : -1072807676

Record Number: 6889
Source Name: MsiInstaller
Time Written: 20090403194914.000000+060
Event Type: erreur
User: MOAL\Med

Computer Name: MOAL
Event Code: 11328
Message: Produit : TuneUp Utilities 2009 -- Erreur 1328. Erreur lors de l'application du programme correctif au fichier C:\Config.Msi\PTA0.tmp. Il a sans doute été mis à jour de manière différente et ne peut plus être modifié par ce programme correctif. Pour obtenir des informations complémentaires, contactez le revendeur de votre programme correctif. Erreur système : -1072807676

Record Number: 6888
Source Name: MsiInstaller
Time Written: 20090403194914.000000+060
Event Type: erreur
User: MOAL\Med

Computer Name: MOAL
Event Code: 11328
Message: Produit : TuneUp Utilities 2009 -- Erreur 1328. Erreur lors de l'application du programme correctif au fichier C:\Config.Msi\PTA0.tmp. Il a sans doute été mis à jour de manière différente et ne peut plus être modifié par ce programme correctif. Pour obtenir des informations complémentaires, contactez le revendeur de votre programme correctif. Erreur système : -1072807676

Record Number: 6887
Source Name: MsiInstaller
Time Written: 20090403194914.000000+060
Event Type: erreur
User: MOAL\Med

Computer Name: MOAL
Event Code: 11328
Message: Produit : TuneUp Utilities 2009 -- Erreur 1328. Erreur lors de l'application du programme correctif au fichier C:\Config.Msi\PTA0.tmp. Il a sans doute été mis à jour de manière différente et ne peut plus être modifié par ce programme correctif. Pour obtenir des informations complémentaires, contactez le revendeur de votre programme correctif. Erreur système : -1072807676

Record Number: 6886
Source Name: MsiInstaller
Time Written: 20090403194914.000000+060
Event Type: erreur
User: MOAL\Med

Computer Name: MOAL
Event Code: 11328
Message: Produit : TuneUp Utilities 2009 -- Erreur 1328. Erreur lors de l'application du programme correctif au fichier C:\Config.Msi\PTA0.tmp. Il a sans doute été mis à jour de manière différente et ne peut plus être modifié par ce programme correctif. Pour obtenir des informations complémentaires, contactez le revendeur de votre programme correctif. Erreur système : -1072807676

Record Number: 6885
Source Name: MsiInstaller
Time Written: 20090403194914.000000+060
Event Type: erreur
User: MOAL\Med

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;C:\Program Files\Intel\DMIX;C:\WINDOWS\system32\WindowsPowerShell\v1.0
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 9 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=0905
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.PSC1
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

oelpmis · Answer

Et  voici le resultat apres le passage de Malwarebytes' Anti-Malware .
---------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2271
Windows 5.1.2600 Service Pack 3

13/06/2009 13:06:58
mbam-log-2009-06-13 (13-06-58).txt

Type de recherche: Examen rapide
Eléments examinés: 84099
Temps écoulé: 8 minute(s), 31 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9d71d88c-c598-4935-c5d1-43aa4db90836} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a4ec18f8-cc8a-fa45-33f9-b8d9717d8dfa} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4ec18f8-cc8a-fa45-33f9-b8d9717d8dfa} (Adware.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\program files\Bifrost\logg.dat (Backdoor.Bifrose) -> Quarantined and deleted successfully.
c:\WINDOWS\KBPK080504.log (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\KBPK081216.log (Malware.Trace) -> Quarantined and deleted successfully.

Destrio5 · Answer

--> Relance MBAM, va dans Quarantaine et supprime tout.

--> Désinstalle Java 6 Update 7 et Java 6 Update 13.

--> Mets à jour Java.

--> Mets à jour Adobe Reader.

--> Refais un scan RSIT et poste le rapport log.

oelpmis · Answer

Voici le dernier scan RSIT apres mise ajour java et adobe ainsi que la suppression de la quarantaine .
==============================================================
Logfile of random's system information tool 1.06 (written by random/random)
Run by Med at 2009-06-13 14:28:05
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 6 GB (31%) free of 18 GB
Total RAM: 758 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:28:10, on 13/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
D:\Securite Utile\RSIT.exe
C:\Program Files\Med.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English	bmyB1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English	bmyB1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English	bmyB1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LFAgent] C:\Program Files\Everstrike Software\Lock Folder XP 3.6\LF30.exe -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5E35CBC9-8AF2-41FC-BBB2-289A58FF3BCA}: NameServer = 194.2.0.50,193.251.169.83
O20 - AppInit_DLLs: C:\PROGRA~1\Kaspersky Lab\Kaspersky
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

Destrio5 · Answer

---> Désactive ton antivirus le temps de la manipulation car OTM est détecté comme une infection à tort.

---> Télécharge OTM (OldTimer) sur ton Bureau.

---> Double-clique sur OTM.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:services
a7qyosct

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=""

:commands
[purity]
[emptytemp]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTM.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

oelpmis · Answer

Apres le passage d OTM.
================


========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service\Driver a7qyosct not found.
Service\Driver key a7qyosct deleted successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\"AppInit_DLLS"|"" /E : value set successfully!
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF72A3.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7300.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF73D8.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7511.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7620.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7635.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7964.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF79A6.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7AD6.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7AF8.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7B89.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7BB2.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7C73.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7C88.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7CDC.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7D03.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7E0D.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7E35.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\Content.IE5\IH9TV9W4\affich-12861350-autorun[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\Content.IE5\IH9TV9W4\windows_ie[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\SuggestedSites.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_5c0.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_730.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
 
OTM by OldTimer - Version 2.1.0.1 log created on 06132009_144004

Files moved on Reboot...
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF72A3.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7300.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF73D8.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7511.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7620.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7635.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7964.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF79A6.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7AD6.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7AF8.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7B89.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7BB2.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7C73.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7C88.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7CDC.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7D03.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7E0D.tmp not found!
File C:\DOCUME~1\Med\LOCALS~1\Temp\~DF7E35.tmp not found!
C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\Content.IE5\IH9TV9W4\affich-12861350-autorun[1].htm moved successfully.
C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\Content.IE5\IH9TV9W4\windows_ie[1].htm moved successfully.
C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Documents and Settings\Med\Local Settings\Temporary Internet Files\SuggestedSites.dat moved successfully.
File C:\WINDOWS	emp\Perflib_Perfdata_5c0.dat not found!
C:\WINDOWS	emp\Perflib_Perfdata_730.dat moved successfully.

Registry entries deleted on Reboot...

Destrio5 · Answer

Tu souhaites vraiment garder Avast ?

oelpmis · Answer

Si ta autre chose de mieux a me proposer je suis prenneur et merci pour tous le travail que tu as effectuer avec moi.

oelpmis · Answer

Pour ne rien te caher les fichiers me contrediront je suis passer par plusieurs anti virus mais ....................

oelpmis · Answer

je n`est pas encore trouver le parfait compagnon .

Destrio5 · Answer

--> Désinstalle Avast.

--> Installe Antivir et mets-le à jour.

--> Double-clique sur l'icône d'Antivir (Parapluie) dans la barre des tâches.

--> Dans Antivir, choisis Outils puis Configuration.

--> Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages.

--> Fais un scan complet et poste le rapport.

Tutoriel sur Antivir

oelpmis · Answer

Fais un scan complet et poste le rapport
Quelle raport il ya eu tellement de rapport plausible qu`il faut me preciser lequel je transmet merci .

Destrio5 · Answer

Celui d'AntiVir.

oelpmis · Answer

Ok donc le temps qu il termine le scan .

oelpmis · Answer

Voici le rapport antivir .
===========================

Avira AntiVir Personal
Report file date: samedi 13 juin 2009 16:35

Scanning for 1464231 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : MOAL

Version information:
BUILD.DAT : 9.0.0.403 17961 Bytes 03/06/2009 17:05:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 13/06/2009 14:44:53
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 10:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 11:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 10:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 12:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 20:33:26
ANTIVIR2.VDF : 7.1.4.87 2982912 Bytes 12/06/2009 14:44:52
ANTIVIR3.VDF : 7.1.4.88 2048 Bytes 12/06/2009 14:44:52
Engineversion : 8.2.0.187
AEVDF.DLL : 8.1.1.1 106868 Bytes 13/06/2009 14:44:53
AESCRIPT.DLL : 8.1.2.6 409978 Bytes 13/06/2009 14:44:53
AESCN.DLL : 8.1.2.3 127347 Bytes 13/06/2009 14:44:52
AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 18:24:41
AEPACK.DLL : 8.1.3.18 401783 Bytes 13/06/2009 14:44:52
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 20:01:56
AEHEUR.DLL : 8.1.0.131 1786232 Bytes 13/06/2009 14:44:52
AEHELP.DLL : 8.1.3.6 205174 Bytes 13/06/2009 14:44:52
AEGEN.DLL : 8.1.1.45 348532 Bytes 13/06/2009 14:44:52
AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 14:32:40
AECORE.DLL : 8.1.6.12 180599 Bytes 13/06/2009 14:44:52
AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 14:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 08:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 05/12/2008 10:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 14:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 10:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 15:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 10:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 15:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 08:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 10:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 13/06/2009 14:44:52
RCTEXT.DLL : 9.0.37.0 86785 Bytes 17/04/2009 10:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: samedi 13 juin 2009 16:35

Starting search for hidden objects.
'29182' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'IEMonitor.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'robotaskbaricon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'IDMan.exe' - '1' Module(s) have been scanned
Scan process 'MemOptimizer.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'reader_sl.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'ISUSPM.exe' - '1' Module(s) have been scanned
Scan process 'LF30.exe' - '1' Module(s) have been scanned
Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
33 processes with 33 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '52' files ).

Starting the file scan:

Begin scan in 'C:\' <System>
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <Stokage>
D:\Documents and Settings\Med\Mes documents\Downloads\Bitomet\Software_Update_Checker.exe
[DETECTION] Contains recognition pattern of the ADSPY/AdMedia.GB adware or spyware

Beginning disinfection:
D:\Documents and Settings\Med\Mes documents\Downloads\Bitomet\Software_Update_Checker.exe
[DETECTION] Contains recognition pattern of the ADSPY/AdMedia.GB adware or spyware
[NOTE] The file was moved to '4a99db10.qua'!

End of the scan: samedi 13 juin 2009 17:58
Used time: 1:19:47 Hour(s)

The scan has been done completely.

7731 Scanned directories
379061 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
2 Files cannot be scanned
379058 Files not concerned
2450 Archives were scanned
2 Warnings
2 Notes
29182 Objects were scanned with rootkit scan
0 Hidden objects were found

Destrio5 · Answer

Le PC va bien ?

Tu préfères la version anglaise d'AntiVir ?

oelpmis · Answer

Oui le pc va tres bien et je suis vraiment ravi et et chapeau bas quand a la version anglaise d`antivir c `est cette version que est venu en telechargement mais puisque`il ya le ver fr et bien je  migre .Merci

[autorun]

25 réponses

Votre réponse

Discussions similaires

Newsletters