Svp j'ai besoin d'aide. Résolu

Question

Bonjour,

Je suis nouveau sur ce forum et content d'être parmi vous.
mon problème est que un ou plusieurs virus ont contaminé mon pc.
j'ai un hdd de 1 tb plein de filmes en hd le virus è trensformé les titres des fichiers, les dates, les informantions sur les types de fichiers et mis certain fichiers en fichier caché... de plus impossible de les renommer enfin bref un bordel sans nom. 

un exemple : voici le nom d'un fiilme de 4gb : ¨+p&#9532;Üh.@å

alors est-ce l'oeuvre d'un hacker mal intentionné ? 

ou juste un fichier, programme, virus indépendant qui a semé la pagaille.

j'ai gravé les virus sur un cd-rom au cas ou j'aurais besoin de leur nom.

le mieu serai de pouvoirfaire l'opération invers de ce qu'a fait le virus.

2 3 infos... :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:51:32, on 26/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21073)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Micro Application\PC Anonyme\IJStealth4Svc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\VisualTaskTips\TaskTips.exe
C:\Program Files\ViStart\ViStart.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\DC++\DCPlusPlus.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Documents and Settings\Administrateur\Bureau	rjsetup681.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-DGGGQ.tmp	rjsetup681.tmp
C:\Program Files\Trojan Remover	rupd.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: ;Tag&rename
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [TrueTransparency] C:\Program Files\TrueTransparency\TrueTransparency.exe
O4 - HKLM\..\Run: [TaskTips] C:\Program Files\VisualTaskTips\TaskTips.exe
O4 - HKLM\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [3170 Scan2PC] "C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] C:\WINDOWS\is-E6G1N.exe /REG
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: ProtectX Hacker Defence Suite.lnk = C:\Program Files\Plasmatek Software\ProtectX\protectx.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: SmarThru4 Capture Selection - C:\Program Files\SmarThru 4\WebCapture.dll2.htm
O8 - Extra context menu item: SmarThru4 Save as HTML - C:\Program Files\SmarThru 4\WebCapture.dll1.htm
O8 - Extra context menu item: SmarThru4 Save Selected Text - C:\Program Files\SmarThru 4\WebCapture.dll.htm
O8 - Extra context menu item: SmarThru4 Web Capture - C:\Program Files\SmarThru 4\WebCapture.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: SmarThru4 Web Capture - {5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Web Capture - {5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Capture Selection - {A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Capture Selection - {A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Save as HTML - {E753A93F-2367-4978-BFA0-83048C1E61CB} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Save as HTML - {E753A93F-2367-4978-BFA0-83048C1E61CB} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Save Selected Text - {F1F53366-3E11-47ab-BF84-580C94F9C9AD} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Save Selected Text - {F1F53366-3E11-47ab-BF84-580C94F9C9AD} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\WINDOWS\System32\DreamScene.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Stealth Service Helper (StealthInjectorService) - Softwareentwicklung Remus - C:\Program Files\Micro Application\PC Anonyme\IJStealth4Svc.exe

jlpjlp · Answer

Slt,


scan avec malwarebyte , fais un scan minutieux et colle le rapport obtenu et vire ce qui est trouvé:


https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­

______________________

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

RedDiamond · Answer

analyse en cours 2 infection...
mais saurais tu dir de que virus il s'agit?
est ce que les filmes sont perdu?

RedDiamond · Answer

Bonjour,

voici le raport

C'est c'est très sympa de m'aider. :- )

info.txt logfile of random's system information tool 1.06 2009-08-26 16:43:56

======Uninstall list======

-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6B7D781D-2B73-4000-9A2D-AA50422D9958}
Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
Adobe Color - Photoshop Specific CS4-->MsiExec.exe /I{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
Adobe Color EU Recommended Settings CS4-->MsiExec.exe /I{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}
Adobe Color JA Extra Settings CS4-->MsiExec.exe /I{0D6013AB-A0C7-41DC-973C-E93129C9A29F}
Adobe Color NA Extra Settings CS4-->MsiExec.exe /I{098A2A49-7CF3-4F08-A38D-FB879117152A}
Adobe Color Video Profiles CS CS4-->MsiExec.exe /I{63C24A08-70F3-4C8E-B9FB-9F21A903801D}
Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}
Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}
Adobe Device Central CS4-->MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A}
Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}
Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}
Adobe Photoshop CS4-->C:\Program Files\Fichiers communs\Adobe\Installers\faf656ef605427ee2f42989c3ad31b8\Setup.exe --uninstall=1
Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
Adobe Setup-->MsiExec.exe /I{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}
Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
Agere Systems PCI Soft Modem-->agrsmdel
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI AVIVO Codecs-->MsiExec.exe /I{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI Parental Control & Encoder-->MsiExec.exe /I{9862B19F-4CAD-4EED-920F-2F378D84393F}
Catalyst Control Center - Branding-->MsiExec.exe /I{4893A35F-0A23-48EC-8E74-24969244D6F2}
Connect-->MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D}
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
DC++ 0.750-->"C:\Program Files\DC++\uninstall.exe"
Desktop Sidebar-->MsiExec.exe /I{A92D7264-1A13-45BE-B769-88445DD04FD6}
HijackThis 2.0.2-->"C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Kaspersky Internet Security 2010-->MsiExec.exe /I{9D8B0949-7C47-476F-9F06-F900D3B078EA}
Kaspersky Internet Security 2010-->MsiExec.exe /I{9D8B0949-7C47-476F-9F06-F900D3B078EA}
kuler-->MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
morphemuleversion-->"C:\Program Files\eMule\unins000.exe"
Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.14)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Nero 8 Lite 8.3.2.1-->"C:\Program Files\Nero\unins000.exe"
PC Anonyme Version 4.90.1.3190-->"C:\Program Files\Micro Application\PC Anonyme\unins000.exe"
PerfectDisk-->MsiExec.exe /I{212F5777-1190-4DEF-8E4D-6B2F313B45E7}
Photoshop Camera Raw-->MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8}
Privacy Eraser Pro-->"C:\Program Files\PrivacyEraser Computing\Privacy Eraser Pro\unins000.exe"
ProtectX-->"C:\Program Files\Plasmatek Software\ProtectX\unins000.exe"
Readiris Pro 10-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{14D08502-FEE4-40E5-90D3-8A967A1D8BA2}\setup.exe" -l0x40c 
Samsung CLX-3170 Series-->C:\Program Files\Samsung\Samsung CLX-3170 Series\Install\Setup.exe /R
Satsuki Decoder Pack 4000-->C:\Program Files\Satsuki Decoder Pack\Uninstall.exe
SmarThru 4-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{90F1943D-EA4A-4460-B59F-30023F3BA69A}\Setup.exe" -l0x40c uninstall -l040c
SmarThru PC Fax-->C:\WINDOWS\prinst.exe /m"Samsung" /u"SmarThru PC Fax"
Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
SuperCopier2-->"C:\Program Files\SuperCopier2\SC2Uninst.exe"
TaskSwitchXP-->C:\Program Files\TaskSwitchXP\uninst.exe
Trojan Remover 6.8.1-->"C:\Program Files\Trojan Remover\unins000.exe"
UltraISO Premium V8.6-->"C:\Program Files\UltraISO\unins000.exe"
UltraVNC v1.0.2 Fr-->"C:\Program Files\UltraVNC\unins000.exe"
UseNeXT-->"C:\Program Files\UseNeXT\unins000.exe"
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Zion++ Vert 2.15-->C:\Program Files\Zion++\uninst.exe

=====HijackThis Backups=====

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') [2009-08-26]
O4 - HKUS\.DEFAULT\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'Default user') [2009-08-26]
O4 - HKUS\S-1-5-20\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE RÉSEAU') [2009-08-26]
O4 - HKUS\S-1-5-19\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SERVICE LOCAL') [2009-08-26]
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') [2009-08-26]
O4 - HKUS\S-1-5-18\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SYSTEM') [2009-08-26]
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE RÉSEAU') [2009-08-26]
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL') [2009-08-26]
O4 - HKUS\S-1-5-19\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (User 'SERVICE LOCAL') [2009-08-26]

======Hosts File======

127.0.0.1  localhost
127.0.0.1  ad.a8.net
127.0.0.1  asy.a8ww.net
127.0.0.1  www.abx4.com #[Adware.ABXToolbar]
127.0.0.1  acezip.net #[SiteAdvisor.acezip.net]
127.0.0.1  www.acezip.net #[Win32/Adware.180Solutions]
127.0.0.1  phpadsnew.abac.com
127.0.0.1  a.abnad.net
127.0.0.1  b.abnad.net
127.0.0.1  c.abnad.net #[eTrust.Tracking.Cookie]

======Security center information======

AV: Kaspersky Internet Security
FW: Kaspersky Internet Security

======System event log======

Computer Name: 0B8E31BDD8354CE
Event Code: 15007
Message: La réservation de l'espace de nom identifié par le préfixe d'URL http://*:2869/ a été correctement ajoutée.

Record Number: 6
Source Name: HTTP
Time Written: 20090819134935.000000+120
Event Type: Informations
User: 

Computer Name: 0B8E31BDD8354CE
Event Code: 3260
Message: Cet ordinateur a correctement été joint au workgroup 'WORKGROUP'.

Record Number: 5
Source Name: Workstation
Time Written: 20090819134649.000000+120
Event Type: Informations
User: 

Computer Name: 0B8E31BDD8354CE
Event Code: 6011
Message: Le nom NetBIOS et le nom de l'hôte DNS de cet ordinateur ont été modifiés de MACHINENAME vers 0B8E31BDD8354CE.

Record Number: 4
Source Name: EventLog
Time Written: 20090819134605.000000+120
Event Type: Informations
User: 

Computer Name: MACHINENAME
Event Code: 2
Message: Pendant la validation de \Device\Serial0 en tant que port série, une FIFO a été détectée. La FIFO sera utilisée.

Record Number: 3
Source Name: Serial
Time Written: 20090819153852.000000+120
Event Type: Informations
User: 

Computer Name: MACHINENAME
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20090819153837.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: 0B8E31BDD8354CE
Event Code: 1000
Message: Les compteurs de performances pour le service MSDTC (MSDTC) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090819134731.000000+120
Event Type: Informations
User: 

Computer Name: 0B8E31BDD8354CE
Event Code: 1000
Message: Les compteurs de performances pour le service TermService (Services Terminal Server) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090819134727.000000+120
Event Type: Informations
User: 

Computer Name: 0B8E31BDD8354CE
Event Code: 1000
Message: Les compteurs de performances pour le service RemoteAccess (Routage et accès distant) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090819134646.000000+120
Event Type: Informations
User: 

Computer Name: 0B8E31BDD8354CE
Event Code: 1000
Message: Les compteurs de performances pour le service PSched (PSched) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090819134625.000000+120
Event Type: Informations
User: 

Computer Name: 0B8E31BDD8354CE
Event Code: 1000
Message: Les compteurs de performances pour le service RSVP (QoS RSVP) ont été chargés.
Les données d'enregistrement contiennent les nouvelles valeurs d'index
assignées à ce service.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090819134613.000000+120
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------








Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-08-26 16:39:07
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 26 GB (65%) free of 40 GB
Total RAM: 1535 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:43:49, on 26/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21073)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Micro Application\PC Anonyme\IJStealth4Svc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\VisualTaskTips\TaskTips.exe
C:\Program Files\ViStart\ViStart.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Administrateur\Bureau\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: ;Tag&rename
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [TrueTransparency] C:\Program Files\TrueTransparency\TrueTransparency.exe
O4 - HKLM\..\Run: [TaskTips] C:\Program Files\VisualTaskTips\TaskTips.exe
O4 - HKLM\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [3170 Scan2PC] "C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: ProtectX Hacker Defence Suite.lnk = C:\Program Files\Plasmatek Software\ProtectX\protectx.exe
O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: SmarThru4 Capture Selection - C:\Program Files\SmarThru 4\WebCapture.dll2.htm
O8 - Extra context menu item: SmarThru4 Save as HTML - C:\Program Files\SmarThru 4\WebCapture.dll1.htm
O8 - Extra context menu item: SmarThru4 Save Selected Text - C:\Program Files\SmarThru 4\WebCapture.dll.htm
O8 - Extra context menu item: SmarThru4 Web Capture - C:\Program Files\SmarThru 4\WebCapture.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: SmarThru4 Web Capture - {5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Web Capture - {5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Capture Selection - {A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Capture Selection - {A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Save as HTML - {E753A93F-2367-4978-BFA0-83048C1E61CB} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Save as HTML - {E753A93F-2367-4978-BFA0-83048C1E61CB} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Save Selected Text - {F1F53366-3E11-47ab-BF84-580C94F9C9AD} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Save Selected Text - {F1F53366-3E11-47ab-BF84-580C94F9C9AD} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\WINDOWS\System32\DreamScene.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Stealth Service Helper (StealthInjectorService) - Softwareentwicklung Remus - C:\Program Files\Micro Application\PC Anonyme\IJStealth4Svc.exe

RedDiamond · Answer

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2697
Windows 5.1.2600 Service Pack 3

26/08/2009 18:28:20
mbam-log-2009-08-26 (18-28-19).txt

Type de recherche: Examen complet (C:\|D:\|E:\|J:\|N:\|)
Eléments examinés: 200458
Temps écoulé: 2 hour(s), 4 minute(s), 19 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Administrateur\Bureau\UseNeXTSetup_5.02.exe (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1614895754-602162358-1417001333-500\Dc2\Password finder.exe (Malware.Hacktool) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{B5759A4D-7822-4145-9E4E-0F9D6806F9DB}\RP24\A0020691.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

jlpjlp · Answer

• Télécharge et install UsbFix par Chiquitine29

 (!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

• Double clic sur le raccourci UsbFix présent sur ton bureau .

• Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

• Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée] 

• Laisse travailler l'outil.

• Ensuite post le rapport UsbFix.txt qui apparaitra.

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html

RedDiamond · Answer

ok merci

RedDiamond · Answer

ça y est c'est fait


############################## | UsbFix V6.023 |

User : Administrateur (Administrateurs) # 0B8E31BDD8354CE
Update on 25/08/09 by Chiquitine29
Start at: 21:13:29 | 26/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

                Intel(R) Celeron(R) CPU 3.06GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : Kaspersky Internet Security 9.0.0.463 [ Enabled | Updated ]
FW : Kaspersky Internet Security[ Enabled ]9.0.0.463

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 39,06 Go (25,49 Go free) # NTFS
D:\ -> Disque fixe local # 97,66 Go (97,59 Go free) [00] # NTFS
E:\ -> Disque fixe local # 8,18 Go (3,13 Go free) [RESTORE] # NTFS
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local # 4,14 Go (410,16 Mo free) [HP_RECOVERY] # FAT32
K:\ -> Disque CD-ROM
L:\ -> Disque CD-ROM
N:\ -> Disque fixe local # 931,28 Go (10,72 Go free) [Ù8B+ã­õ("¯] # FAT32
R:\ -> Disque fixe local # 298,09 Go (1,79 Go free) [TREKSTOR] # NTFS
S:\ -> Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Micro Application\PC Anonyme\IJStealth4Svc.exe
C:\Program Files\VisualTaskTips\TaskTips.exe
C:\Program Files\ViStart\ViStart.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

Présent ! E:\autorun.inf  
Présent ! J:\autorun.inf  

################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{656313a9-917d-11de-80bb-0011d8902b46}
Shell\AutoRun\command =wd_windows_tools\WDSetup.exe 

HKCU\..\..\Explorer\MountPoints2\{dd6775b7-8cc3-11de-ab46-806d6172696f}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

HKCU\..\..\Explorer\MountPoints2\{dd6775ba-8cc3-11de-ab46-806d6172696f}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AUTORUN.EXE

################## | Cracks / Keygens / Serials |

"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hack\Seriale\Seriale 2000\snmanager.exe"  
26/08/2009 04:14 |Size : 169472 |Crc32 : a4ca1ff3 |Md5 : 5d28f3a773579498b450bf232158b907  
 
"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crack Outils\Restorator\crack.exe"  
26/08/2009 11:55 |Size : 6656 |Crc32 : 8a969be0 |Md5 : d1602da22645d004f63366bbd90e5afc  
 
"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme1\Lancez-moi.exe"  
26/08/2009 11:55 |Size : 32768 |Crc32 : 0cdc8b19 |Md5 : 62a7250bc60e44ebb831a0ec01f614f6  
 
"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme13\crackme3.exe"  
26/08/2009 11:55 |Size : 4096 |Crc32 : 68140b2a |Md5 : 017a32abc5156b22c6de1578a04589fc  
 
"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\CrackMe_10\CrackMe11b.exe"  
26/08/2009 11:11 |Size : 4096 |Crc32 : 5fd0cf38 |Md5 : 1c3477f32c174b2e101464efa2334394  
 

################## | ! Fin du rapport # UsbFix V6.023 ! |

RedDiamond · Answer

étape numéro 2

############################## | UsbFix V6.023 |

User : Administrateur (Administrateurs) # 0B8E31BDD8354CE
Update on 25/08/09 by Chiquitine29
Start at: 23:30:03 | 26/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

                Intel(R) Celeron(R) CPU 3.06GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : Kaspersky Internet Security 9.0.0.463 [ Enabled | Updated ]
FW : Kaspersky Internet Security[ Enabled ]9.0.0.463

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 39,06 Go (25,45 Go free) # NTFS
D:\ -> Disque fixe local # 97,66 Go (97,59 Go free) [00] # NTFS
E:\ -> Disque fixe local # 8,18 Go (3,13 Go free) [RESTORE] # NTFS
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local # 4,14 Go (410,16 Mo free) [HP_RECOVERY] # FAT32
K:\ -> Disque CD-ROM
L:\ -> Disque CD-ROM
N:\ -> Disque fixe local # 931,28 Go (10,72 Go free) [Ù8B+ã­õ("¯] # FAT32
S:\ -> Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Micro Application\PC Anonyme\IJStealth4Svc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe

################## | Fichiers # Dossiers infectieux |


################## | Autres |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |


################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\E\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\J\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{656313a9-917d-11de-80bb-0011d8902b46}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[26/08/2009 11:36|--a------|892] -> C:\aaw7boot.log 
[19/08/2009 12:21|--a------|0] -> C:\AUTOEXEC.BAT 
[19/08/2009 13:46|--ahs----|212] -> C:\boot.ini 
[24/08/2008 01:53|-rahs----|4952] -> C:\Bootfont.bin 
[19/08/2009 12:21|--a------|0] -> C:\CONFIG.SYS 
[19/08/2009 12:44|--a------|16743] -> C:\DPsFnshr.log 
[19/08/2009 12:21|-rahs----|0] -> C:\IO.SYS 
[19/08/2009 12:21|-rahs----|0] -> C:\MSDOS.SYS 
[24/08/2008 01:53|-rahs----|47564] -> C:\NTDETECT.COM 
[24/08/2008 01:53|-rahs----|252240] -> C:
tldr 
[?|?|?] -> C:\pagefile.sys 
[19/08/2009 14:29|--a------|5241] -> C:\PhoeniXP_Log.txt 
[19/08/2009 14:16|--ah-----|268] -> C:\sqmdata00.sqm 
[19/08/2009 16:16|--ah-----|268] -> C:\sqmdata01.sqm 
[19/08/2009 19:33|--ah-----|268] -> C:\sqmdata02.sqm 
[20/08/2009 10:32|--ah-----|268] -> C:\sqmdata03.sqm 
[22/08/2009 14:30|--ah-----|268] -> C:\sqmdata04.sqm 
[23/08/2009 11:45|--ah-----|268] -> C:\sqmdata05.sqm 
[23/08/2009 20:56|--ah-----|268] -> C:\sqmdata06.sqm 
[24/08/2009 00:27|--ah-----|268] -> C:\sqmdata07.sqm 
[24/08/2009 09:58|--ah-----|268] -> C:\sqmdata08.sqm 
[25/08/2009 16:02|--ah-----|268] -> C:\sqmdata09.sqm 
[19/08/2009 14:16|--ah-----|244] -> C:\sqmnoopt00.sqm 
[19/08/2009 16:16|--ah-----|244] -> C:\sqmnoopt01.sqm 
[19/08/2009 19:33|--ah-----|244] -> C:\sqmnoopt02.sqm 
[20/08/2009 10:32|--ah-----|244] -> C:\sqmnoopt03.sqm 
[22/08/2009 14:30|--ah-----|244] -> C:\sqmnoopt04.sqm 
[23/08/2009 11:45|--ah-----|244] -> C:\sqmnoopt05.sqm 
[23/08/2009 20:56|--ah-----|244] -> C:\sqmnoopt06.sqm 
[24/08/2009 00:27|--ah-----|244] -> C:\sqmnoopt07.sqm 
[24/08/2009 09:58|--ah-----|244] -> C:\sqmnoopt08.sqm 
[25/08/2009 16:02|--ah-----|244] -> C:\sqmnoopt09.sqm 
[26/08/2009 23:52|--a------|4161] -> C:\UsbFix.txt 
[19/04/2006 21:19|--a------|387279] -> E:\AUTORUN.APM 
[19/04/2006 21:19|--a------|1337856] -> E:\AUTORUN.EXE 
[15/04/2006 10:19|--a------|174246] -> E:\AUTORUN.ICO 
[19/04/2006 21:27|--a------|53] -> E:\AUTORUN.INF 
[27/02/2009 19:42|--a------|190] -> E:\HP_RECOVERY (K).lnk 
[15/09/2008 14:24|--a------|189] -> E:\Raccourci vers Lecteur CD.lnk 
[19/10/2006 16:55|---------|2147467639] -> E:\RESTO001.GHS 
[19/10/2006 16:59|---------|1079739390] -> E:\RESTO002.GHS 
[19/10/2006 16:59|---------|2147456413] -> E:\RESTORE.GHO 
[28/07/2001 06:07|---hs----|0] -> J:\AUTOEXEC.BAT 
[30/04/2004 22:01|---hs----|53] -> J:\Autorun.inf 
[13/10/2006 18:36|---hs----|244] -> J:\BOOT.INI 
[17/08/2001 09:26|---hs----|237728] -> J:\CMLDR 
[28/07/2001 06:07|---hs----|0] -> J:\CONFIG.SYS 
[09/09/2002 23:14|---hs----|100] -> J:\Desktop.ini 
[28/07/2001 06:07|---hs----|0] -> J:\IO.SYS 
[28/07/2001 06:07|---hs----|0] -> J:\MSDOS.SYS 
[25/07/2001 22:00|---hs----|45124] -> J:\NTDETECT.COM 
[25/07/2001 22:00|---hs----|222880] -> J:\NTLDR 
[29/04/2004 23:37|---hs----|4096] -> J:\Thumbs.db 
[09/02/2002 00:44|---hs----|88038] -> J:\Warning.bmp 
[16/09/2004 08:27|---hs----|6] -> J:\BLOCK.RIN 
[10/09/2002 10:21|---hs----|7850] -> J:\Folder.htt 
[25/01/2002 10:21|---hs----|0] -> J:\GRAPH16 
[30/04/2001 12:16|---hs----|14] -> J:\Graph 
[11/10/2006 09:32|---hs----|32] -> J:\HPCD.sys 
[11/10/2006 09:32|---hs----|932] -> J:\Master.log 
[17/08/2001 07:32|---hs----|0] -> J:\NTFS 
[11/10/2006 07:42|---hs----|26] -> J:\RCBoot.sys 
[30/04/2001 12:16|---hs----|14] -> J:\SVGA 
[23/11/2004 08:39|---hs----|36] -> J:\SaveFile.Dir 
[01/03/2005 09:39|---hs----|2213] -> J:\Softthinks_MLSP_ALL_BLU_WW.txt 
[01/03/2005 09:39|---hs----|7] -> J:\Softthinks_MLSP_ALL_BLU_WW-01.block 
[18/08/2001 07:00|---hs----|10] -> J:\WIN51 
[22/01/2001 07:00|---hs----|11] -> J:\WIN51.B2 
[25/07/2001 07:00|---hs----|11] -> J:\WIN51.RC1 
[25/07/2001 12:47|---hs----|11] -> J:\WIN51.RC2 
[18/08/2001 07:00|---hs----|10] -> J:\WIN51IC 
[20/03/2001 07:00|---hs----|11] -> J:\WIN51IC.B2 
[25/07/2001 07:00|---hs----|11] -> J:\WIN51IC.RC1 
[25/07/2001 07:00|---hs----|11] -> J:\WIN51IC.RC2 
[17/08/2001 07:00|---hs----|10] -> J:\WIN51IP 
[22/01/2001 07:00|---hs----|11] -> J:\WIN51IP.B2 
[25/07/2001 12:47|---hs----|11] -> J:\WIN51IP.RC2 
[17/08/2001 05:17|---hs----|184] -> J:\WINBOM.INI 
[01/02/2005 07:49|---hs----|535] -> J:\install.bat 
[10/09/2002 07:58|---hs----|181616] -> J:\protect.ed 
[12/10/2006 18:56|--ah-----|18] -> J:\USER 
[?|?|?] -> N:\§[ÁñP¨ÂS.XE_ 
[?|?|?] -> N:\pã	oà”ße.­Öå 
[?|?|?] -> N:
Ùx~}Á:U.Rü= 
[?|?|?] -> N:\ä0‹gµj..m 
[?|?|?] -> N:\@u7ç–.áf! 
[?|?|?] -> N:\Ç5á™±n.ˆöú 
[?|?|?] -> N:\º 
[?|?|?] -> N:\Æ"mßtüçŽ.)°¯ 
[?|?|?] -> N:\<­Ø â¡>Ú.u¨õ 
[?|?|?] -> N:\Û²®M‘·b'.t£ 
[?|?|?] -> N:\Ð±9kÁeÝ.×Ðà 
[?|?|?] -> N:\ÿ\šðJûÓÂ.åŸ 
[?|?|?] -> N:\ä²Ÿ‰ã‰Ë.qbž 
[?|?|?] -> N:\Y•¼îÚ.„ž.) 
[?|?|?] -> N:\hýÚæî.|û 
[?|?|?] -> N:\ú£v˜«oÐæ.ûh¤ 
[?|?|?] -> N:\Ñ?7wÐ¶9.ˆè 
[?|?|?] -> N:\ÁÙ	¶s§eŠ.uL 
[?|?|?] -> N:\‰Ï 
[?|?|?] -> N:\?î	å@.öýI 
[?|?|?] -> N:\‡Ç½>	>bÏ.pä- 
[?|?|?] -> N:\ÆÛmüm·.ñ¶ß 
[?|?|?] -> N:\ô0¬[]ó®l.Çá
 
[?|?|?] -> N:\1$Ôooä¸.ô¾ 
[?|?|?] -> N:\ºh‚Åà­¸Ü.>Ô[ 
[?|?|?] -> N:\ºt`‚¯µ­.TdJ 
[?|?|?] -> N:\ÖŽyÖ¤ké.š)o 
[?|?|?] -> N:\?j)¼"xÑÛ.‹m 
[?|?|?] -> N:
”,(¡WÈu.k8È 
[?|?|?] -> N:\Ýï¸®4Œ^.g$ß 
[?|?|?] -> N:\$çä¶g›Ê.'¿ 
[?|?|?] -> N:\s!æÒ¦Ç.å"¤ 
[?|?|?] -> N:\vëëÛþ‹½&.|- 
[?|?|?] -> N:\î¹ßÒuïr.ÇÓò 
[?|?|?] -> N:\§,½x™»§›.O|M 
[?|?|?] -> N:\³Ó\-¤±s.ÛÛÞ 
[?|?|?] -> N:\¦×®ìâðQ
################## | Cracks / Keygens / Serials |

"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hack\Seriale\Seriale 2000\snmanager.exe"  
26/08/2009 04:14 |Size : 169472 |Crc32 : a4ca1ff3 |Md5 : 5d28f3a773579498b450bf232158b907  
 
"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crack Outils\Restorator\crack.exe"  
26/08/2009 11:55 |Size : 6656 |Crc32 : 8a969be0 |Md5 : d1602da22645d004f63366bbd90e5afc  
 
"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme1\Lancez-moi.exe"  
26/08/2009 11:55 |Size : 32768 |Crc32 : 0cdc8b19 |Md5 : 62a7250bc60e44ebb831a0ec01f614f6  
 
"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme13\crackme3.exe"  
26/08/2009 11:55 |Size : 4096 |Crc32 : 68140b2a |Md5 : 017a32abc5156b22c6de1578a04589fc  
 
"C:\Documents and Settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\CrackMe_10\CrackMe11b.exe"  
26/08/2009 11:11 |Size : 4096 |Crc32 : 5fd0cf38 |Md5 : 1c3477f32c174b2e101464efa2334394  
 

################## | ! Fin du rapport # UsbFix V6.023 ! |

RedDiamond · Answer

############################## | UsbFix V6.023 |

User : Administrateur (Administrateurs) # 0B8E31BDD8354CE
Update on 25/08/09 by Chiquitine29
Start at: 23:55:46 | 26/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

                Intel(R) Celeron(R) CPU 3.06GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : Kaspersky Internet Security 9.0.0.463 [ Enabled | Updated ]
FW : Kaspersky Internet Security[ Enabled ]9.0.0.463

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 39,06 Go (25,53 Go free) # NTFS
D:\ -> Disque fixe local # 97,66 Go (97,59 Go free) [00] # NTFS
E:\ -> Disque fixe local # 8,18 Go (3,13 Go free) [RESTORE] # NTFS
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local # 4,14 Go (410,16 Mo free) [HP_RECOVERY] # FAT32
K:\ -> Disque CD-ROM
L:\ -> Disque CD-ROM
N:\ -> Disque fixe local # 931,28 Go (10,72 Go free) [Ù8B+ã­õ("¯] # FAT32
S:\ -> Disque CD-ROM

################## | Vaccination |

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# D:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# E:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# J:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# N:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## | ! Fin du rapport # UsbFix V6.023 ! |

RedDiamond · Answer

j'espère que j'ai pas été trop pressé. scan fait vaccination aussi me semble t'il, pas contre rien n'as encore changé du coté des fichiers. 


[?|?|?] -> N:\§[ÁñP¨ÂS.XE_
[?|?|?] -> N:\pã oà”ße.­Öå
[?|?|?] -> N:
Ùx~}Á:U.Rü=
[?|?|?] -> N:\ä0‹gµj..m
[?|?|?] -> N:\@u7ç–.áf!
[?|?|?] -> N:\Ç5á™±n.ˆöú
[?|?|?] -> N:\º
[?|?|?] -> N:\Æ"mßtüçŽ.)°¯
[?|?|?] -> N:\<­Ø â¡>Ú.u¨õ
[?|?|?] -> N:\Û²®M‘·b'.t£
[?|?|?] -> N:\Ð±9kÁeÝ.×Ðà
[?|?|?] -> N:\ÿ\šðJûÓÂ.åŸ
[?|?|?] -> N:\ä²Ÿ‰ã‰Ë.qbž
[?|?|?] -> N:\Y•¼îÚ.„ž.)
[?|?|?] -> N:\hýÚæî.|û
[?|?|?] -> N:\ú£v˜«oÐæ.ûh¤
[?|?|?] -> N:\Ñ?7wÐ¶9.ˆè
[?|?|?] -> N:\ÁÙ ¶s§eŠ.uL
[?|?|?] -> N:\‰Ï
[?|?|?] -> N:\?î å@.öýI
[?|?|?] -> N:\‡Ç½> >bÏ.pä-
[?|?|?] -> N:\ÆÛmüm·.ñ¶ß
[?|?|?] -> N:\ô0¬[]ó®l.Çá

[?|?|?] -> N:\1$Ôooä¸.ô¾
[?|?|?] -> N:\ºh‚Åà­¸Ü.>Ô[
[?|?|?] -> N:\ºt`‚¯µ­.TdJ
[?|?|?] -> N:\ÖŽyÖ¤ké.š)o
[?|?|?] -> N:\?j)¼"xÑÛ.‹m
[?|?|?] -> N:
”,(¡WÈu.k8È
[?|?|?] -> N:\Ýï¸®4Œ^.g$ß
[?|?|?] -> N:\$çä¶g›Ê.'¿
[?|?|?] -> N:\s!æÒ¦Ç.å"¤
[?|?|?] -> N:\vëëÛþ‹½&.|-
[?|?|?] -> N:\î¹ßÒuïr.ÇÓò
[?|?|?] -> N:\§,½x™»§›.O|M
[?|?|?] -> N:\³Ó\-¤±s.ÛÛÞ
[?|?|?] -> N:\¦×®ìâðQ 

Ah j'ai un autre indice. le Hdd étais en NTFS et la il se trouve en Fat 32. Je trouve ça très bizard.

Le logiciel que tu m'as fais découvrir est très impressionnant. Merci encore.

RedDiamond · Answer

Re

############################## | UsbFix V6.023 |

User : Administrateur (Administrateurs) # 0B8E31BDD8354CE
Update on 25/08/09 by Chiquitine29
Start at: 01:33:39 | 27/08/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

                Intel(R) Celeron(R) CPU 3.06GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Disabled
AV : Kaspersky Internet Security 9.0.0.463 [ Enabled | Updated ]
FW : Kaspersky Internet Security[ Enabled ]9.0.0.463

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 39,06 Go (25,53 Go free) # NTFS
D:\ -> Disque fixe local # 97,66 Go (97,59 Go free) [00] # NTFS
E:\ -> Disque fixe local # 8,18 Go (3,13 Go free) [RESTORE] # NTFS
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local # 4,14 Go (410,16 Mo free) [HP_RECOVERY] # FAT32
K:\ -> Disque CD-ROM
L:\ -> Disque CD-ROM
N:\ -> Disque fixe local # 931,28 Go (10,72 Go free) [Ù8B+ã­õ("¯] # FAT32
S:\ -> Disque CD-ROM

###################### | Listing des fichiers présents C:\ |

[26/08/2009 11:36|--a------|892] - C:\aaw7boot.log
[19/08/2009 12:21|--a------|0] - C:\AUTOEXEC.BAT
[19/08/2009 13:46|--ahs----|212] - C:\boot.ini
[24/08/2008 01:53|-rahs----|4952] - C:\Bootfont.bin
[19/08/2009 12:21|--a------|0] - C:\CONFIG.SYS
[19/08/2009 12:44|--a------|16743] - C:\DPsFnshr.log
[19/08/2009 12:21|-rahs----|0] - C:\IO.SYS
[19/08/2009 12:21|-rahs----|0] - C:\MSDOS.SYS
[24/08/2008 01:53|-rahs----|47564] - C:\NTDETECT.COM
[24/08/2008 01:53|-rahs----|252240] - C:
tldr
[?|?|?] - C:\pagefile.sys
[19/08/2009 14:29|--a------|5241] - C:\PhoeniXP_Log.txt
[19/08/2009 14:16|--ah-----|268] - C:\sqmdata00.sqm
[19/08/2009 16:16|--ah-----|268] - C:\sqmdata01.sqm
[19/08/2009 19:33|--ah-----|268] - C:\sqmdata02.sqm
[20/08/2009 10:32|--ah-----|268] - C:\sqmdata03.sqm
[22/08/2009 14:30|--ah-----|268] - C:\sqmdata04.sqm
[23/08/2009 11:45|--ah-----|268] - C:\sqmdata05.sqm
[23/08/2009 20:56|--ah-----|268] - C:\sqmdata06.sqm
[24/08/2009 00:27|--ah-----|268] - C:\sqmdata07.sqm
[24/08/2009 09:58|--ah-----|268] - C:\sqmdata08.sqm
[25/08/2009 16:02|--ah-----|268] - C:\sqmdata09.sqm
[19/08/2009 14:16|--ah-----|244] - C:\sqmnoopt00.sqm
[19/08/2009 16:16|--ah-----|244] - C:\sqmnoopt01.sqm
[19/08/2009 19:33|--ah-----|244] - C:\sqmnoopt02.sqm
[20/08/2009 10:32|--ah-----|244] - C:\sqmnoopt03.sqm
[22/08/2009 14:30|--ah-----|244] - C:\sqmnoopt04.sqm
[23/08/2009 11:45|--ah-----|244] - C:\sqmnoopt05.sqm
[23/08/2009 20:56|--ah-----|244] - C:\sqmnoopt06.sqm
[24/08/2009 00:27|--ah-----|244] - C:\sqmnoopt07.sqm
[24/08/2009 09:58|--ah-----|244] - C:\sqmnoopt08.sqm
[25/08/2009 16:02|--ah-----|244] - C:\sqmnoopt09.sqm
[27/08/2009 01:33|--a------|2814] - C:\UsbFix.txt

###################### | Listing des dossiers présents C:\ |

[26/08/2009 23:55|drahs----|0] - C:\autorun.inf
[26/08/2009 14:58|d--hs----|0] - C:\Config.Msi
[19/08/2009 14:13|d--------|0] - C:\Documents and Settings
[19/08/2009 14:09|d--------|0] - C:\DP_Virtu
[19/08/2009 14:22|dr-h-----|0] - C:\MSOCache
[26/08/2009 20:12|dr-------|0] - C:\Program Files
[26/08/2009 23:52|d--hs----|0] - C:\RECYCLER
[26/08/2009 16:43|d--------|0] - C:sit
[26/08/2009 19:53|d--hs----|0] - C:\System Volume Information
[27/08/2009 01:33|d--------|0] - C:\UsbFix
[26/08/2009 23:24|d--------|0] - C:\WINDOWS

###################### | Listing des fichiers présents D:\ |


###################### | Listing des dossiers présents D:\ |

[26/08/2009 23:55|drahs----|0] - D:\autorun.inf
[26/08/2009 23:52|d--hs----|0] - D:\RECYCLER
[26/08/2009 19:47|d--hs----|0] - D:\System Volume Information

###################### | Listing des fichiers présents E:\ |

[19/04/2006 21:19|--a------|387279] - E:\AUTORUN.APM
[19/04/2006 21:19|--a------|1337856] - E:\AUTORUN.EXE
[15/04/2006 10:19|--a------|174246] - E:\AUTORUN.ICO
[27/02/2009 19:42|--a------|190] - E:\HP_RECOVERY (K).lnk
[15/09/2008 14:24|--a------|189] - E:\Raccourci vers Lecteur CD.lnk
[19/10/2006 16:55|---------|2147467639] - E:\RESTO001.GHS
[19/10/2006 16:59|---------|1079739390] - E:\RESTO002.GHS
[19/10/2006 16:59|---------|2147456413] - E:\RESTORE.GHO

###################### | Listing des dossiers présents E:\ |

[26/08/2009 23:55|drahs----|0] - E:\autorun.inf
[26/08/2009 23:52|d--hs----|0] - E:\RECYCLER
[19/08/2009 14:21|d--hs----|0] - E:\System Volume Information

###################### | Listing des fichiers présents J:\ |

[28/07/2001 06:07|---hs----|0] - J:\AUTOEXEC.BAT
[13/10/2006 18:36|---hs----|244] - J:\BOOT.INI
[17/08/2001 09:26|---hs----|237728] - J:\CMLDR
[28/07/2001 06:07|---hs----|0] - J:\CONFIG.SYS
[09/09/2002 23:14|---hs----|100] - J:\Desktop.ini
[28/07/2001 06:07|---hs----|0] - J:\IO.SYS
[28/07/2001 06:07|---hs----|0] - J:\MSDOS.SYS
[25/07/2001 22:00|---hs----|45124] - J:\NTDETECT.COM
[25/07/2001 22:00|---hs----|222880] - J:\NTLDR
[29/04/2004 23:37|---hs----|4096] - J:\Thumbs.db
[09/02/2002 00:44|---hs----|88038] - J:\Warning.bmp
[16/09/2004 08:27|---hs----|6] - J:\BLOCK.RIN
[10/09/2002 10:21|---hs----|7850] - J:\Folder.htt
[25/01/2002 10:21|---hs----|0] - J:\GRAPH16
[30/04/2001 12:16|---hs----|14] - J:\Graph
[11/10/2006 09:32|---hs----|32] - J:\HPCD.sys
[11/10/2006 09:32|---hs----|932] - J:\Master.log
[17/08/2001 07:32|---hs----|0] - J:\NTFS
[11/10/2006 07:42|---hs----|26] - J:\RCBoot.sys
[30/04/2001 12:16|---hs----|14] - J:\SVGA
[23/11/2004 08:39|---hs----|36] - J:\SaveFile.Dir
[01/03/2005 09:39|---hs----|2213] - J:\Softthinks_MLSP_ALL_BLU_WW.txt
[01/03/2005 09:39|---hs----|7] - J:\Softthinks_MLSP_ALL_BLU_WW-01.block
[18/08/2001 07:00|---hs----|10] - J:\WIN51
[22/01/2001 07:00|---hs----|11] - J:\WIN51.B2
[25/07/2001 07:00|---hs----|11] - J:\WIN51.RC1
[25/07/2001 12:47|---hs----|11] - J:\WIN51.RC2
[18/08/2001 07:00|---hs----|10] - J:\WIN51IC
[20/03/2001 07:00|---hs----|11] - J:\WIN51IC.B2
[25/07/2001 07:00|---hs----|11] - J:\WIN51IC.RC1
[25/07/2001 07:00|---hs----|11] - J:\WIN51IC.RC2
[17/08/2001 07:00|---hs----|10] - J:\WIN51IP
[22/01/2001 07:00|---hs----|11] - J:\WIN51IP.B2
[25/07/2001 12:47|---hs----|11] - J:\WIN51IP.RC2
[17/08/2001 05:17|---hs----|184] - J:\WINBOM.INI
[01/02/2005 07:49|---hs----|535] - J:\install.bat
[10/09/2002 07:58|---hs----|181616] - J:\protect.ed
[12/10/2006 18:56|--ah-----|18] - J:\USER

###################### | Listing des dossiers présents J:\ |

[26/08/2009 23:55|drahs----|0] - J:\autorun.inf
[20/01/2005 05:14|d--hs----|0] - J:\cmdcons
[13/10/2006 18:45|d--hs----|0] - J:\Recycled
[20/01/2005 05:14|d--hs----|0] - J:\MiniNT
[16/09/2004 22:50|d--hs----|0] - J:\PRELOAD
[12/10/2006 18:29|d--hs----|0] - J:\I386
[12/10/2006 18:55|d--hs----|0] - J:\Tools
[12/10/2006 18:56|d--hs----|0] - J:\hp
[12/10/2006 18:56|dr-------|0] - J:\R‚installation SystŠme
[13/10/2006 09:46|d--hs----|0] - J:\System Volume Information

###################### | Listing des fichiers présents N:\ |

[?|?|?] - N:\§[ÁñP¨ÂS.XE_
[?|?|?] - N:\pã	oà”ße.­Öå
[?|?|?] - N:
Ùx~}Á:U.Rü=
[?|?|?] - N:\ä0‹gµj..m
[?|?|?] - N:\@u7ç–.áf!
[?|?|?] - N:\Ç5á™±n.ˆöú
[?|?|?] - N:\º
[?|?|?] - N:\Æ"mßtüçŽ.)°¯
[?|?|?] - N:\<­Ø â¡>Ú.u¨õ
[?|?|?] - N:\Û²®M‘·b'.t£
[?|?|?] - N:\Ð±9kÁeÝ.×Ðà
[?|?|?] - N:\ÿ\šðJûÓÂ.åŸ
[?|?|?] - N:\ä²Ÿ‰ã‰Ë.qbž
[?|?|?] - N:\Y•¼îÚ.„ž.)
[?|?|?] - N:\hýÚæî.|û
[?|?|?] - N:\ú£v˜«oÐæ.ûh¤
[?|?|?] - N:\Ñ?7wÐ¶9.ˆè
[?|?|?] - N:\ÁÙ	¶s§eŠ.uL
[?|?|?] - N:\‰Ï
[?|?|?] - N:\?î	å@.öýI
[?|?|?] - N:\‡Ç½>	>bÏ.pä-
[?|?|?] - N:\ÆÛmüm·.ñ¶ß
[?|?|?] - N:\ô0¬[]ó®l.Çá
[?|?|?] - N:\1$Ôooä¸.ô¾
[?|?|?] - N:\ºh‚Åà­¸Ü.>Ô[
[?|?|?] - N:\ºt`‚¯µ­.TdJ
[?|?|?] - N:\ÖŽyÖ¤ké.š)o
[?|?|?] - N:\?j)¼"xÑÛ.‹m
[?|?|?] - N:
”,(¡WÈu.k8È
[?|?|?] - N:\Ýï¸®4Œ^.g$ß
[?|?|?] - N:\$çä¶g›Ê.'¿
[?|?|?] - N:\s!æÒ¦Ç.å"¤
[?|?|?] - N:\vëëÛþ‹½&.|-
[?|?|?] - N:\î¹ßÒuïr.ÇÓò
[?|?|?] - N:\§,½x™»§›.O|M
[?|?|?] - N:\³Ó\-¤±s.ÛÛÞ
[?|?|?] - N:\¦×®ìâðQ

jlpjlp · Answer

ok fais l'option nettoyage et colle le rapport

RedDiamond · Answer

je l'ai délà fais le rapport est plus haut. si tu entend ''nettoyage'' par: ötape n°2 ''supprimer''.. je le refais de suite

jlpjlp · Answer

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)


double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

RedDiamond · Answer

Ok je vais faire ça car mon ordinateur est en train de corriger les erreures de caines de cluster pardues, il est est au cluster 7'600'000 ça fais trois quatres jours qu'il scan...
je m'impatiente, d'autant plus que semblerais t'il qu'un cluster est la plus petite unité d'un disque dur.
donc si c'est égal a un bit. je dois attendre 1000 milliard de cluster pour corriger un Tib complet.
mais je ne suis pas sur de ce que j'avance car je ne connais rien du fameux cluster.
ma prochaine réponse sera accompagnée du rapport. Merci jlpjlp

jlpjlp · Answer

ok

Red · Answer

Voila :

ComboFix 09-08-30.01 - Administrateur 30/08/2009 22:26.1.1 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.1.1036.18.1535.1087 [GMT 2:00]
Running from: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
 * Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
[i] ADS - ntoskrnl.exe: deleted 68 bytes in 1 streams. /i

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\msconfig.exe
c:\windows\system32\Plugins

.
(((((((((((((((((((((((((   Files Created from 2009-07-28 to 2009-08-30  )))))))))))))))))))))))))))))))
.

2009-08-30 20:32 . 2009-08-30 20:32	--------	d-----w-	c:\windows\system32\oobe
2009-08-30 20:32 . 2009-08-30 20:32	--------	d-----w-	c:\windows\system32
pp
2009-08-30 20:32 . 2009-08-30 20:32	--------	d-----w-	c:\windows\msagent
2009-08-26 19:11 . 2009-08-30 20:11	--------	d-----w-	C:\UsbFix
2009-08-26 18:12 . 2009-08-26 18:18	--------	d-----w-	c:\program files\PowerDataRecovery
2009-08-26 16:13 . 2009-08-26 16:13	--------	d-----w-	c:\program files\Password Recovery for MSN
2009-08-26 15:15 . 2009-08-05 17:29	3036024	----a-w-	c:\documents and settings\Administrateur\Application Data\Simply Super Software\Trojan Remover\hnh8D9.exe
2009-08-26 14:39 . 2009-08-26 14:43	--------	d-----w-	C:sit
2009-08-26 14:19 . 2009-08-26 14:19	932368	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
2009-08-26 14:19 . 2009-08-26 14:19	678416	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
2009-08-26 14:19 . 2009-08-26 14:19	604688	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
2009-08-26 14:19 . 2009-08-26 14:19	1096208	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
2009-08-26 14:19 . 2009-08-26 14:19	522768	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
2009-08-26 14:19 . 2009-08-26 14:19	80400	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Filesollback\patch\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2009-08-26 14:19 . 2009-08-26 14:19	80400	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Filesollback\patch\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2009-08-26 14:19 . 2009-08-26 14:19	264720	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Filesollback\patch\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2009-08-26 14:19 . 2009-08-26 14:19	109072	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files	emporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd3.dll
2009-08-26 14:19 . 2009-08-26 14:19	59920	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files	emporaryFolder\AutoPatches\kav9exec\9.0.0.459\mzvkbd.dll
2009-08-26 14:19 . 2009-08-26 14:19	264720	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files	emporaryFolder\AutoPatches\kav9exec\9.0.0.459\klwtbbho.dll
2009-08-26 14:18 . 2009-08-26 14:18	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Malwarebytes
2009-08-26 14:18 . 2009-08-03 11:36	38160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-26 14:18 . 2009-08-26 14:18	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-26 14:18 . 2009-08-26 14:18	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-08-26 14:18 . 2009-08-03 11:36	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-08-26 12:52 . 2009-08-26 12:52	604140	--sha-w-	c:\windows\system32\drivers\ISwift3.dat
2009-08-26 12:49 . 2009-08-26 12:49	94643	----a-w-	c:\windows\system32\drivers\klick.dat
2009-08-26 12:49 . 2009-08-26 12:49	105395	----a-w-	c:\windows\system32\drivers\klin.dat
2009-08-26 12:24 . 2009-08-26 12:24	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2009-08-26 12:02 . 2009-08-26 12:09	5037072	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\SpyBot\spybotsd14.exe
2009-08-26 11:55 . 2009-08-26 12:02	4354084	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\SpyBot\spybotsd13.exe
2009-08-26 11:10 . 2006-06-19 11:01	69632	----a-w-	c:\windows\system32\ztvcabinet.dll
2009-08-26 11:10 . 2006-05-25 13:52	162304	----a-w-	c:\windows\system32\ztvunrar36.dll
2009-08-26 11:10 . 2005-08-25 23:50	77312	----a-w-	c:\windows\system32\ztvunace26.dll
2009-08-26 11:10 . 2003-02-02 18:06	153088	----a-w-	c:\windows\system32\UNRAR3.dll
2009-08-26 11:10 . 2002-03-05 23:00	75264	----a-w-	c:\windows\system32\unacev2.dll
2009-08-26 11:10 . 2009-08-26 11:10	--------	d-----w-	c:\program files\Trojan Remover
2009-08-26 11:10 . 2009-08-26 11:10	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\Simply Super Software
2009-08-26 11:10 . 2009-08-26 11:10	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Simply Super Software
2009-08-26 09:57 . 2009-08-26 09:57	8192	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme1\Crackme#1.EXE
2009-08-26 09:57 . 2009-08-26 09:57	20480	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme2\CRACKME.EXE
2009-08-26 09:55 . 2009-08-26 09:55	8192	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme1\Crackme#1ok.EXE
2009-08-26 09:55 . 2009-08-26 09:55	4096	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme13\crackme3.exe
2009-08-26 09:55 . 2009-08-26 09:55	12288	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme7\CRACKMEetape1.EXE
2009-08-26 09:55 . 2009-08-26 09:55	12288	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme7\CRACKMEetape2.EXE
2009-08-26 09:55 . 2009-08-26 09:55	6656	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crack Outils\Restorator\crack.exe
2009-08-26 09:55 . 2009-08-26 09:55	32768	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme1\Lancez-moi.exe
2009-08-26 09:30 . 2009-08-26 09:30	--------	d-----w-	c:\program files\Plasmatek Software
2009-08-26 09:14 . 2004-05-30 16:17	10574966	------w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Anti-hacker\Anti-hacker\kantihacker1.5.119_rus.exe
2009-08-26 09:12 . 2009-08-26 09:12	12288	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme7\CRACKME.EXE
2009-08-26 09:11 . 2009-08-26 09:11	20480	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\Crackme2\CRACKMEOk.EXE
2009-08-26 09:11 . 2009-08-26 09:11	4096	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hacking\CrackingLessons\Crackme\CrackMe_10\CrackMe11b.exe
2009-08-26 03:37 . 2009-08-26 03:39	468496	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\HackerWatch\hwupdchk.exe
2009-08-26 03:34 . 2009-08-26 03:37	622608	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\HackerWatch\HWAPI.dll
2009-08-26 03:28 . 2009-08-26 03:28	1878731	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\NeoTrace 3.25\gejave_ntp325.exe
2009-08-26 03:03 . 2009-08-26 03:04	2576366	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Protectx - hacker défense suite version 4.16 pro\protectx.exe
2009-08-26 02:15 . 2009-08-26 02:32	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\UseNeXT
2009-08-26 02:14 . 2009-08-26 02:14	--------	d-----w-	c:\program files\UseNeXT
2009-08-26 02:14 . 2009-08-26 02:14	169472	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hack\Seriale\Seriale 2000\snmanager.exe
2009-08-26 02:14 . 2009-08-26 02:14	69632	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hack\PasswordVisible2002\password visible2002 .exe
2009-08-26 02:14 . 2009-08-26 02:14	223232	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hack\parole\FTP_PR~1.EXE
2009-08-26 02:14 . 2009-08-26 02:14	66048	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hack\aflare parole din windows 2\HOOVER.EXE
2009-08-26 02:13 . 2009-08-26 02:13	1771	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hack\Show Bios Password\AW.COM
2009-08-26 02:13 . 2009-08-26 02:13	1049	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hack\Show Bios Password\AM.EXE
2009-08-26 02:13 . 2009-08-26 02:13	15458	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hack\Seriale\Seriale 2000\SN2000.EXE
2009-08-26 02:13 . 2009-08-26 02:13	14848	----a-w-	c:\documents and settings\Administrateur\Application Data\DC++\Downloads\Hackevelation\Revelation.exe
2009-08-26 00:34 . 2009-08-26 02:27	--------	d-----w-	c:\documents and settings\Administrateur\Contacts
2009-08-25 19:06 . 2009-08-25 19:06	--------	d-----w-	c:\program files\Fichiers communs\Windows Live
2009-08-25 16:12 . 2009-08-26 14:13	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\Norton
2009-08-25 16:12 . 2009-08-25 16:12	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\Symantec
2009-08-25 16:12 . 2009-08-25 16:12	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\NortonInstaller
2009-08-25 16:09 . 2004-06-26 13:22	6016	----a-w-	c:\windows\system32\drivers\vnccom.SYS
2009-08-25 16:08 . 2009-08-25 16:09	--------	d-----w-	c:\program files\UltraVNC
2009-08-25 16:08 . 2005-06-10 22:02	12800	----a-w-	c:\windows\system32\vncdrv.dll
2009-08-25 16:08 . 2004-06-26 13:22	4736	----a-w-	c:\windows\system32\drivers\vncdrv.sys
2009-08-25 16:08 . 2004-06-26 13:21	5760	----a-w-	c:\windows\system32\vnchelp.dll
2009-08-25 01:00 . 2009-08-25 01:00	--------	d-----w-	c:\program files\MSXML 4.0
2009-08-24 09:26 . 2009-08-24 09:26	--------	d-----w-	c:\documents and settings\Administrateur\Local Settings\Application Data\S2PC
2009-08-24 09:26 . 2009-08-24 09:26	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\SmarThru4
2009-08-24 09:26 . 2007-10-22 06:55	41984	----a-w-	c:\windows\system32\drivers\DgivEcp.sys
2009-08-24 09:24 . 2009-08-24 09:26	--------	d-----w-	c:\program files\SmarThru 4
2009-08-24 09:24 . 2008-08-08 01:51	479232	----a-w-	c:\windows\ssndii.exe
2009-08-24 09:24 . 2007-08-13 05:59	82432	----a-w-	c:\windows\system32\msxml4r.dll
2009-08-24 09:24 . 2007-08-13 05:59	44544	----a-w-	c:\windows\system32\msxml4a.dll
2009-08-24 09:24 . 2007-08-13 05:59	21776	----a-w-	c:\windows\system32\msxml2a.dll
2009-08-24 09:24 . 2009-08-24 09:24	--------	d-----w-	c:\windows\Samsung
2009-08-24 09:22 . 2008-04-13 05:47	25856	----a-w-	c:\windows\system32\drivers\usbprint.sys
2009-08-24 09:21 . 2008-04-13 07:45	32128	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2009-08-24 09:20 . 2008-01-10 12:29	81920	------w-	c:\windows\system32\ssdevm.dll
2009-08-24 09:20 . 2007-10-23 02:53	110592	----a-r-	c:\windows\WiaInst.exe
2009-08-24 09:20 . 2007-08-13 08:22	49152	----a-w-	c:\windows\system32\Ssusbpn.dll
2009-08-24 09:20 . 2008-07-08 23:43	138752	----a-r-	c:\windows\system32\SaXPWIA.dll
2009-08-24 09:20 . 2008-07-08 23:43	138240	----a-r-	c:\windows\system32\SaXPUIEx.dll
2009-08-24 09:20 . 2008-07-08 23:43	87040	----a-r-	c:\windows\system32\SaXPSTI.dll
2009-08-24 09:20 . 2008-07-08 23:43	116736	----a-r-	c:\windows\system32\SaXPIPH.dll
2009-08-24 09:20 . 2008-07-08 23:43	139776	----a-r-	c:\windows\system32\SaXPEH.dll
2009-08-24 09:20 . 2007-08-14 01:01	22723	----a-w-	c:\windows\system32\sst1cl3.dll
2009-08-24 09:19 . 2007-08-14 00:59	151552	----a-w-	c:\windows\system32\sst1cci.exe
2009-08-24 09:19 . 2007-08-14 00:59	65536	----a-w-	c:\windows\system32\sst1cci.dll
2009-08-24 09:19 . 2009-08-24 09:19	--------	d-----w-	c:\windows\system32\drivers\Samsung
2009-08-24 09:19 . 2009-08-24 09:19	--------	d-----w-	c:\program files\Samsung
2009-08-23 23:08 . 2009-08-23 23:28	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\PCAnonyme4
2009-08-23 22:44 . 2009-08-23 22:44	--------	d-----w-	c:\documents and settings\LocalService.AUTORITE NT\Bureau
2009-08-23 22:35 . 2009-08-26 12:41	--------	d-----w-	c:\program files\Lavasoft
2009-08-23 22:35 . 2009-08-26 12:41	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft
2009-08-23 21:38 . 2009-08-23 21:38	--------	d-----w-	c:\program files\AVG
2009-08-23 21:23 . 2009-08-26 15:30	--------	d---a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-08-23 21:23 . 2009-08-23 21:23	--------	d-----w-	c:\program files\Micro Application
2009-08-23 20:20 . 2001-08-23 11:47	5632	----a-w-	c:\windows\system32\ptpusb.dll
2009-08-23 20:20 . 2008-04-13 05:45	15104	----a-w-	c:\windows\system32\drivers\usbscan.sys
2009-08-23 20:20 . 2008-04-13 13:33	159232	----a-w-	c:\windows\system32\ptpusd.dll
2009-08-23 10:20 . 2009-06-25 08:26	54272	------w-	c:\windows\system32\dllcache\wdigest.dll
2009-08-23 10:20 . 2009-06-25 08:26	301568	------w-	c:\windows\system32\dllcache\kerberos.dll
2009-08-23 10:20 . 2009-06-25 08:26	136192	------w-	c:\windows\system32\dllcache\msv1_0.dll
2009-08-23 10:20 . 2009-06-24 11:18	92928	------w-	c:\windows\system32\dllcache\ksecdd.sys
2009-08-22 16:26 . 2009-08-24 10:32	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\dvdcss
2009-08-21 01:53 . 2009-08-21 01:55	--------	d-----w-	c:\program files\Zion++
2009-08-20 01:48 . 2008-07-06 12:06	89088	----a-w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-20 01:48 . 2008-07-06 12:06	117760	----a-w-	c:\windows\system32\prntvpt.dll
2009-08-20 01:48 . 2008-07-06 10:50	597504	----a-w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-20 01:48 . 2008-07-06 12:06	575488	----a-w-	c:\windows\system32\xpsshhdr.dll
2009-08-20 01:48 . 2008-07-06 12:06	575488	----a-w-	c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-20 01:48 . 2008-07-06 12:06	1676288	----a-w-	c:\windows\system32\xpssvcs.dll
2009-08-20 01:48 . 2008-07-06 12:06	1676288	----a-w-	c:\windows\system32\dllcache\xpssvcs.dll
2009-08-20 01:08 . 2007-11-30 11:18	26488	----a-w-	c:\windows\system32\spupdsvc.exe
2009-08-20 01:02 . 2009-08-23 13:49	--------	d--h--w-	c:\windows\$hf_mig$

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-26 21:53 . 2008-08-23 23:53	82830	----a-w-	c:\windows\system32\perfc00C.dat
2009-08-26 21:53 . 2008-08-23 23:53	507458	----a-w-	c:\windows\system32\perfh00C.dat
2009-08-26 12:49 . 2009-08-19 11:57	--------	d-----w-	c:\program files\Mozilla Thunderbird
2009-08-24 09:25 . 2009-08-24 09:25	--------	d-----w-	c:\program files\Fichiers communs\SRC Shared
2009-08-24 09:25 . 2009-08-24 09:24	--------	d-----w-	c:\program files\Readiris10
2009-08-19 12:44 . 2009-08-19 12:43	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Winamp
2009-08-19 12:44 . 2009-08-19 12:43	--------	d-----w-	c:\program files\Winamp
2009-08-19 12:26 . 2009-08-19 10:42	--------	d-----w-	c:\program files\MSBuild
2009-08-19 11:57 . 2009-08-19 11:57	--------	d-----w-	c:\program files\Fichiers communs\Nero
2009-08-19 11:57 . 2009-08-19 10:49	--------	d-----w-	c:\program files\Nero
2009-08-19 11:57 . 2009-08-19 11:57	--------	d-----w-	c:\documents and settings\All Users.WINDOWS\Application Data\Nero
2009-08-19 11:56 . 2009-08-19 11:56	--------	d-----w-	c:\program files\TaskSwitchXP
2009-08-19 11:55 . 2009-08-19 11:55	2678	----a-w-	c:\windows\java\Packages\Data\IZ9B9JVB.DAT
2009-08-19 11:55 . 2009-08-19 11:55	2678	----a-w-	c:\windows\java\Packages\Data\PBJJL3JB.DAT
2009-08-19 11:55 . 2009-08-19 11:55	2678	----a-w-	c:\windows\java\Packages\Data\CUHJF9BZ.DAT
2009-08-19 11:55 . 2009-08-19 11:55	2678	----a-w-	c:\windows\java\Packages\Data\LN9JLZ57.DAT
2009-08-19 11:55 . 2009-08-19 11:55	2678	----a-w-	c:\windows\java\Packages\Data\53DVTVZH.DAT
2009-08-19 11:47 . 2009-08-19 11:47	21892	----a-w-	c:\windows\system32\emptyregdb.dat
2009-08-19 11:47 . 2009-08-19 10:33	--------	d-----w-	c:\program files\Windows Media Connect 2
2009-08-19 10:58 . 2009-08-19 10:50	--------	d-----w-	c:\documents and settings\XP\Application Data\Ahead
2009-08-19 10:51 . 2009-08-19 10:51	125	----a-w-	c:\documents and settings\XP\Local Settings\Application Data\fusioncache.dat
2009-08-19 10:50 . 2009-08-19 10:49	--------	d-----w-	c:\program files\Fichiers communs\Ahead
2009-08-19 10:36 . 2009-08-19 10:36	--------	d-----w-	c:\program files\Reference Assemblies
2009-08-19 10:30 . 2009-08-19 10:30	--------	d-----w-	c:\program files\microsoft frontpage
2009-08-19 10:23 . 2009-08-19 10:23	--------	d-----w-	c:\program files\VistaDrives
2009-08-19 10:23 . 2009-08-19 10:23	--------	d-----w-	c:\program files\WGA
2009-08-19 10:20 . 2009-08-19 10:20	--------	d-----w-	c:\program files\Services en ligne
2009-08-05 09:00 . 2008-08-23 23:53	205312	----a-w-	c:\windows\system32\mswebdvd.dll
2009-07-29 04:35 . 2008-08-23 23:53	81920	----a-w-	c:\windows\system32\fontsub.dll
2009-07-29 04:35 . 2008-08-23 23:53	119808	----a-w-	c:\windows\system32	2embed.dll
2009-07-17 19:03 . 2008-08-23 23:53	58880	----a-w-	c:\windows\system32\atl.dll
2009-07-13 21:43 . 2008-08-23 23:53	286208	----a-w-	c:\windows\system32\wmpdxm.dll
2009-07-03 13:48 . 2009-07-03 13:48	219664	----a-w-	c:\windows\system32\klogon.dll
2009-07-03 13:45 . 2009-07-03 13:45	27507	----a-w-	c:\windows\system32\drivers\klopp.dat
2009-06-29 16:13 . 2008-08-23 23:53	828928	----a-w-	c:\windows\system32\wininet.dll
2009-06-29 16:13 . 2008-08-23 23:53	78336	----a-w-	c:\windows\system32\ieencode.dll
2009-06-29 16:13 . 2008-08-23 23:53	17408	----a-w-	c:\windows\system32\corpol.dll
2009-06-25 08:26 . 2008-08-23 23:53	736768	----a-w-	c:\windows\system32\lsasrv.dll
2009-06-25 08:26 . 2008-08-23 23:53	56832	----a-w-	c:\windows\system32\secur32.dll
2009-06-25 08:26 . 2008-08-23 23:53	54272	----a-w-	c:\windows\system32\wdigest.dll
2009-06-25 08:26 . 2008-08-23 23:53	147456	----a-w-	c:\windows\system32\schannel.dll
2009-06-25 08:26 . 2008-08-23 23:53	136192	----a-w-	c:\windows\system32\msv1_0.dll
2009-06-25 08:26 . 2008-08-23 23:53	301568	----a-w-	c:\windows\system32\kerberos.dll
2009-06-24 11:18 . 2008-08-23 23:53	92928	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2009-06-15 12:01 . 2009-06-15 12:01	128016	----a-w-	c:\windows\system32\drivers\kl1.sys
2009-06-15 11:09 . 2008-08-23 23:53	82944	----a-w-	c:\windows\system32	lntsess.exe
2009-06-15 10:44 . 2008-08-23 23:53	78848	----a-w-	c:\windows\system32	elnet.exe
2009-06-10 14:14 . 2008-08-23 23:53	85504	----a-w-	c:\windows\system32\avifil32.dll
2009-06-10 07:21 . 2009-08-19 11:47	2066432	----a-w-	c:\windows\system32\mstscax.dll
2009-06-10 06:15 . 2008-08-23 23:53	132096	----a-w-	c:\windows\system32\wkssvc.dll
2009-06-04 16:26 . 2009-06-04 16:26	64088	----a-w-	c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.459\French\setup.exe
2009-06-03 19:10 . 2008-08-23 23:53	1297408	----a-w-	c:\windows\system32\quartz.dll
.

------- Sigcheck -------

[-] 2008-08-23 23:53	361600	E88631E21A9CACA06104802F9E915115	c:\windows\system32\drivers	cpip.sys

[-] 2008-08-23 23:53	2011136	22F702A6DCBDB4F7282C4B73B95EE4E4	c:\windows\explorer.exe

[-] 2008-08-23 23:53	1648640	F2614128EF03320BBFCF17F19A1633E9	c:\windows\system32\comres.dll



[-] 2008-08-23 23:53	1571840	A9658459BB4F4EE00FA117C9382C0D3A	c:\windows\system32\sfcfiles.dll

c:\windows\system32\drivers\beep.sys ... is missing !!
c:\windows\system32\msgsvc.dll ... is missing !!
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-08-19 288560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueTransparency"="c:\program files\TrueTransparency\TrueTransparency.exe" [2007-07-28 123904]
"TaskTips"="c:\program files\VisualTaskTips\TaskTips.exe" [2007-08-15 36352]
"ViStart"="c:\program files\ViStart\ViStart.exe" [2007-09-05 589824]
"AdobeCS4ServiceManager"="c:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-08-11 524288]
"3170 Scan2PC"="c:\windows\Twain_32\Samsung\CLX3170\Scan2pc.exe" [2008-08-07 495616]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2009-08-04 1068424]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="c:\windows\system32\sti_ci.dll" [2008-08-23 679936]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="c:\program files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 62976]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-06-29 124928]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\WBSrv]
2005-12-20 20:57	176128	----a-w-	c:\progra~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	PDBoot.exe\0autocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Messenger\livecall.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\uTorrent\uTorrent.exe"=
"c:\Program Files\eMule\eMule.exe"=
"c:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"=
"c:\Program Files\DC++\DCPlusPlus.exe"=
"c:\Program Files\Zion++\Zion++.exe"=
"c:\Program Files\Micro Application\PC Anonyme\PCAnonyme.exe"=
"c:\WINDOWS\twain_32\Samsung\ScanMgr.exe"=
"c:\WINDOWS\twain_32\Samsung\CLX3170\Scan2Pc.exe"=
"c:\WINDOWS\twain_32\Samsung\CLX3170\Sscan2io.exe"=
"c:\Program Files\UltraVNC\winvnc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [15/12/2008 20:41 33808]
R0 Si3124;Si3124;c:\windows\system32\drivers\si3124.sys [24/08/2008 01:53 76208]
R0 Si3531;Si3531;c:\windows\system32\drivers\Si3531.sys [24/08/2008 01:53 210224]
R2 StealthInjectorService;Stealth Service Helper;c:\program files\Micro Application\PC Anonyme\IJStealth4Svc.exe [23/08/2009 23:23 148992]
R2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [25/08/2009 18:09 6016]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [19/08/2009 16:22 89600]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13/05/2009 17:46 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [16/05/2009 20:59 19472]
S0 wylu;wylu;c:\windows\system32\drivers\pxbdpj.sys --> c:\windows\system32\drivers\pxbdpj.sys [?]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - HELPSVC
*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)


.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: SmarThru4 Capture Selection - c:\program files\SmarThru 4\WebCapture.dll2.htm
IE: SmarThru4 Save as HTML - c:\program files\SmarThru 4\WebCapture.dll1.htm
IE: SmarThru4 Save Selected Text - c:\program files\SmarThru 4\WebCapture.dll.htm
IE: SmarThru4 Web Capture - c:\program files\SmarThru 4\WebCapture.dll
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\eivtxlv7.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 22:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\mc23.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1614895754-602162358-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ø*Ç*T%\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"

[HKEY_USERS\S-1-5-21-1614895754-602162358-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ø*Ç*T%\OpenWithProgids]
"øÇ+_auto_file"=hex(0):

[HKEY_LOCAL_MACHINE\software\Classes\*„%E*_*a*u*t*o*_*f*i*l*e*\shell\Play]
@="Lire avec VLC"

[HKEY_LOCAL_MACHINE\software\Classes\*„%E*_*a*u*t*o*_*f*i*l*e*\shell\Play\command]
@="\"c:\Program Files\VideoLAN\VLC\vlc.exe\" --started-from-file \"%1\""
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
c:\program files\Raxco\PerfectDisk\PDAgent.exe
c:\program files\Raxco\PerfectDisk\PDEngine.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\devldr32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2009-08-30 22:42 - machine was rebooted
ComboFix-quarantined-files.txt  2009-08-30 20:42

Pre-Run: 27 578 064 896 octets libres
Post-Run: 27 462 877 184 octets libres

335	--- E O F ---	2009-08-26 23:51

jlpjlp · Answer

remets un rapport combofix après avoir activé là console de récupération comme proposé lors du lancement du logiciel . Puis mets un rapport avec kaspersky que tu as et remets ensuite un rapport rsit et dis tes soucis

RedDiamond · Answer

Combofix : 
message d'erreur :              Were you trying to run CFScript?
                                         The name CFScript appers to be incorrectly spelt.

Donc impossible : activé là console de récupération

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-08-31 23:55:43
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 26 GB (65%) free of 40 GB
Total RAM: 1535 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:01:17, on 01/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21073)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VisualTaskTips\TaskTips.exe
C:\Program Files\ViStart\ViStart.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\Program Files\Micro Application\PC Anonyme\IJStealth4Svc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\Administrateur\Bureau\Nouveau dossier (2)\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Administrateur\Bureau\Administrateur.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O4 - HKLM\..\Run: [TrueTransparency] C:\Program Files\TrueTransparency\TrueTransparency.exe
O4 - HKLM\..\Run: [TaskTips] C:\Program Files\VisualTaskTips\TaskTips.exe
O4 - HKLM\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [3170 Scan2PC] "C:\WINDOWS\Twain_32\Samsung\CLX3170\Scan2pc.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-18\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: ProtectX Hacker Defence Suite.lnk = C:\Program Files\Plasmatek Software\ProtectX\protectx.exe
O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: SmarThru4 Capture Selection - C:\Program Files\SmarThru 4\WebCapture.dll2.htm
O8 - Extra context menu item: SmarThru4 Save as HTML - C:\Program Files\SmarThru 4\WebCapture.dll1.htm
O8 - Extra context menu item: SmarThru4 Save Selected Text - C:\Program Files\SmarThru 4\WebCapture.dll.htm
O8 - Extra context menu item: SmarThru4 Web Capture - C:\Program Files\SmarThru 4\WebCapture.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: SmarThru4 Web Capture - {5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Web Capture - {5941A0E4-56C1-4a49-9B18-05762CAC5F9B} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Capture Selection - {A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Capture Selection - {A07BFEF7-DD11-4937-B23B-E70C11D2EDF4} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Save as HTML - {E753A93F-2367-4978-BFA0-83048C1E61CB} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Save as HTML - {E753A93F-2367-4978-BFA0-83048C1E61CB} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra button: SmarThru4 Save Selected Text - {F1F53366-3E11-47ab-BF84-580C94F9C9AD} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O9 - Extra 'Tools' menuitem: SmarThru4 Save Selected Text - {F1F53366-3E11-47ab-BF84-580C94F9C9AD} - C:\Program Files\SmarThru 4\WebCapture.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\WINDOWS\System32\DreamScene.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Stealth Service Helper (StealthInjectorService) - Softwareentwicklung Remus - C:\Program Files\Micro Application\PC Anonyme\IJStealth4Svc.exe

RedDiamond · Answer

devrai-je réinstaller xp et essayer de traiter le disque dur par la suite?

RedDiamond · Answer

Plus envie de perdre du temps j'ai formaté le HDD.

jlpjlp · Answer

ok

RedDiamond · Answer

merci d'avoir essayé ;- )

Svp j'ai besoin d'aide. - Page 2

Newsletters