Internet rame ordi surchauffe icones disparus

dekaki Messages postés 2 Statut Membre -  
 Kaki -
Bonjour à tous !

Comme une débutante j'ai lancé un fichier exe (mais il venait d'un ami qui est sur mac, qui me demandait de vérifier que l'outil fonctionnait bien, et qui m'a garanti que c'était un fichier propre... Mais en fait non... Merci copain...). Le fichier ne s'est pas exécuté 'visiblement' mais mon ordi s'est mis à ramer d'un coup, le ventilateur à tourner à bloc, et internet à ramer. En gros mon ordinateur fonctionne bien sauf le net (les logiciels comme toshop ou dream fonctionnent normalement).
Qui plus est, mes icônes ont disparus (le bureau dans les icônes de lancement rapide, le poste de travail, l'icone memory stick)...

J'ai lancé un spybot S&D, il m'a trouvé pas mal de malewares et de trojans (je pense que le virus en a balancé partout, c'est comme si lors de l'exécution du fichier exe ça s'était propagé partout...). Pendant la première execution, l'ordi a affiché un écran noir, m'a affiché un message genre "surchauffe" et a redémarré (enfin a tenté de redémarrer, l'écran était noir). Du coup j'ai branché mon ventilateur histoire de le rafraichir...

Voici mon Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:55:57, on 28/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\user\xdkthjc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\SYSDLL.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony\HotKey Utility\HKserv .exe
C:\Program Files\PowerISO\PWRISOVM .exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\user\LOCALS~1\Temp\ctv6856.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
C:\WINDOWS\system32\Restore\rstrui.exe
E:\APPZ\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll (file missing)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\user\xdkthjc.exe \s,C:\Documents and Settings\user\volikc.exe \s
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: IE Developer Toolbar BHO - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"
O4 - HKLM\..\Run: [AppMon Utility] "C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe" @@@Start
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HomePlayer] C:\Program Files\HomePlayer\HomePlayer.exe
O4 - HKLM\..\Run: [rgca8bj0ee8l] C:\WINDOWS\system32\qgcc8bj0ee8l.exe
O4 - HKLM\..\Run: [hipwh] C:\WINDOWS\system32\hipwh.exe \u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SYSDLL] SYSDLL
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1078081533-117609710-839522115-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Administrateur')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\254369156.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\254369156.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{19180DD8-5C51-44CA-9E51-39A1A4E10533}: NameServer = 213.174.139.72,255.255.255.255
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C279558-653A-4AF1-8403-867DEB1E1CC7}: NameServer = 213.174.139.72,255.255.255.255
O17 - HKLM\System\CCS\Services\Tcpip\..\{9DA36BE0-EDBA-41B6-ADD6-3EC826E6202A}: NameServer = 213.174.139.72,255.255.255.255
O17 - HKLM\System\CCS\Services\Tcpip\..\{A934A19A-C559-40E4-BE3F-C80C8D87D93D}: NameServer = 213.174.139.72,255.255.255.255
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O21 - SSODL: jhceSkHL - {A8771657-02DD-BCFD-05D7-015E9DD18DFD} - C:\WINDOWS\system32\yery.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service de transfert intelligent en arrière-plan (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe
O23 - Service: Mises à jour automatiques (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 13063 bytes

Merci à qui pourra m'aider... Je dois travailler sur mon ordi demain (je suis webdesigner et donc vraiment dans la m...barras)... :'(
Configuration: Windows XP
Firefox 3.0.13

21 réponses

  • 1
  • 2
  1. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Plutôt sympa ton copain lol..

    Commence par faire ceci :

    List&Kill'em ---->

    [x] Télécharge List&Kill'em (par Gen-Hackman) sur ton bureau à cette adresse : http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem.exe

    /!\ Désactive tes protections le temps de la manip' ( Antivirus, Pare-Feu ) /!\

    /!\ Déconnecte internet et ferme toutes tes applications en cours /!\

    [x] Lance le en double cliquant dessus ( Si tu es sous Vista -> Clique droit -> " Exécuter en tant qu'administrateur " )

    [x] Choisis l'option F ( pour français ) et valide par "entrée".

    [x] Choisis ensuite l'option 1 ( Recherche )

    [x] Ne fais rien pendant le scan

    [x] Copie/Colle le rapport qui s'ouvrira dans ton prochain message
    0
    1. dekaki Messages postés 2 Statut Membre
       
      Ouahou quelle réactivité !!

      Merci déjà pour ta réponse :)

      Voici le rapport :

      List'em by g3n-h@ckm@n 1.0.2.8

      updated on 23.08.2009 ::::: 13.00


      Microsoft Windows XP [version 5.1.2600]


      28/08/2009 23:22:07,31


      Nom de l'h“te: KAKIORDI
      Nom du systŠme d'exploitation: Microsoft Windows XP Professionnel
      Version du systŠme: 5.1.2600 Service Pack 3 version 2600
      Fabricant du systŠme d'exploitation: Microsoft Corporation
      Configuration du systŠme d'exploitation: Station de travail autonome
      Type de version du systŠme d'exploitation: Multiprocessor Free
      Propri‚taire enregistr‚ÿ: user
      Organisation enregistr‚eÿ:
      Identificateur de produit: 76413-OEM-0082103-49254
      Date d'installation originale: 04/12/2008, 10:04:52
      Dur‚e d'activit‚ systŠme: 0 jours, 3 heures, 27 minutes, 55 secondes
      Fabricant du systŠme: Sony Corporation
      ModŠle du systŠme: VGC-LA1
      Type du systŠme: X86-based PC
      Processeur(s): 1 processeur(s) install‚(s).
      [01]: x86 Family 6 Model 15 Stepping 6 GenuineIntel ~1828 MHz
      Version du BIOS: SONY - 20060814
      R‚pertoire Windows: C:\WINDOWS
      R‚pertoire systŠme: C:\WINDOWS\system32
      P‚riph‚rique d'amor‡age: \Device\HarddiskVolume1
      Option r‚gionale du systŠme: fr;Fran‡ais (France)
      ParamŠtres r‚gionaux d'entr‚eÿ: fr;Fran‡ais (France)
      Fuseau horaire: N/D
      M‚moire physique totale: 3ÿ070 Mo
      M‚moire physique disponible: 2ÿ064 Mo
      M‚moire virtuelle : taille maximale: 2ÿ048 Mo
      M‚moire virtuelle : disponible: 2ÿ008 Mo
      M‚moire virtuelle : en cours d'utilisation: 40 Mo
      Emplacements des fichiers d'‚change: C:\pagefile.sys
      Domaine: KAKIREZO
      Serveur d'ouverture de session: \\KAKIORDI
      Correctif(s): 95 Corrections install‚es.
      [01]: File 1
      [02]: File 1
      [03]: File 1
      [04]: File 1
      [05]: File 1
      [06]: File 1
      [07]: File 1
      [08]: File 1
      [09]: File 1
      [10]: File 1
      [11]: File 1
      [12]: File 1
      [13]: File 1
      [14]: File 1
      [15]: File 1
      [16]: File 1
      [17]: File 1
      [18]: File 1
      [19]: File 1
      [20]: File 1
      [21]: File 1
      [22]: File 1
      [23]: File 1
      [24]: File 1
      [25]: File 1
      [26]: File 1
      [27]: File 1
      [28]: File 1
      [29]: File 1
      [30]: File 1
      [31]: File 1
      [32]: File 1
      [33]: File 1
      [34]: File 1
      [35]: File 1
      [36]: File 1
      [37]: File 1
      [38]: File 1
      [39]: File 1
      [40]: File 1
      [41]: File 1
      [42]: File 1
      [43]: File 1
      [44]: Q147222
      [45]: SP3 - SP
      [46]: Q954430
      [47]: IDNMitigationAPIs - Update
      [48]: NLSDownlevelMapping - Update
      [49]: KB952069_WM9
      [50]: KB936782_WMP10
      [51]: KB923689
      [52]: KB941569
      [53]: KB938127-v2-IE7 - Update
      [54]: KB956390-IE7 - Update
      [55]: KB958215-IE7 - Update
      [56]: KB960714-IE7 - Update
      [57]: KB961260-IE7 - Update
      [58]: KB963027-IE7 - Update
      [59]: KB936929 - Service Pack
      [60]: KB923561 - Update
      [61]: KB938464 - Update
      [62]: KB946648 - Update
      [63]: KB950762 - Update
      [64]: KB950974 - Update
      [65]: KB951066 - Update
      [66]: KB951072-v2 - Update
      [67]: KB951376-v2 - Update
      [68]: KB951698 - Update
      [69]: KB951748 - Update
      [70]: KB951978 - Update
      [71]: KB952004 - Update
      [72]: KB952287 - Update
      [73]: KB952954 - Update
      [74]: KB954211 - Update
      [75]: KB954459 - Update
      [76]: KB954600 - Update
      [77]: KB955069 - Update
      [78]: KB955839 - Update
      [79]: KB956390 - Update
      [80]: KB956391 - Update
      [81]: KB956572 - Update
      [82]: KB956802 - Update
      [83]: KB956803 - Update
      [84]: KB956841 - Update
      [85]: KB957095 - Update
      [86]: KB957097 - Update
      [87]: KB958644 - Update
      [88]: KB958687 - Update
      [89]: KB958690 - Update
      [90]: KB959426 - Update
      [91]: KB960225 - Update
      [92]: KB960715 - Update
      [93]: KB960803 - Update
      [94]: KB961373 - Update
      [95]: KB967715 - Update
      Carte(s) r‚seau: 3 carte(s) r‚seau install‚e(s).
      [01]: Carte r‚seau 1394
      Nom de la connexion : Connexion 1394
      DHCP activ‚ : Oui
      Serveur DHCP : N/D
      Adresse(s) IP
      [02]: LAN-Express BCM 802.11g PCI-E Adapter
      Nom de la connexion : Connexion r‚seau sans fil
      DHCP activ‚ : Oui
      Serveur DHCP : 192.168.0.254
      Adresse(s) IP
      [01] : 192.168.0.11
      [03]: Marvell Yukon 88E8036 PCI-E Fast Ethernet Controller
      Nom de la connexion : Connexion au r‚seau local 3
      tat : Support d‚connect‚

      Nom de l'image PIDÿ Nom de la sessio Num‚ro d Utilisation
      ========================= ====== ================ ======== ============
      System Idle Process 0 Console 0 28 Ko
      System 4 Console 0 236 Ko
      smss.exe 888 Console 0 420 Ko
      csrss.exe 936 Console 0 5ÿ000 Ko
      winlogon.exe 964 Console 0 3ÿ876 Ko
      services.exe 1016 Console 0 4ÿ812 Ko
      lsass.exe 1028 Console 0 1ÿ892 Ko
      svchost.exe 1208 Console 0 6ÿ008 Ko
      svchost.exe 1284 Console 0 5ÿ812 Ko
      svchost.exe 1332 Console 0 21ÿ496 Ko
      svchost.exe 1460 Console 0 7ÿ112 Ko
      svchost.exe 1496 Console 0 4ÿ704 Ko
      spoolsv.exe 1788 Console 0 6ÿ604 Ko
      xdkthjc.exe 488 Console 0 4ÿ860 Ko
      explorer.exe 516 Console 0 36ÿ672 Ko
      svchost.exe 1548 Console 0 4ÿ172 Ko
      AppleMobileDeviceService. 1592 Console 0 2ÿ940 Ko
      mDNSResponder.exe 1604 Console 0 3ÿ792 Ko
      ehRecvr.exe 1652 Console 0 4ÿ332 Ko
      jqs.exe 1804 Console 0 1ÿ408 Ko
      nvsvc32.exe 1876 Console 0 3ÿ592 Ko
      HPZipm12.exe 1968 Console 0 1ÿ828 Ko
      svchost.exe 324 Console 0 5ÿ904 Ko
      Pen_Tablet.exe 540 Console 0 3ÿ120 Ko
      Pen_TabletUser.exe 1368 Console 0 2ÿ576 Ko
      alg.exe 2068 Console 0 3ÿ728 Ko
      wmiapsrv.exe 2316 Console 0 4ÿ612 Ko
      svchost.exe 3876 Console 0 10ÿ288 Ko
      TSVNCache.exe 1816 Console 0 6ÿ992 Ko
      ehtray.exe 2992 Console 0 1ÿ964 Ko
      VCUServe.exe 3176 Console 0 3ÿ944 Ko
      AppMonUtility.exe 3228 Console 0 4ÿ020 Ko
      ehmsas.exe 3124 Console 0 2ÿ824 Ko
      GrooveMonitor.exe 3332 Console 0 4ÿ996 Ko
      acrotray.exe 3348 Console 0 2ÿ896 Ko
      iTunesHelper.exe 584 Console 0 9ÿ828 Ko
      ctfmon.exe 3464 Console 0 4ÿ132 Ko
      btdna.exe 3448 Console 0 8ÿ332 Ko
      ehSched.exe 868 Console 0 4ÿ748 Ko
      SYSDLL.exe 3476 Console 0 10ÿ076 Ko
      dllhost.exe 3904 Console 0 6ÿ300 Ko
      iPodService.exe 1624 Console 0 4ÿ212 Ko
      hkserv .exe 480 Console 0 14ÿ592 Ko
      pwrisovm .exe 2252 Console 0 2ÿ724 Ko
      HKWnd.exe 2484 Console 0 4ÿ404 Ko
      iexplore.exe 3760 Console 0 93ÿ924 Ko
      firefox.exe 4072 Console 0 221ÿ156 Ko
      ctv6856.exe 2832 Console 0 12ÿ872 Ko
      SpybotSD.exe 2140 Console 0 70ÿ332 Ko
      googletalkplugin.exe 2516 Console 0 6ÿ356 Ko
      rstrui.exe 2580 Console 0 21ÿ476 Ko
      Photoshop.exe 4080 Console 0 80ÿ560 Ko
      Adobelm_Cleanup.0001 3396 Console 0 2ÿ004 Ko
      Adobelmsvc.exe 1144 Console 0 1ÿ284 Ko
      Adobelm_Cleanup.0001 2844 Console 0 2ÿ008 Ko
      List_Killem.exe 3936 Console 0 4ÿ980 Ko
      cmd.exe 3008 Console 0 1ÿ792 Ko
      wmiprvse.exe 1660 Console 0 8ÿ276 Ko
      wmiprvse.exe 3488 Console 0 4ÿ944 Ko
      tasklist.exe 3604 Console 0 4ÿ592 Ko

      Infections :
      ==========


      ¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

      "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
      "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
      "C:\WINDOWS\9g2234wesdf3dfgjf23"
      "C:\WINDOWS\System32\prnjobs.vbs"
      "C:\WINDOWS\System32\SYSDLL.exe"
      "C:\WINDOWS\system32\sysloc"
      C:\Documents and Settings\user\LOCAL Settings\Temp\a .exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\ctv254407.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\ctv255328.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\ctv6856.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\ctv96.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\llehskzk.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\rsyncini.exe

      ¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

      HKCU\SOFTWARE\XML
      HKCU\SOFTWARE\XML
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

      ¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

      99139.EXE-074064AC.pf
      A.EXE-2F9C5E53.pf
      ACROBAT.EXE-3A2333BF.pf
      ACROBATINFO.EXE-363A65B6.pf
      ADOBELMSVC.EXE-004A961E.pf
      ADOBELM_CLEANUP.0001-3606633F.pf
      ADVCHECK163.EXE-33F34E45.pf
      ADVCHECK163.TMP-1E6C35F4.pf
      ALG.EXE-0F138680.pf
      APPLEMOBILEBACKUP.EXE-0C747D1B.pf
      APPLEMOBILEDEVICEHELPER.EXE-26E2CD91.pf
      APPLEMOBILESYNC.EXE-12A767F4.pf
      APPLESYNCNOTIFIER .EXE-2A55C75C.pf
      APPLESYNCNOTIFIER.EXE-38620255.pf
      APPMONUTILITY.EXE-03C01741.pf
      BITTORRENT.EXE-15EBE065.pf
      CALC.EXE-02CD573A.pf
      CMD.EXE-087B4001.pf
      CTFMON.EXE-0E17969B.pf
      CTV254407.EXE-3A2CE151.pf
      CTV255328.EXE-369757E5.pf
      CTV96.EXE-30C86A41.pf
      DEFRAG.EXE-273F131E.pf
      DFRGNTFS.EXE-269967DF.pf
      DISTNOTED.EXE-02950815.pf
      DLLHOST.EXE-205D880D.pf
      DREAMWEAVER.EXE-1582BAEF.pf
      DRWTSN32.EXE-2B4B52AC.pf
      DWWIN.EXE-30875ADC.pf
      EHMSAS.EXE-181DA6C9.pf
      EHTRAY.EXE-02EFC9BD.pf
      EXCEL.EXE-34CB65E9.pf
      EXPLORER.EXE-082F38A9.pf
      FILEZILLA.EXE-1C946DD3.pf
      FIREFOX.EXE-28641590.pf
      FLASH.EXE-37E9D395.pf
      FZSFTP.EXE-06BCC64F.pf
      GCONSYNC.EXE-390634EA.pf
      GOOGLECRASHHANDLER.EXE-293D67F6.pf
      GOOGLETALKPLUGIN.EXE-142679DD.pf
      GOOGLEUPDATE.EXE-14065D1A.pf
      HELPSVC.EXE-2878DDA2.pf
      HIPWH.EXE-192977EC.pf
      HKSERV.EXE-0AC3D4EF.pf
      HKWND.EXE-04EDED55.pf
      HOMEPLAYER .EXE-0000F2EB.pf
      HOMEPLAYER.EXE-20861817.pf
      IEXPLORE.EXE-1C6988B1.pf
      IEXPLORE.EXE-27122324.pf
      ILLUSTRATOR.EXE-06A07E3D.pf
      IMAPI.EXE-0BF740A4.pf
      IMIDYPWK.EXE-339CB793.pf
      IPODSERVICE.EXE-3192DE38.pf
      ITUNES.EXE-1A268432.pf
      JAVA.EXE-0C263507.pf
      JQSNOTIFY.EXE-24AE4A36.pf
      JUCHECK.EXE-395165C8.pf
      KEYGEN.SOTHINK.SWF.DECOMPILER-1A0020E4.pf
      LANGUAGE.EXE-1E09AFC0.pf
      Layout.ini
      LLEHSKZK.EXE-0C4B712D.pf
      LOGONUI.EXE-0AF22957.pf
      MDCRASHREPORTTOOL.EXE-0292A659.pf
      NCTZELSZ.EXE-29765E06.pf
      NETSH.EXE-085CFFDE.pf
      NOTEPAD.EXE-336351A9.pf
      NTOSBOOT-B00DFAAD.pf
      NVFUYAPQ.EXE-084C2322.pf
      OJBIANGR.EXE-15CBCD72.pf
      OUTLOOKSYNCCLIENT.EXE-02991846.pf
      PEN_TABLET.EXE-103B76A7.pf
      PEN_TABLETUSER.EXE-210D7C89.pf
      PHOTOSHOP.EXE-0234D846.pf
      PING.EXE-31216D26.pf
      POWERPNT.EXE-364EC56A.pf
      PWRISOVM .EXE-1D575D10.pf
      PWRISOVM.EXE-395F826A.pf
      QGCC8BJ0EE8L.EXE-0C922684.pf
      QMMTLYLG.EXE-263F944C.pf
      REG.EXE-0D2A95F7.pf
      REGSVR32.EXE-25EEFE2F.pf
      RSYNCINI.EXE-1AA014FC.pf
      RUNDLL32.EXE-12E27DD0.pf
      RUNDLL32.EXE-146BD721.pf
      RUNDLL32.EXE-14974A31.pf
      RUNDLL32.EXE-14D3EA3E.pf
      RUNDLL32.EXE-15ADBFE9.pf
      RUNDLL32.EXE-1653F402.pf
      RUNDLL32.EXE-1857459C.pf
      RUNDLL32.EXE-1A0CEA1E.pf
      RUNDLL32.EXE-1AAB5978.pf
      RUNDLL32.EXE-207F431D.pf
      RUNDLL32.EXE-2AA5910E.pf
      RUNDLL32.EXE-31610E45.pf
      RUNDLL32.EXE-320D5138.pf
      RUNDLL32.EXE-35A483DA.pf
      RUNDLL32.EXE-3A9AF677.pf
      RUNDLL32.EXE-3F0E4CDC.pf
      RUNDLL32.EXE-3FFD1DD2.pf
      RUNDLL32.EXE-40F9F999.pf
      RUNDLL32.EXE-415F88EC.pf
      RUNDLL32.EXE-451FC2C0.pf
      RUNDLL32.EXE-46D5CD60.pf
      RUNDLL32.EXE-4ABAF25B.pf
      SAFLASHPLAYER.EXE-3800FC0A.pf
      SDFILES.EXE-2F004719.pf
      SDUPDATE.EXE-00420EF0.pf
      SERIAL.SOTHINK.SWF.DECOMPILER-2094E6B1.pf
      SETUP.EXE-1EFFC3EF.pf
      SETUP.TMP-1C1EBF78.pf
      SOFTWAREUPDATE.EXE-1415D1B8.pf
      SPYBOTSD.EXE-1344276B.pf
      SVCHOST.EXE-3530F672.pf
      SWFDECOMPILER.EXE-2CD5B796.pf
      SYNCSERVER.EXE-2A76C6C1.pf
      SYSDLL.EXE-367899DA.pf
      TASKMGR.EXE-20256C55.pf
      TSVNCACHE.EXE-2D798823.pf
      UPDATE.EXE-131667C7.pf
      USERINIT.EXE-30B18140.pf
      VCUSERVE.EXE-3A994003.pf
      VERCLSID.EXE-3667BD89.pf
      VLC.EXE-22DF01AA.pf
      VOLIKC.EXE-11491E15.pf
      WIAACMGR.EXE-212ED878.pf
      WINRAR.EXE-39C6DAD9.pf
      WINWORD.EXE-07381162.pf
      WMIAPSRV.EXE-1E2270A5.pf
      WMIPRVSE.EXE-28F301A9.pf
      YAHOOSYNC.EXE-1F77D9C6.pf




      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤


      Alors, c'est grave ?? :'(
      0
  2. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Je ne pourrais pas encore te le dire x)

    Fait ceci maintenant :

    [x] Relance List&Kill'em mais choisis cette fois ci l'option n°2 ( Destruction )

    [x] Ne fais rien pendant le nettoyage

    [x] Copie/Colle le rapport qui s'ouvrira dans ton prochain message ( Si jamais tu le fermes
    sans faire exprès, il se trouve sous C:\Kill'em.txt
    0
    1. dekaki
       
      Alors en fait en faisant cela il m'a dit que certains fichiers nécessaires au bon fonctionnement de windows allait être supprimées, et comme avec l'ordi que j'ai je n'ai pas de CD d'install (ne me demande pas pourquoi, c'est hallucinant, heureusement que j'ai ma clé W XP collé au dos de l'ordi...).

      Après, il m'étais impossible de te répondre tellement l'ordi ramait...

      Bref j'ai fait une restauration systeme a une date antérieure (hier soir), et la ca marche nickel mais peut-être aussi est-ce grace a toi :)

      Voila donc le rapport :

      Kill'em by g3n-h@ckm@n 1.0.2.8

      updated on 23.08.2009 ::::: 13.00


      Microsoft Windows XP [version 5.1.2600]


      28/08/2009 23:28:11,56

      Fichiers analysés :
      =================


      ¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

      "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"
      "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"
      "C:\WINDOWS\9g2234wesdf3dfgjf23"
      "C:\WINDOWS\System32\prnjobs.vbs"
      "C:\WINDOWS\System32\SYSDLL.exe"
      "C:\WINDOWS\system32\sysloc"
      C:\Documents and Settings\user\LOCAL Settings\Temp\a .exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\ctv254407.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\ctv255328.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\ctv6856.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\ctv96.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\llehskzk.exe
      C:\Documents and Settings\user\LOCAL Settings\Temp\rsyncini.exe


      ¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers :

      Quarantaine :

      9g2234wesdf3dfgjf23.Kill'em
      a .exe.Kill'em
      ctv254407.exe.Kill'em
      ctv255328.exe.Kill'em
      ctv6856.exe.Kill'em
      ctv96.exe.Kill'em
      llehskzk.exe.Kill'em
      prnjobs.vbs.Kill'em
      qmgr0.dat.Kill'em
      qmgr1.dat.Kill'em
      rsyncini.exe.Kill'em
      SYSDLL.exe.Kill'em
      sysloc.Kill'em

      ¤¤¤¤¤¤¤¤¤¤ Verification :



      Infections :
      ==========


      ¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :


      ¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

      HKCU\SOFTWARE\XML
      HKCU\SOFTWARE\XML
      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

      ¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

      Layout.ini
      NTOSBOOT-B00DFAAD.pf




      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤


      Je suis guérie docteur ???
      0
  3. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Non, pas tout à fait vu que tu as fait une restauration système et qu'elle était peut être " infectée "

    peux-tu refaire l'option 1 de list&kill'em ? et poster le rapport.
    0
    1. dekaki
       
      Et voila !

      List'em by g3n-h@ckm@n 1.0.2.8

      updated on 23.08.2009 ::::: 13.00


      Microsoft Windows XP [version 5.1.2600]


      29/08/2009 0:31:09,39


      Nom de l'h“te: KAKIORDI
      Nom du systŠme d'exploitation: Microsoft Windows XP Professionnel
      Version du systŠme: 5.1.2600 Service Pack 3 version 2600
      Fabricant du systŠme d'exploitation: Microsoft Corporation
      Configuration du systŠme d'exploitation: Station de travail autonome
      Type de version du systŠme d'exploitation: Multiprocessor Free
      Propri‚taire enregistr‚ÿ: user
      Organisation enregistr‚eÿ:
      Identificateur de produit: 76413-OEM-0082103-49254
      Date d'installation originale: 04/12/2008, 10:04:52
      Dur‚e d'activit‚ systŠme: 0 jours, 0 heures, 52 minutes, 56 secondes
      Fabricant du systŠme: Sony Corporation
      ModŠle du systŠme: VGC-LA1
      Type du systŠme: X86-based PC
      Processeur(s): 1 processeur(s) install‚(s).
      [01]: x86 Family 6 Model 15 Stepping 6 GenuineIntel ~1828 MHz
      Version du BIOS: SONY - 20060814
      R‚pertoire Windows: C:\WINDOWS
      R‚pertoire systŠme: C:\WINDOWS\system32
      P‚riph‚rique d'amor‡age: \Device\HarddiskVolume1
      Option r‚gionale du systŠme: fr;Fran‡ais (France)
      ParamŠtres r‚gionaux d'entr‚eÿ: fr;Fran‡ais (France)
      Fuseau horaire: N/D
      M‚moire physique totale: 3ÿ070 Mo
      M‚moire physique disponible: 2ÿ375 Mo
      M‚moire virtuelle : taille maximale: 2ÿ048 Mo
      M‚moire virtuelle : disponible: 2ÿ008 Mo
      M‚moire virtuelle : en cours d'utilisation: 40 Mo
      Emplacements des fichiers d'‚change: C:\pagefile.sys
      Domaine: KAKIREZO
      Serveur d'ouverture de session: \\KAKIORDI
      Correctif(s): 95 Corrections install‚es.
      [01]: File 1
      [02]: File 1
      [03]: File 1
      [04]: File 1
      [05]: File 1
      [06]: File 1
      [07]: File 1
      [08]: File 1
      [09]: File 1
      [10]: File 1
      [11]: File 1
      [12]: File 1
      [13]: File 1
      [14]: File 1
      [15]: File 1
      [16]: File 1
      [17]: File 1
      [18]: File 1
      [19]: File 1
      [20]: File 1
      [21]: File 1
      [22]: File 1
      [23]: File 1
      [24]: File 1
      [25]: File 1
      [26]: File 1
      [27]: File 1
      [28]: File 1
      [29]: File 1
      [30]: File 1
      [31]: File 1
      [32]: File 1
      [33]: File 1
      [34]: File 1
      [35]: File 1
      [36]: File 1
      [37]: File 1
      [38]: File 1
      [39]: File 1
      [40]: File 1
      [41]: File 1
      [42]: File 1
      [43]: File 1
      [44]: Q147222
      [45]: SP3 - SP
      [46]: Q954430
      [47]: IDNMitigationAPIs - Update
      [48]: NLSDownlevelMapping - Update
      [49]: KB952069_WM9
      [50]: KB936782_WMP10
      [51]: KB923689
      [52]: KB941569
      [53]: KB938127-v2-IE7 - Update
      [54]: KB956390-IE7 - Update
      [55]: KB958215-IE7 - Update
      [56]: KB960714-IE7 - Update
      [57]: KB961260-IE7 - Update
      [58]: KB963027-IE7 - Update
      [59]: KB936929 - Service Pack
      [60]: KB923561 - Update
      [61]: KB938464 - Update
      [62]: KB946648 - Update
      [63]: KB950762 - Update
      [64]: KB950974 - Update
      [65]: KB951066 - Update
      [66]: KB951072-v2 - Update
      [67]: KB951376-v2 - Update
      [68]: KB951698 - Update
      [69]: KB951748 - Update
      [70]: KB951978 - Update
      [71]: KB952004 - Update
      [72]: KB952287 - Update
      [73]: KB952954 - Update
      [74]: KB954211 - Update
      [75]: KB954459 - Update
      [76]: KB954600 - Update
      [77]: KB955069 - Update
      [78]: KB955839 - Update
      [79]: KB956390 - Update
      [80]: KB956391 - Update
      [81]: KB956572 - Update
      [82]: KB956802 - Update
      [83]: KB956803 - Update
      [84]: KB956841 - Update
      [85]: KB957095 - Update
      [86]: KB957097 - Update
      [87]: KB958644 - Update
      [88]: KB958687 - Update
      [89]: KB958690 - Update
      [90]: KB959426 - Update
      [91]: KB960225 - Update
      [92]: KB960715 - Update
      [93]: KB960803 - Update
      [94]: KB961373 - Update
      [95]: KB967715 - Update
      Carte(s) r‚seau: 3 carte(s) r‚seau install‚e(s).
      [01]: Carte r‚seau 1394
      Nom de la connexion : Connexion 1394
      DHCP activ‚ : Oui
      Serveur DHCP : N/D
      Adresse(s) IP
      [02]: LAN-Express BCM 802.11g PCI-E Adapter
      Nom de la connexion : Connexion r‚seau sans fil
      DHCP activ‚ : Oui
      Serveur DHCP : 192.168.0.254
      Adresse(s) IP
      [01] : 192.168.0.11
      [03]: Marvell Yukon 88E8036 PCI-E Fast Ethernet Controller
      Nom de la connexion : Connexion au r‚seau local 3
      tat : Support d‚connect‚

      Nom de l'image PIDÿ Nom de la sessio Num‚ro d Utilisation
      ========================= ====== ================ ======== ============
      System Idle Process 0 Console 0 28 Ko
      System 4 Console 0 236 Ko
      smss.exe 888 Console 0 408 Ko
      csrss.exe 940 Console 0 4ÿ372 Ko
      winlogon.exe 968 Console 0 1ÿ452 Ko
      services.exe 1012 Console 0 3ÿ568 Ko
      lsass.exe 1024 Console 0 1ÿ764 Ko
      svchost.exe 1192 Console 0 5ÿ228 Ko
      svchost.exe 1260 Console 0 4ÿ792 Ko
      svchost.exe 1304 Console 0 20ÿ844 Ko
      svchost.exe 1404 Console 0 6ÿ140 Ko
      svchost.exe 1464 Console 0 3ÿ924 Ko
      spoolsv.exe 1796 Console 0 5ÿ908 Ko
      explorer.exe 368 Console 0 42ÿ056 Ko
      svchost.exe 652 Console 0 3ÿ476 Ko
      AppleMobileDeviceService. 692 Console 0 2ÿ752 Ko
      mDNSResponder.exe 704 Console 0 3ÿ684 Ko
      ehRecvr.exe 744 Console 0 4ÿ324 Ko
      ehSched.exe 684 Console 0 4ÿ764 Ko
      jqs.exe 908 Console 0 1ÿ388 Ko
      nvsvc32.exe 1336 Console 0 3ÿ588 Ko
      HPZipm12.exe 1396 Console 0 1ÿ828 Ko
      svchost.exe 1892 Console 0 4ÿ916 Ko
      Pen_Tablet.exe 1948 Console 0 3ÿ120 Ko
      Pen_TabletUser.exe 312 Console 0 2ÿ516 Ko
      Pen_Tablet.exe 460 Console 0 12ÿ692 Ko
      dllhost.exe 584 Console 0 6ÿ300 Ko
      alg.exe 1692 Console 0 3ÿ612 Ko
      wmiapsrv.exe 2212 Console 0 4ÿ612 Ko
      ctfmon.exe 2332 Console 0 3ÿ876 Ko
      TSVNCache.exe 2516 Console 0 6ÿ912 Ko
      ehtray.exe 2604 Console 0 1ÿ260 Ko
      VCUServe.exe 2748 Console 0 3ÿ952 Ko
      AppMonUtility.exe 2796 Console 0 4ÿ004 Ko
      ehmsas.exe 2824 Console 0 2ÿ868 Ko
      HKServ.exe 2876 Console 0 14ÿ536 Ko
      jusched.exe 2912 Console 0 9ÿ980 Ko
      PWRISOVM.EXE 2944 Console 0 2ÿ684 Ko
      GrooveMonitor.exe 2980 Console 0 6ÿ008 Ko
      acrotray.exe 3024 Console 0 2ÿ908 Ko
      iTunesHelper.exe 3112 Console 0 9ÿ064 Ko
      HomePlayer.exe 3172 Console 0 38ÿ240 Ko
      btdna.exe 3184 Console 0 7ÿ856 Ko
      SYSDLL.exe 3260 Console 0 9ÿ104 Ko
      iPodService.exe 3724 Console 0 4ÿ140 Ko
      HKWnd.exe 3852 Console 0 4ÿ384 Ko
      firefox.exe 2200 Console 0 190ÿ056 Ko
      googletalkplugin.exe 2668 Console 0 6ÿ112 Ko
      jucheck.exe 268 Console 0 11ÿ944 Ko
      List_Killem.exe 3604 Console 0 4ÿ980 Ko
      cmd.exe 1244 Console 0 1ÿ792 Ko
      wmiprvse.exe 3104 Console 0 8ÿ212 Ko
      wmiprvse.exe 3276 Console 0 4ÿ928 Ko
      tasklist.exe 2020 Console 0 4ÿ576 Ko

      Infections :
      ==========


      ¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

      "C:\WINDOWS\System32\prnjobs.vbs"
      "C:\WINDOWS\System32\SYSDLL.exe"
      "C:\WINDOWS\system32\sysloc"

      ¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes :

      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

      ¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch :

      APPMONUTILITY.EXE-03C01741.pf
      CMD.EXE-087B4001.pf
      EHMSAS.EXE-181DA6C9.pf
      EHTRAY.EXE-02EFC9BD.pf
      FILEZILLA.EXE-1C946DD3.pf
      FIREFOX.EXE-28641590.pf
      GOOGLETALKPLUGIN.EXE-142679DD.pf
      GOOGLEUPDATE.EXE-14065D1A.pf
      HKSERV.EXE-0AC3D4EF.pf
      JAVA.EXE-0C263507.pf
      JQSNOTIFY.EXE-24AE4A36.pf
      JUCHECK.EXE-395165C8.pf
      JUSCHED.EXE-25206883.pf
      LANGUAGE.EXE-1E09AFC0.pf
      Layout.ini
      LIST_KILLEM.EXE-23B175E9.pf
      MODE.COM-31685BAE.pf
      NOTEPAD.EXE-336351A9.pf
      NTOSBOOT-B00DFAAD.pf
      PWRISOVM.EXE-395F826A.pf
      REG.EXE-0D2A95F7.pf
      RUNDLL32.EXE-12E27DD0.pf
      RUNDLL32.EXE-415F88EC.pf
      RUNDLL32.EXE-4750180E.pf
      SPYBOTSD.EXE-1344276B.pf
      SYSTEMINFO.EXE-32ED1FAB.pf
      TASKLIST.EXE-10D94B23.pf
      TASKMGR.EXE-20256C55.pf
      TSVNCACHE.EXE-2D798823.pf
      VCUSERVE.EXE-3A994003.pf
      VERCLSID.EXE-3667BD89.pf
      WMIPRVSE.EXE-28F301A9.pf




      ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
      0
  4. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Ok fait ceci :

    - Télécharge OTMoveIt (de Old_Timer) https://www.luanagames.com/index.fr.html sur ton Bureau.

    - Double-clique sur OTMoveIt.exe
    - Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
    - Copie le texte en gras ci dessous et colle le dans le cadre de gauche de OTMoveIt nommé Paste List of Files/Folders to be moved

    :processes
    explorer.exe

    :reg
    [-HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536]

    :files
    C:\WINDOWS\System32\prnjobs.vbs
    C:\WINDOWS\System32\SYSDLL.exe
    C:\WINDOWS\system32\sysloc

    :commands
    [emptytemp]
    [purity]
    [start explorer]


    - Clique sur MoveIt! pour lancer la suppression.
    - Si OTMoveIt propose de redémarrer ton PC, accepte.
    - Lorsque un résultat apparaît dans le cadre Results, clique sur Exit.
    - Dans ta future réponse, envoie le rapport de OTMoveIt situé sur C:\_OTMoveIt\MovedFiles
    0
    1. dekaki
       
      Mais c'est pas des fichiers systemes important ? Désolée j'y comprend pas grand chose, mais comme tout a l'heure j'ai eu un message de windows... C'est juste pour comprendre :)
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Ce sont des fichiers infectieux comme peut en témoigner un " extrait " de rapport malwarebyte's
    C:\Windows\System32\SYSDLL.exe (Worm.Koobface) -> Unloaded process successfully.

    Donc tu peux les supprimer sans craintes bien au contraire ;)
    0
    1. dekaki
       
      Ok :)

      Voilà le rapport :

      ========== PROCESSES ==========
      Process explorer.exe killed successfully.
      ========== REGISTRY ==========
      Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\U­serdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536­\\ not found.
      ========== FILES ==========
      C:\WINDOWS\System32\prnjobs.vbs moved successfully.
      C:\WINDOWS\System32\SYSDLL.exe moved successfully.
      C:\WINDOWS\system32\sysloc moved successfully.
      ========== COMMANDS ==========
      File delete failed. C:\DOCUME~1\user\LOCALS~1\Temp\hsperfdata_user\3172 scheduled to be deleted on reboot.
      File delete failed. C:\DOCUME~1\user\LOCALS~1\Temp\etilqs_UktuN1GaCuoBgBTgsmzH scheduled to be deleted on reboot.
      File delete failed. C:\DOCUME~1\user\LOCALS~1\Temp\Perflib_Perfdata_a6c.dat scheduled to be deleted on reboot.
      User's Temp folder emptied.
      User's Temporary Internet Files folder emptied.
      User's Internet Explorer cache folder emptied.
      Local Service Temp folder emptied.
      File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
      Local Service Temporary Internet Files folder emptied.
      File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_38c.dat scheduled to be deleted on reboot.
      Windows Temp folder emptied.
      Java cache emptied.
      File delete failed. C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
      File delete failed. C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\XUL.mfl scheduled to be deleted on reboot.
      FireFox cache emptied.
      Opera cache emptied.
      Temp folders emptied.
      Explorer started successfully

      OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 08292009_004757

      Files moved on Reboot...
      File C:\DOCUME~1\user\LOCALS~1\Temp\hsperfdata_user\3172 not found!
      File C:\DOCUME~1\user\LOCALS~1\Temp\etilqs_UktuN1GaCuoBgBTgsmzH not found!
      File C:\DOCUME~1\user\LOCALS~1\Temp\Perflib_Perfdata_a6c.dat not found!
      File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
      File C:\WINDOWS\temp\Perflib_Perfdata_38c.dat not found!
      C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\Cache\_CACHE_001_ moved successfully.
      C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\Cache\_CACHE_002_ moved successfully.
      C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\Cache\_CACHE_003_ moved successfully.
      C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\Cache\_CACHE_MAP_ moved successfully.
      C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\urlclassifier3.sqlite moved successfully.
      C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\9t57vw6i.default\XUL.mfl moved successfully.
      0
  7. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Ok parfait !

    Tu peux faire ceci maintenant : ( attention le scan est assez long sur certains PC 1h30/2h )

    Malwarebyte's anti-malware ----->

    [x] Télécharge Malwarebyte's anti-malware (MBAM) à cette adresse : http://www.malwarebytes.org/mbam/program/mbam-setup.exe

    [x] Installe le

    [x] N'oublie pas de le mettre à jour !

    [x] Fais un scan complet

    [x] Coche bien tout les éléments trouvés et supprime les !

    [x] Un tutoriel pour son utilisation est disponible ici : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    [x] Suis les indications données sur le lien précédent puis copie/colle le rapport généré dans ton prochain message

    Je te répondrais surement demain vu qu'il commence à se faire tard :p
    0
    1. dekaki
       
      En tout cas merci beaucoup !!!!!! Mon ordi a l'air de rouler plutôt pas mal là ;D
      Et si jamais un jour je peux t'aider sur du design ou de l'inté (ou du flash, mais light) n'hésite pas :)
      Bonne soirée !
      Carine
      0
  8. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    De rien ! Ce fut un plaisir de t'aider ;)

    Si jamais tu as un soucis tu sais ou poster.

    N'oublie pas de passer malwarebyte's demain et de poster le rapport histoire qu'on vire les restes.
    0
    1. dekaki
       
      Et voila le rapport ! (je n'ai pas pu faire la mise a jour, erreur 732 :-s j'ai cherché mais j'ai rien trouvé a ce propos)


      Malwarebytes' Anti-Malware 1.40
      Version de la base de données: 2551
      Windows 5.1.2600 Service Pack 3

      29/08/2009 02:05:28
      mbam-log-2009-08-29 (02-05-28).txt

      Type de recherche: Examen rapide
      Eléments examinés: 100459
      Temps écoulé: 3 minute(s), 51 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 13
      Valeur(s) du Registre infectée(s): 1
      Elément(s) de données du Registre infecté(s): 30
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 5

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.exe (Security.Hijack) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\ju495.ju495mgr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\ju495.ju495mgr.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdll (Worm.Autorun) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0f2a07d0-84c9-478e-afb9-004e75af0200}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{19180dd8-5c51-44ca-9e51-39a1a4e10533}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{19180dd8-5c51-44ca-9e51-39a1a4e10533}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7c279558-653a-4af1-8403-867deb1e1cc7}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7c279558-653a-4af1-8403-867deb1e1cc7}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9da36be0-edba-41b6-add6-3ec826e6202a}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9fe04551-da8c-4925-bfa8-5cf18c1719fd}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{a934a19a-c559-40e4-be3f-c80c8d87d93d}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{a934a19a-c559-40e4-be3f-c80c8d87d93d}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{0f2a07d0-84c9-478e-afb9-004e75af0200}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{19180dd8-5c51-44ca-9e51-39a1a4e10533}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{19180dd8-5c51-44ca-9e51-39a1a4e10533}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7c279558-653a-4af1-8403-867deb1e1cc7}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7c279558-653a-4af1-8403-867deb1e1cc7}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9da36be0-edba-41b6-add6-3ec826e6202a}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9fe04551-da8c-4925-bfa8-5cf18c1719fd}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{a934a19a-c559-40e4-be3f-c80c8d87d93d}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{a934a19a-c559-40e4-be3f-c80c8d87d93d}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{0f2a07d0-84c9-478e-afb9-004e75af0200}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{19180dd8-5c51-44ca-9e51-39a1a4e10533}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{19180dd8-5c51-44ca-9e51-39a1a4e10533}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{7c279558-653a-4af1-8403-867deb1e1cc7}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{7c279558-653a-4af1-8403-867deb1e1cc7}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{9da36be0-edba-41b6-add6-3ec826e6202a}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{9fe04551-da8c-4925-bfa8-5cf18c1719fd}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{a934a19a-c559-40e4-be3f-c80c8d87d93d}\DhcpNameServer (Trojan.DNSChanger) -> Data: 213.174.139.72 255.255.255.255 -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{a934a19a-c559-40e4-be3f-c80c8d87d93d}\NameServer (Trojan.DNSChanger) -> Data: 213.174.139.72,255.255.255.255 -> Quarantined and deleted successfully.

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\WINDOWS\system32\digiwet.dll (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\secupdat.dat (Backdoor.Bot) -> Quarantined and deleted successfully.
      C:\WINDOWS\sto452730.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
      C:\WINDOWS\sto452688.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
      C:\WINDOWS\sto453142.dat (Worm.KoobFace) -> Quarantined and deleted successfully.


      Merki ;D
      0
  9. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Ok, est ce que tu peux reposter un RSIT s'il te plait ?
    0
    1. dekaki
       
      Un quoi ?? :-s
      0
  10. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Oups désolé j'ai oublié de te mettre la manip'

    RSIT ----->

    [x] Télécharge Random's System Information Tool à cette adresse : http://images.malwareremoval.com/random/RSIT.exe

    [x] Double clique sur " RSIT.exe ".

    [x] Clique sur " Continue ".

    [x] Si hijackthis n'est pas présent il sera automatiquement téléchargé et tu devras accepter la license.

    [x] Une fois l'analyse finie, deux fichiers ( info.txt & log.txt ) s'ouvriront.

    [x] Copie colle le contenu des deux rapports dans ton prochain message

    -------> Si jamais tu as fermé les rapports sans faire attention, ils sont sous C:\rsit
    0
  11. dekaki
     
    Alors le premier :

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by user at 2009-08-29 13:39:02
    Microsoft Windows XP Professionnel Service Pack 3
    System drive C: has 65 GB (65%) free of 100 GB
    Total RAM: 3070 MB (49% free)

    HijackThis download failed

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-117609710-839522115-1003Core.job
    C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-117609710-839522115-1003UA.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
    Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
    Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-06 320920]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
    AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC7E636D-39AA-49b6-B511-65413DA137A1}]
    IE Developer Toolbar BHO - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll [2007-03-01 623992]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-06 34816]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
    JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-06 73728]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"=C:\WINDOWS\ehome\ehtray.exe [2004-08-10 59392]
    "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-12-04 7561216]
    "LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2006-04-13 49152]
    "VAIOCameraUtility"=C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe [2006-11-14 411768]
    "AppMon Utility"=C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe [2006-11-15 415864]
    "HKSERV.EXE"=C:\Program Files\Sony\HotKey Utility\HKserv.exe [2004-06-29 122880]
    "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-01-06 136600]
    "PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE [2008-11-02 167936]
    "AppleSyncNotifier"=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-05-13 177472]
    "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
    "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
    "Acrobat Assistant 7.0"=C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2004-12-14 483328]
    ""= []
    "QuickTime Task"=C:\Program Files\QuickTime Alternative\QTTask.exe [2009-05-26 413696]
    "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128]
    "HomePlayer"=C:\Program Files\HomePlayer\HomePlayer.exe [2007-11-06 294912]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
    "BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2008-12-19 342848]
    "Google Update"=C:\Documents and Settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-09 133104]

    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
    Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe
    Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digiwet.dll

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1
    "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=145

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "HonorAutoRunSetting"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll"="C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin"
    "C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
    "C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
    "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
    "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
    "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
    "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
    "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\Program Files\Spotify\spotify.exe"="C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify"
    "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
    "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
    "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
    "C:\Program Files\FileZilla\FileZilla.exe"="C:\Program Files\FileZilla\FileZilla.exe:*:Enabled:FileZilla"
    "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
    "C:\Program Files\HomePlayer\HomePlayer.exe"="C:\Program Files\HomePlayer\HomePlayer.exe:*:Enabled:HomePlayer"
    "C:\Program Files\HomePlayer\VLC\vlc.exe"="C:\Program Files\HomePlayer\VLC\vlc.exe:*:Enabled:VLC HomePlayer"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{189cabc6-1d5b-11de-9017-0013a94b2add}]
    shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97c60b8a-81a1-11de-9056-0016cf34f0d5}]
    shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

    ======File associations======

    .js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1"

    ======List of files/folders created in the last 1 months======

    2009-08-29 13:39:03 ----D---- C:\Program Files\trend micro
    2009-08-29 13:39:02 ----D---- C:\rsit
    2009-08-29 01:28:58 ----D---- C:\Documents and Settings\user\Application Data\Malwarebytes
    2009-08-29 01:28:54 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2009-08-29 01:28:53 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2009-08-29 00:47:57 ----D---- C:\_OTMoveIt
    2009-08-28 23:28:11 ----D---- C:\Kill'em
    2009-08-28 23:28:11 ----A---- C:\Kill'em.txt
    2009-08-28 23:22:07 ----A---- C:\List'em.txt
    2009-08-28 19:01:41 ----D---- C:\Program Files\Fichiers communs\SourceTec
    2009-08-28 19:01:39 ----D---- C:\Program Files\SourceTec
    2009-08-24 20:05:07 ----D---- C:\Documents and Settings\user\Application Data\vlc
    2009-08-08 19:43:17 ----D---- C:\Documents and Settings\user\Application Data\CyberLink
    2009-08-02 23:45:08 ----D---- C:\Program Files\Microsoft

    ======List of files/folders modified in the last 1 months======

    2009-08-29 13:39:03 ----RD---- C:\Program Files
    2009-08-29 13:34:34 ----D---- C:\Documents and Settings\user\Application Data\DNA
    2009-08-29 13:14:39 ----A---- C:\WINDOWS\ModemLog_HDAUDIO SoftV92 Data Fax Modem with SmartCP.txt
    2009-08-29 04:05:38 ----D---- C:\WINDOWS\Prefetch
    2009-08-29 03:54:00 ----A---- C:\WINDOWS\SchedLgU.Txt
    2009-08-29 02:11:30 ----D---- C:\Program Files\Mozilla Firefox
    2009-08-29 02:07:20 ----D---- C:\Documents and Settings\user\Application Data\WTablet
    2009-08-29 02:07:19 ----D---- C:\WINDOWS\Registration
    2009-08-29 02:07:19 ----AD---- C:\WINDOWS\Temp
    2009-08-29 02:07:12 ----D---- C:\WINDOWS
    2009-08-29 02:07:06 ----D---- C:\Program Files\DNA
    2009-08-29 02:06:26 ----D---- C:\WINDOWS\system32\drivers
    2009-08-29 02:05:28 ----D---- C:\WINDOWS\system32
    2009-08-29 00:48:07 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2009-08-29 00:47:57 ----D---- C:\WINDOWS\system32\CatRoot2
    2009-08-28 23:37:51 ----D---- C:\WINDOWS\system32\config
    2009-08-28 23:37:30 ----D---- C:\WINDOWS\system32\wbem
    2009-08-28 23:37:16 ----D---- C:\WINDOWS\ehome
    2009-08-28 23:37:16 ----D---- C:\Program Files\PowerISO
    2009-08-28 23:37:16 ----D---- C:\Program Files\HomePlayer
    2009-08-28 23:37:15 ----D---- C:\Program Files\Spybot - Search & Destroy
    2009-08-28 23:37:15 ----D---- C:\Program Files\Adobe
    2009-08-28 23:37:00 ----D---- C:\WINDOWS\system32\Restore
    2009-08-28 19:46:37 ----SD---- C:\WINDOWS\Tasks
    2009-08-28 19:01:41 ----D---- C:\Program Files\Fichiers communs
    2009-08-28 11:13:12 ----RSD---- C:\WINDOWS\Fonts
    2009-08-27 23:58:50 ----D---- C:\Documents and Settings\user\Application Data\BitTorrent
    2009-08-26 21:40:27 ----D---- C:\Program Files\MultipleIEs
    2009-08-26 21:10:25 ----D---- C:\Documents and Settings\user\Application Data\Adobe
    2009-08-26 18:29:43 ----A---- C:\WINDOWS\win.ini
    2009-08-24 17:19:06 ----D---- C:\Program Files\Flickr Uploadr
    2009-08-24 14:54:26 ----SHD---- C:\WINDOWS\Installer
    2009-08-24 14:54:25 ----HD---- C:\Config.Msi
    2009-08-24 14:54:25 ----D---- C:\Documents and Settings\user\Application Data\Mozilla

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 DMICall;Sony DMI Call service; C:\WINDOWS\system32\DRIVERS\DMICall.sys [2006-10-18 10216]
    R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
    R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
    R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2008-11-02 56572]
    R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2008-12-04 12544]
    R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
    R3 BCM43XX;LAN-Express BCM IEEE 802.11 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ExpbcmAG.sys [2006-05-16 428928]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
    R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
    R3 HidIr;Pilote HID infrarouge Microsoft; C:\WINDOWS\system32\DRIVERS\hidir.sys [2008-04-13 19200]
    R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2008-12-04 998656]
    R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2008-12-04 202112]
    R3 IrBus;Pilote de filtre de bus infrarouge pour les contrôles distants eHome; C:\WINDOWS\system32\DRIVERS\IrBus.sys [2008-04-13 46592]
    R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
    R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
    R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-12-04 3662400]
    R3 SNC;Périphérique de contrôle d'ordinateur portable Sony; C:\WINDOWS\system32\DRIVERS\SonyNC.sys [2001-08-17 20752]
    R3 SonyImgF;Sony Image Conversion Filter Driver; C:\WINDOWS\system32\DRIVERS\SonyImgF.sys [2008-12-04 30976]
    R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2008-12-04 1177032]
    R3 ti21sony;ti21sony; C:\WINDOWS\system32\drivers\ti21sony.sys [2008-12-04 807424]
    R3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-06-05 39424]
    R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
    R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
    R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    R3 usbvm321;Sony Visual Communication Camera VGP-VCC1; C:\WINDOWS\System32\Drivers\usbvm321.sys [2008-12-04 234496]
    R3 wacommousefilter;Wacom Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
    R3 wacomvhid;Wacom Virtual Hid Driver; C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2008-08-18 13352]
    R3 WacomVKHid;Virtual Keyboard Driver; C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys [2007-02-15 11440]
    R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2008-12-04 721280]
    R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2008-12-04 243328]
    S3 AVerM115S;AVerM115S service; C:\WINDOWS\system32\DRIVERS\AVerM115S.sys [2006-06-14 745600]
    S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\ax88772.sys [2006-09-06 19072]
    S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
    S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
    S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
    S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
    S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
    S3 MHNDRV;Pilote MHN; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
    S3 MPE;Filtre BDA MPE; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
    S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
    S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
    S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
    S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
    S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
    S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
    S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
    S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
    S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
    S3 wacmoumonitor;Wacom Mode Helper; C:\WINDOWS\system32\DRIVERS\wacmoumonitor.sys [2008-10-06 15656]
    S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-06-05 144712]
    R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
    R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2004-08-10 194560]
    R2 ehSched;Service de planification Media Center; C:\WINDOWS\eHome\ehSched.exe [2004-08-10 103424]
    R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-06 152984]
    R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-12-04 143428]
    R2 TabletServicePen;TabletServicePen; C:\WINDOWS\system32\Pen_Tablet.exe [2008-12-11 2749736]
    R3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-12-09 72704]
    R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
    S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-01 136120]
    S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
    S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2008-11-17 195752]
    S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
    S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
    S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
    S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-10 38912]

    -----------------EOF-----------------

    Et le deuxieme :

    info.txt logfile of random's system information tool 1.06 2009-08-29 13:39:06

    ======Uninstall list======

    -->msiexec /I {236BB7C4-4419-42FD-040C-1E257A25E34D}
    -->msiexec /I {B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}
    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Adobe Acrobat 7.0 Professional-->msiexec /I {AC76BA86-1033-0000-7760-100000000002}
    Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000101}
    Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5101}
    Adobe Creative Suite 2-->C:\PROGRA~1\INSTAL~1\{0134A~1\setup.exe /relaunched/rootloc=e:\appz\exc\adobe creative suite 2.0/lang=040c
    Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
    Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-119F-4D52-B551-6739B2B22101}
    Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
    Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-0C40-4930-9AFE-113BCE553101}
    Adobe SVG Viewer 3.0-->C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log
    Analyseur et SDK MSXML 4.0 SP2-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
    Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    AppMon Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8C44C027-7B9F-46F1-8FD8-5767403A7CA5}\setup.exe" -l0x40c -removeonly
    ASIX AX88772 WinXP_2K 32Bit Driver-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{3C6BD212-5680-4758-83ED-21171BCCBEB7}
    Axure RP Pro 5-->"C:\Documents and Settings\All Users\Application Data\{EA6AF74E-BDCD-4FE5-BAB2-F6BF858C5B6A}\AxureRP.exe" REMOVE=TRUE MODIFY=FALSE
    Axure RP Pro 5-->C:\Documents and Settings\All Users\Application Data\{EA6AF74E-BDCD-4FE5-BAB2-F6BF858C5B6A}\AxureRP.exe
    Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
    Broadcom Driver v4.150.22.0_Foxconn Installation Program-->C:\Program Files\InstallShield Installation Information\{88410D8F-8529-492B-B556-2394A29B811B}\setup.exe -runfromtemp -l0x0009 -removeonly
    Comptes@Jour-->"C:\Program Files\InstallShield Installation Information\{1C274306-FF04-47B0-9A1C-BC2180F8D37E}\setup.exe" -runfromtemp -l0x040c -removeonly
    Comptes@Jour-->MsiExec.exe /I{1C274306-FF04-47B0-9A1C-BC2180F8D37E}
    Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
    CrossFont version 5.1-->"C:\Program Files\CrossFnt\unins000.exe"
    EasyPHP 2.0b1-->"C:\Program Files\EasyPHP\unins000.exe"
    FileZilla (remove only)-->"C:\Program Files\FileZilla\uninstall.exe"
    Flickr Uploadr 3.0.5-->"C:\Program Files\Flickr Uploadr\uninstall.exe"
    Google Talk Plugin-->MsiExec.exe /I{BBC783B7-8725-3B1C-B49A-BA7F09391251}
    HDAUDIO SoftV92 Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_20030003\HXFSETUP.EXE -U -ISnyHDANk.inf
    High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
    HijackThis 2.0.2-->"C:\Program Files\HJT\HijackThis.exe" /uninstall
    HomePlayer 1.5.8a-->C:\Program Files\HomePlayer\uninst.exe
    HotKey Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B36C3DFD-BAB0-4513-BD27-FA4906A738FD}\Setup.exe"
    HotKey Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BB311F54-39D6-4A03-8E18-053D1B2833D7}\Setup.exe" -l0x40c
    HP Photosmart, Officejet and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{3A316611-45D1-429C-AA26-B71259C44689}\setup\hpzscr01.exe -datfile hposcr11.dat
    Internet Explorer Developer Toolbar-->MsiExec.exe /I{E7081891-BC7F-43F9-9CE6-B5DD2F497156}
    iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}
    Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
    K-Lite Codec Pack 3.3.0 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
    LAN-Express AS IEEE 802.11 Wireless LAN-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FCCB0B43-7A6D-49A4-A5B3-B10F592F4EB6}\setup.exe" -l0x40c -removeonly
    LAN-Express BCM IEEE 802.11 Wireless LAN-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{75B6A48E-985D-4195-B8F9-E41D3F7CCC99}\setup.exe" -l0x40c -removeonly
    Ma-Config.com-->MsiExec.exe /X{3A4EE7A4-356E-43B7-A4A3-9C55B22A05B3}
    Macromedia Dreamweaver 8-->MsiExec.exe /I{5FD788ED-1A37-4496-9BDD-463F493B27FA}
    Macromedia Extension Manager-->MsiExec.exe /I{3C8C9FB3-5FDF-40B4-B314-EAD722728C76}
    Macromedia Flash 8 Video Encoder-->MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
    Macromedia Flash 8-->MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
    Macromedia Flash Player 8-->MsiExec.exe /X{885A63EA-382B-4DD4-A755-14809B8557D6}
    Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
    Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
    Microsoft Flight Simulator X-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{9527A496-5DF9-412A-ADC7-168BA5379CA6}
    Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
    Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
    Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
    Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
    Microsoft Office Enterprise 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
    Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
    Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
    Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
    Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
    Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
    Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
    Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
    Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
    Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
    Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
    Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
    Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
    Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
    Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
    Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
    Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
    MobileMe Control Panel-->MsiExec.exe /I{DDBB28C8-B2AA-45A1-8DCE-059A798509FB}
    Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    MultipleIEs-->"C:\Program Files\MultipleIEs\unins000.exe"
    Notepad++-->C:\Program Files\Notepad++\uninstall.exe
    NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
    OpenOffice.org 2.2-->MsiExec.exe /I{419805D6-75A0-4981-BC8F-9FF97EC6B03A}
    Opera 9.64-->MsiExec.exe /X{E1BBBAC5-2857-4155-82A6-54492CE88620}
    Pen Tablet-->C:\Program Files\Tablet\Pen\Remove.exe /u
    Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
    PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
    PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
    QuickTime Alternative 1.81-->"C:\Program Files\QuickTime Alternative\unins000.exe"
    QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
    Real Alternative 1.52-->"C:\Program Files\Real Alternative\unins000.exe"
    Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
    Safari-->MsiExec.exe /I{2D6ED011-055B-4041-B198-BB903827EBFB}
    Setting Utility Series-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59452470-A902-477F-9338-9B88101681BD}\setup.exe" -l0x40c UNINSTALL -removeonly
    SigmaTel Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x40c -remove -removeonly
    Sony Utilities DLL-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EF3D45BB-2260-4008-88EA-492E7744A9DF}\setup.exe" -l0x9 -removeonly
    Sony Video Shared Library-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}\setup.exe" -l0x40c -removeonly
    Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
    Spotify-->"C:\Program Files\Spotify\uninstall.exe"
    Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
    Suite Specific-->MsiExec.exe /I{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}
    TortoiseSVN 1.5.7.15182 (32 bit)-->MsiExec.exe /X{27968397-2FC3-4D79-BD5D-E6AC44A263FE}
    Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
    Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
    VAIO Camera Capture Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6D2576EC-A0E9-418A-A09A-409933A3B6F4}\setup.exe" -l0x40c -removeonly
    VAIO Camera Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1417F599-1DBD-4499-9375-B2813E9F890C}\setup.exe" -l0x40c -removeonly
    VAIO Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FC37C108-821D-4EDE-8F40-D5B497586805}\setup.exe" -l0x40c -removeonly
    VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
    Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
    Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
    Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
    WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

    ======Hosts File======

    127.0.0.1 www.007guard.com
    127.0.0.1 007guard.com
    127.0.0.1 008i.com
    127.0.0.1 www.008k.com
    127.0.0.1 008k.com
    127.0.0.1 www.00hq.com
    127.0.0.1 00hq.com
    127.0.0.1 010402.com
    127.0.0.1 www.032439.com
    127.0.0.1 032439.com

    ======System event log======

    Computer Name: KAKIORDI
    Event Code: 7035
    Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

    Record Number: 5835
    Source Name: Service Control Manager
    Time Written: 20090623152336.000000+120
    Event Type: Informations
    User: AUTORITE NT\SYSTEM

    Computer Name: KAKIORDI
    Event Code: 51
    Message: Une erreur a été détectée sur le périphérique \Device\Harddisk3\D au cours d'une opération de pagination.

    Record Number: 5834
    Source Name: Disk
    Time Written: 20090623145049.000000+120
    Event Type: Avertissement
    User:

    Computer Name: KAKIORDI
    Event Code: 51
    Message: Une erreur a été détectée sur le périphérique \Device\Harddisk3\D au cours d'une opération de pagination.

    Record Number: 5833
    Source Name: Disk
    Time Written: 20090623145048.000000+120
    Event Type: Avertissement
    User:

    Computer Name: KAKIORDI
    Event Code: 51
    Message: Une erreur a été détectée sur le périphérique \Device\Harddisk3\D au cours d'une opération de pagination.

    Record Number: 5832
    Source Name: Disk
    Time Written: 20090623145041.000000+120
    Event Type: Avertissement
    User:

    Computer Name: KAKIORDI
    Event Code: 35
    Message: Le service de temps synchronise maintenant l'heure système avec la
    source de temps time.windows.com (ntp.m|0x1|192.168.0.11:123->207.46.232.182:123).

    Record Number: 5831
    Source Name: W32Time
    Time Written: 20090623144230.000000+120
    Event Type: Informations
    User:

    =====Application event log=====

    Computer Name: USER-312AAA333B
    Event Code: 1
    Message:
    Record Number: 246
    Source Name: Bonjour Service
    Time Written: 20090126142010.000000+060
    Event Type: Informations
    User:

    Computer Name: USER-312AAA333B
    Event Code: 1517
    Message: Windows a sauvegardé le Registre utilisateur USER-312AAA333B\user alors qu'une application ou un service utilisait toujours le Registre pendant la fermeture de la session. La mémoire utilisée par le Registre de l'utilisateur n'a pas été libérée. le Registre sera déchargé lorsqu'il ne sera plus utilisé.

    Cela est souvent causé par des services s'exécutant en tant que compte d'utilisateur, essayez de configurer les services pour s'exécuter dans le compte service réseau ou service local.

    Record Number: 245
    Source Name: Userenv
    Time Written: 20090126141848.000000+060
    Event Type: Avertissement
    User: AUTORITE NT\SYSTEM

    Computer Name: USER-312AAA333B
    Event Code: 4097
    Message: L'application, C:\Program Files\Macromedia\Dreamweaver 8\Dreamweaver.exe, a généré une erreur d'application
    L'erreur s'est produite le 01/26/2009 à 13:50:24.328
    L'exception générée était c0000005 à l'adresse 08BEE6B9 (<nosymbols>)

    Record Number: 244
    Source Name: DrWatson
    Time Written: 20090126135024.000000+060
    Event Type: Informations
    User:

    Computer Name: USER-312AAA333B
    Event Code: 4097
    Message: L'application, C:\Program Files\Macromedia\Dreamweaver 8\Dreamweaver.exe, a généré une erreur d'application
    L'erreur s'est produite le 01/26/2009 à 13:48:00.281
    L'exception générée était c000001d à l'adresse 05243D89 (<nosymbols>)

    Record Number: 243
    Source Name: DrWatson
    Time Written: 20090126134800.000000+060
    Event Type: Informations
    User:

    Computer Name: USER-312AAA333B
    Event Code: 1000
    Message: Application défaillante vlc.exe, version 0.8.6.0, module défaillant libvlc.dll, version 0.0.0.0, adresse de défaillance 0x0009c98a.

    Record Number: 242
    Source Name: Application Error
    Time Written: 20090125211233.000000+060
    Event Type: erreur
    User:

    ======Environment variables======

    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Adobe\AGL;C:\Program Files\TortoiseSVN\bin;C:\Program Files\QuickTime Alternative\QTSystem\
    "windir"=%SystemRoot%
    "FP_NO_HOST_CHECK"=NO
    "OS"=Windows_NT
    "PROCESSOR_ARCHITECTURE"=x86
    "PROCESSOR_LEVEL"=6
    "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
    "PROCESSOR_REVISION"=0f06
    "NUMBER_OF_PROCESSORS"=2
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
    "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

    -----------------EOF-----------------
    0
  12. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Infection USB

    Fait ceci :

    USBfix ------>

    [x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

    [x] Un tutoriel est disponible ici : https://www.malekal.com/usbfix-supprimer-virus-usb/

    [x] Installe le

    [x] Branche tout tes médias amovibles ( clés USB, DD externe )

    [x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )

    [x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.

    [x] Au menu principal, choisi l'option 1

    [x] Laisse l'outil travailler puis poste le rapport dans ton prochain message
    0
  13. dekaki
     
    Déoslée j'étais partie !!

    Voila le rapport :

    ############################## | UsbFix V6.023 |

    User : user (Administrateurs) # KAKIORDI
    Update on 29/08/09 by Chiquitine29
    Start at: 19:45:37 | 29/08/2009
    Website : http://pagesperso-orange.fr/NosTools/index.html

    Intel(R) Core(TM)2 CPU T5600 @ 1.83GHz
    Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
    Internet Explorer 7.0.5730.13
    Windows Firewall Status : Disabled

    C:\ -> Disque fixe local # 97,65 Go (63,6 Go free) [LE DISQUE C] # NTFS
    D:\ -> Disque CD-ROM
    E:\ -> Disque fixe local # 368,1 Go (350,34 Go free) [KAKI] # NTFS
    F:\ -> Disque CD-ROM
    G:\ -> Disque amovible
    H:\ -> Disque amovible
    I:\ -> Disque CD-ROM
    J:\ -> Disque fixe local # 931,51 Go (566,18 Go free) [KAKISTOCK] # NTFS
    K:\ -> Disque amovible # 977,19 Mo (977,19 Mo free) # FAT
    M:\ -> Disque amovible
    N:\ -> Disque amovible
    O:\ -> Disque amovible

    ############################## | Processus actifs |

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
    C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe
    C:\Program Files\Sony\HotKey Utility\HKserv.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\HomePlayer\HomePlayer.exe
    C:\Program Files\Sony\HotKey Utility\HKWnd.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Pen_Tablet.exe
    C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
    C:\WINDOWS\system32\Pen_Tablet.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
    C:\Program Files\Macromedia\Dreamweaver 8\Dreamweaver.exe
    C:\Program Files\Adobe\Adobe Photoshop CS2\Photoshop.exe
    C:\DOCUME~1\user\LOCALS~1\Temp\Adobelm_Cleanup.0001
    C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    C:\DOCUME~1\user\LOCALS~1\Temp\Adobelm_Cleanup.0001
    C:\Program Files\FileZilla\FileZilla.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\distnoted.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\SyncServer.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    ################## | Fichiers # Dossiers infectieux |

    ################## | Suspect ! ... | https://www.virustotal.com/gui/ |

    ################## | Registre # Clés Run infectieuses |

    ################## | Registre # Mountpoints2 |

    HKCU\..\..\Explorer\MountPoints2\{189cabc6-1d5b-11de-9017-0013a94b2add}
    Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

    HKCU\..\..\Explorer\MountPoints2\{97c60b8a-81a1-11de-9056-0016cf34f0d5}
    Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

    ################## | Cracks / Keygens / Serials |

    ################## | ! Fin du rapport # UsbFix V6.023 ! |
    0
  14. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    ------- SUPPRESSION --------

    [x] Relance USBfix mais cette fois ci choisis l'option 2

    /!\ N'oublie pas de laisser tes médias amovibles branchés sur ton PC /!\

    [x] Patiente pendant que l'outil travaille.

    [x] Ton PC redémarrera, puis USBfix analysera tes médias amovibles.

    [x] Poste le rapport situé sous C:\USBfix.txt
    0
  15. dekaki
     
    Et voilà !

    ############################## | UsbFix V6.023 |

    User : user (Administrateurs) # KAKIORDI
    Update on 29/08/09 by Chiquitine29
    Start at: 20:44:16 | 29/08/2009
    Website : http://pagesperso-orange.fr/NosTools/index.html

    Intel(R) Core(TM)2 CPU T5600 @ 1.83GHz
    Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
    Internet Explorer 7.0.5730.13
    Windows Firewall Status : Disabled

    C:\ -> Disque fixe local # 97,65 Go (63,87 Go free) [LE DISQUE C] # NTFS
    D:\ -> Disque CD-ROM
    E:\ -> Disque fixe local # 368,1 Go (350,34 Go free) [KAKI] # NTFS
    G:\ -> Disque amovible
    H:\ -> Disque amovible
    J:\ -> Disque fixe local # 931,51 Go (566,18 Go free) [KAKISTOCK] # NTFS
    K:\ -> Disque amovible # 977,19 Mo (977,19 Mo free) # FAT
    M:\ -> Disque amovible
    N:\ -> Disque amovible
    O:\ -> Disque amovible

    ############################## | Processus actifs |

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\logonui.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\eHome\ehRec.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Pen_Tablet.exe
    C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
    C:\WINDOWS\system32\Pen_Tablet.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    ################## | Fichiers # Dossiers infectieux |

    ################## | Autres |

    ################## | Suspect ! ... | https://www.virustotal.com/gui/ |

    ################## | Registre # Clés Run infectieuses |

    ################## | Registre # Mountpoints2 |

    Supprimé ! HKCU\...\Explorer\MountPoints2\{189cabc6-1d5b-11de-9017-0013a94b2add}\Shell\AutoRun\Command
    Supprimé ! HKCU\...\Explorer\MountPoints2\{97c60b8a-81a1-11de-9056-0016cf34f0d5}\Shell\AutoRun\Command

    ################## | Listing des fichiers présent |

    [04/12/2008 11:02|--a------|0] -> C:\AUTOEXEC.BAT
    [04/12/2008 10:50|---hs----|209] -> C:\boot.ini
    [10/08/2004 14:00|-rahs----|4952] -> C:\Bootfont.bin
    [04/12/2008 11:02|--a------|0] -> C:\CONFIG.SYS
    [04/12/2008 11:02|-rahs----|0] -> C:\IO.SYS
    [28/08/2009 23:36|--a------|1841] -> C:\Kill'em.txt
    [29/08/2009 00:32|--a------|14849] -> C:\List'em.txt
    [04/12/2008 11:02|-rahs----|0] -> C:\MSDOS.SYS
    [10/08/2004 14:00|-rahs----|47564] -> C:\NTDETECT.COM
    [04/12/2008 23:08|-rahs----|252240] -> C:\ntldr
    [?|?|?] -> C:\pagefile.sys
    [29/08/2009 20:50|--a------|3127] -> C:\UsbFix.txt

    ################## | Cracks / Keygens / Serials |

    ################## | ! Fin du rapport # UsbFix V6.023 ! |
    0
  16. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Des améliorations ?

    RSIT ----->

    [x] Télécharge Random's System Information Tool à cette adresse : http://images.malwareremoval.com/random/RSIT.exe

    [x] Double clique sur " RSIT.exe ".

    [x] Clique sur " Continue ".

    [x] Si hijackthis n'est pas présent il sera automatiquement téléchargé et tu devras accepter la license.

    [x] Une fois l'analyse finie, deux fichiers ( info.txt & log.txt ) s'ouvriront.

    [x] Copie colle le contenu des deux rapports dans ton prochain message

    -------> Si jamais tu as fermé les rapports sans faire attention, ils sont sous C:\rsit
    0
    1. dekaki
       
      Je refais RSIT ?
      0
  17. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Oui
    0
    1. dekaki
       
      Info :

      info.txt logfile of random's system information tool 1.06 2009-08-29 22:05:34

      ======Uninstall list======

      -->msiexec /I {236BB7C4-4419-42FD-040C-1E257A25E34D}
      -->msiexec /I {B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}
      -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
      Adobe Acrobat 7.0 Professional-->msiexec /I {AC76BA86-1033-0000-7760-100000000002}
      Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000101}
      Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5101}
      Adobe Creative Suite 2-->C:\PROGRA~1\INSTAL~1\{0134A~1\setup.exe /relaunched/rootloc=e:\appz\exc\adobe creative suite 2.0/lang=040c
      Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
      Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
      Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
      Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-119F-4D52-B551-6739B2B22101}
      Adobe Reader 9.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
      Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-0C40-4930-9AFE-113BCE553101}
      Adobe SVG Viewer 3.0-->C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log
      Analyseur et SDK MSXML 4.0 SP2-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
      Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}
      Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
      AppMon Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8C44C027-7B9F-46F1-8FD8-5767403A7CA5}\setup.exe" -l0x40c -removeonly
      ASIX AX88772 WinXP_2K 32Bit Driver-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{3C6BD212-5680-4758-83ED-21171BCCBEB7}
      Axure RP Pro 5-->"C:\Documents and Settings\All Users\Application Data\{EA6AF74E-BDCD-4FE5-BAB2-F6BF858C5B6A}\AxureRP.exe" REMOVE=TRUE MODIFY=FALSE
      Axure RP Pro 5-->C:\Documents and Settings\All Users\Application Data\{EA6AF74E-BDCD-4FE5-BAB2-F6BF858C5B6A}\AxureRP.exe
      Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
      Broadcom Driver v4.150.22.0_Foxconn Installation Program-->C:\Program Files\InstallShield Installation Information\{88410D8F-8529-492B-B556-2394A29B811B}\setup.exe -runfromtemp -l0x0009 -removeonly
      Comptes@Jour-->"C:\Program Files\InstallShield Installation Information\{1C274306-FF04-47B0-9A1C-BC2180F8D37E}\setup.exe" -runfromtemp -l0x040c -removeonly
      Comptes@Jour-->MsiExec.exe /I{1C274306-FF04-47B0-9A1C-BC2180F8D37E}
      Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
      CrossFont version 5.1-->"C:\Program Files\CrossFnt\unins000.exe"
      EasyPHP 2.0b1-->"C:\Program Files\EasyPHP\unins000.exe"
      FileZilla (remove only)-->"C:\Program Files\FileZilla\uninstall.exe"
      Flickr Uploadr 3.0.5-->"C:\Program Files\Flickr Uploadr\uninstall.exe"
      Google Talk Plugin-->MsiExec.exe /I{BBC783B7-8725-3B1C-B49A-BA7F09391251}
      HDAUDIO SoftV92 Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_20030003\HXFSETUP.EXE -U -ISnyHDANk.inf
      High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
      HijackThis 2.0.2-->"C:\Program Files\HJT\HijackThis.exe" /uninstall
      HomePlayer 1.5.8a-->C:\Program Files\HomePlayer\uninst.exe
      HotKey Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B36C3DFD-BAB0-4513-BD27-FA4906A738FD}\Setup.exe"
      HotKey Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BB311F54-39D6-4A03-8E18-053D1B2833D7}\Setup.exe" -l0x40c
      HP Photosmart, Officejet and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{3A316611-45D1-429C-AA26-B71259C44689}\setup\hpzscr01.exe -datfile hposcr11.dat
      Internet Explorer Developer Toolbar-->MsiExec.exe /I{E7081891-BC7F-43F9-9CE6-B5DD2F497156}
      iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}
      Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
      K-Lite Codec Pack 3.3.0 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
      LAN-Express AS IEEE 802.11 Wireless LAN-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FCCB0B43-7A6D-49A4-A5B3-B10F592F4EB6}\setup.exe" -l0x40c -removeonly
      LAN-Express BCM IEEE 802.11 Wireless LAN-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{75B6A48E-985D-4195-B8F9-E41D3F7CCC99}\setup.exe" -l0x40c -removeonly
      Ma-Config.com-->MsiExec.exe /X{3A4EE7A4-356E-43B7-A4A3-9C55B22A05B3}
      Macromedia Dreamweaver 8-->MsiExec.exe /I{5FD788ED-1A37-4496-9BDD-463F493B27FA}
      Macromedia Extension Manager-->MsiExec.exe /I{3C8C9FB3-5FDF-40B4-B314-EAD722728C76}
      Macromedia Flash 8 Video Encoder-->MsiExec.exe /X{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}
      Macromedia Flash 8-->MsiExec.exe /I{2BD5C305-1B27-4D41-B690-7A61172D2FEB}
      Macromedia Flash Player 8-->MsiExec.exe /X{885A63EA-382B-4DD4-A755-14809B8557D6}
      Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
      Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
      Microsoft Flight Simulator X-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{9527A496-5DF9-412A-ADC7-168BA5379CA6}
      Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
      Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
      Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
      Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
      Microsoft Office Enterprise 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
      Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
      Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
      Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
      Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
      Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
      Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
      Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
      Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
      Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
      Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
      Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
      Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
      Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
      Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
      Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
      Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
      Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
      Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
      Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
      MobileMe Control Panel-->MsiExec.exe /I{DDBB28C8-B2AA-45A1-8DCE-059A798509FB}
      Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
      MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
      MultipleIEs-->"C:\Program Files\MultipleIEs\unins000.exe"
      Notepad++-->C:\Program Files\Notepad++\uninstall.exe
      NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
      OpenOffice.org 2.2-->MsiExec.exe /I{419805D6-75A0-4981-BC8F-9FF97EC6B03A}
      Opera 9.64-->MsiExec.exe /X{E1BBBAC5-2857-4155-82A6-54492CE88620}
      Pen Tablet-->C:\Program Files\Tablet\Pen\Remove.exe /u
      Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
      PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
      PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
      QuickTime Alternative 1.81-->"C:\Program Files\QuickTime Alternative\unins000.exe"
      QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
      Real Alternative 1.52-->"C:\Program Files\Real Alternative\unins000.exe"
      Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
      Safari-->MsiExec.exe /I{2D6ED011-055B-4041-B198-BB903827EBFB}
      Setting Utility Series-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59452470-A902-477F-9338-9B88101681BD}\setup.exe" -l0x40c UNINSTALL -removeonly
      SigmaTel Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x40c -remove -removeonly
      Sony Utilities DLL-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EF3D45BB-2260-4008-88EA-492E7744A9DF}\setup.exe" -l0x9 -removeonly
      Sony Video Shared Library-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}\setup.exe" -l0x40c -removeonly
      Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
      Spotify-->"C:\Program Files\Spotify\uninstall.exe"
      Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
      Suite Specific-->MsiExec.exe /I{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}
      TortoiseSVN 1.5.7.15182 (32 bit)-->MsiExec.exe /X{27968397-2FC3-4D79-BD5D-E6AC44A263FE}
      Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
      Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
      UsbFix-->C:\UsbFix\Uninstal.exe
      VAIO Camera Capture Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6D2576EC-A0E9-418A-A09A-409933A3B6F4}\setup.exe" -l0x40c -removeonly
      VAIO Camera Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1417F599-1DBD-4499-9375-B2813E9F890C}\setup.exe" -l0x40c -removeonly
      VAIO Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FC37C108-821D-4EDE-8F40-D5B497586805}\setup.exe" -l0x40c -removeonly
      VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
      Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
      Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
      Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
      WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

      ======Hosts File======

      127.0.0.1 www.007guard.com
      127.0.0.1 007guard.com
      127.0.0.1 008i.com
      127.0.0.1 www.008k.com
      127.0.0.1 008k.com
      127.0.0.1 www.00hq.com
      127.0.0.1 00hq.com
      127.0.0.1 010402.com
      127.0.0.1 www.032439.com
      127.0.0.1 032439.com

      ======System event log======

      Computer Name: KAKIORDI
      Event Code: 4202
      Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{9DA36BE0-EDBA-41B6-ADD6-3EC826E6202A} était déconnectée du réseau,
      et la configuration réseau de la carte a été abandonnée. Si la carte
      réseau n'était pas déconnectée, ceci peut indiquer un disfonctionnement.
      Contactez le fabricant pour des pilotes mis à jour.

      Record Number: 5874
      Source Name: Tcpip
      Time Written: 20090623153203.000000+120
      Event Type: Informations
      User:

      Computer Name: KAKIORDI
      Event Code: 7036
      Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : arrêté.

      Record Number: 5873
      Source Name: Service Control Manager
      Time Written: 20090623153203.000000+120
      Event Type: Informations
      User:

      Computer Name: KAKIORDI
      Event Code: 7036
      Message: Le service Service de l’iPod est entré dans l'état : en cours d'exécution.

      Record Number: 5872
      Source Name: Service Control Manager
      Time Written: 20090623153201.000000+120
      Event Type: Informations
      User:

      Computer Name: KAKIORDI
      Event Code: 7035
      Message: Un contrôle Démarrer a correctement été envoyé au service Service de l’iPod.

      Record Number: 5871
      Source Name: Service Control Manager
      Time Written: 20090623153201.000000+120
      Event Type: Informations
      User: AUTORITE NT\SYSTEM

      Computer Name: KAKIORDI
      Event Code: 7000
      Message: Le service Service de transfert intelligent en arrière-plan n'a pas pu démarrer en raison de l'erreur :
      Le fichier spécifié est introuvable.


      Record Number: 5870
      Source Name: Service Control Manager
      Time Written: 20090623153200.000000+120
      Event Type: erreur
      User:

      =====Application event log=====

      Computer Name: USER-312AAA333B
      Event Code: 1
      Message:
      Record Number: 246
      Source Name: Bonjour Service
      Time Written: 20090126142010.000000+060
      Event Type: Informations
      User:

      Computer Name: USER-312AAA333B
      Event Code: 1517
      Message: Windows a sauvegardé le Registre utilisateur USER-312AAA333B\user alors qu'une application ou un service utilisait toujours le Registre pendant la fermeture de la session. La mémoire utilisée par le Registre de l'utilisateur n'a pas été libérée. le Registre sera déchargé lorsqu'il ne sera plus utilisé.


      Cela est souvent causé par des services s'exécutant en tant que compte d'utilisateur, essayez de configurer les services pour s'exécuter dans le compte service réseau ou service local.

      Record Number: 245
      Source Name: Userenv
      Time Written: 20090126141848.000000+060
      Event Type: Avertissement
      User: AUTORITE NT\SYSTEM

      Computer Name: USER-312AAA333B
      Event Code: 4097
      Message: L'application, C:\Program Files\Macromedia\Dreamweaver 8\Dreamweaver.exe, a généré une erreur d'application
      L'erreur s'est produite le 01/26/2009 à 13:50:24.328
      L'exception générée était c0000005 à l'adresse 08BEE6B9 (<nosymbols>)

      Record Number: 244
      Source Name: DrWatson
      Time Written: 20090126135024.000000+060
      Event Type: Informations
      User:

      Computer Name: USER-312AAA333B
      Event Code: 4097
      Message: L'application, C:\Program Files\Macromedia\Dreamweaver 8\Dreamweaver.exe, a généré une erreur d'application
      L'erreur s'est produite le 01/26/2009 à 13:48:00.281
      L'exception générée était c000001d à l'adresse 05243D89 (<nosymbols>)

      Record Number: 243
      Source Name: DrWatson
      Time Written: 20090126134800.000000+060
      Event Type: Informations
      User:

      Computer Name: USER-312AAA333B
      Event Code: 1000
      Message: Application défaillante vlc.exe, version 0.8.6.0, module défaillant libvlc.dll, version 0.0.0.0, adresse de défaillance 0x0009c98a.

      Record Number: 242
      Source Name: Application Error
      Time Written: 20090125211233.000000+060
      Event Type: erreur
      User:

      ======Environment variables======

      "ComSpec"=%SystemRoot%\system32\cmd.exe
      "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Adobe\AGL;C:\Program Files\TortoiseSVN\bin;C:\Program Files\QuickTime Alternative\QTSystem\
      "windir"=%SystemRoot%
      "FP_NO_HOST_CHECK"=NO
      "OS"=Windows_NT
      "PROCESSOR_ARCHITECTURE"=x86
      "PROCESSOR_LEVEL"=6
      "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
      "PROCESSOR_REVISION"=0f06
      "NUMBER_OF_PROCESSORS"=2
      "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
      "TEMP"=%SystemRoot%\TEMP
      "TMP"=%SystemRoot%\TEMP
      "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
      "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

      -----------------EOF-----------------


      Et log :

      Logfile of random's system information tool 1.06 (written by random/random)
      Run by user at 2009-08-29 22:05:30
      Microsoft Windows XP Professionnel Service Pack 3
      System drive C: has 65 GB (65%) free of 100 GB
      Total RAM: 3070 MB (72% free)

      HijackThis download failed

      ======Scheduled tasks folder======

      C:\WINDOWS\tasks\AppleSoftwareUpdate.job
      C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-117609710-839522115-1003Core.job
      C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-117609710-839522115-1003UA.job

      ======Registry dump======

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
      AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
      Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
      Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
      Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
      Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-01-06 320920]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
      AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC7E636D-39AA-49b6-B511-65413DA137A1}]
      IE Developer Toolbar BHO - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll [2007-03-01 623992]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
      Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-01-06 34816]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
      JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-01-06 73728]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
      "ehTray"=C:\WINDOWS\ehome\ehtray.exe [2004-08-10 59392]
      "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-12-04 7561216]
      "LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2006-04-13 49152]
      "VAIOCameraUtility"=C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe [2006-11-14 411768]
      "AppMon Utility"=C:\Program Files\Sony\AppMonUtil\AppMonUtility.exe [2006-11-15 415864]
      "HKSERV.EXE"=C:\Program Files\Sony\HotKey Utility\HKserv.exe [2004-06-29 122880]
      "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-01-06 136600]
      "PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE [2008-11-02 167936]
      "AppleSyncNotifier"=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-05-13 177472]
      "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
      "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
      "Acrobat Assistant 7.0"=C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2004-12-14 483328]
      ""= []
      "QuickTime Task"=C:\Program Files\QuickTime Alternative\QTTask.exe [2009-05-26 413696]
      "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128]
      "HomePlayer"=C:\Program Files\HomePlayer\HomePlayer.exe [2007-11-06 294912]

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
      "BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2008-12-19 342848]
      "Google Update"=C:\Documents and Settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-09 133104]

      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
      Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe
      Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
      "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
      "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digiwet.dll

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
      "dontdisplaylastusername"=0
      "legalnoticecaption"=
      "legalnoticetext"=
      "shutdownwithoutlogon"=1
      "undockwithoutlogon"=1
      "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
      "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "NoDriveTypeAutoRun"=255
      "NoDriveAutoRun"=FFFFFFFF
      "HonorAutoRunSetting"=1

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "HonorAutoRunSetting"=
      "NoDriveAutoRun"=
      "NoDriveTypeAutoRun"=

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll"="C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin"
      "C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\user\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
      "C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
      "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
      "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
      "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
      "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
      "C:\Program Files\Spotify\spotify.exe"="C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify"
      "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
      "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
      "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
      "C:\Program Files\FileZilla\FileZilla.exe"="C:\Program Files\FileZilla\FileZilla.exe:*:Enabled:FileZilla"
      "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
      "C:\Program Files\HomePlayer\HomePlayer.exe"="C:\Program Files\HomePlayer\HomePlayer.exe:*:Enabled:HomePlayer"
      "C:\Program Files\HomePlayer\VLC\vlc.exe"="C:\Program Files\HomePlayer\VLC\vlc.exe:*:Enabled:VLC HomePlayer"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

      ======File associations======

      .js - edit - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1"

      ======List of files/folders created in the last 1 months======

      2009-08-29 20:43:59 ----A---- C:\UsbFix.txt
      2009-08-29 19:44:47 ----D---- C:\UsbFix
      2009-08-29 13:39:03 ----D---- C:\Program Files\trend micro
      2009-08-29 13:39:02 ----D---- C:\rsit
      2009-08-29 01:28:58 ----D---- C:\Documents and Settings\user\Application Data\Malwarebytes
      2009-08-29 01:28:54 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
      2009-08-29 01:28:53 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
      2009-08-29 00:47:57 ----D---- C:\_OTMoveIt
      2009-08-28 23:28:11 ----D---- C:\Kill'em
      2009-08-28 23:28:11 ----A---- C:\Kill'em.txt
      2009-08-28 23:22:07 ----A---- C:\List'em.txt
      2009-08-28 19:01:41 ----D---- C:\Program Files\Fichiers communs\SourceTec
      2009-08-28 19:01:39 ----D---- C:\Program Files\SourceTec
      2009-08-24 20:05:07 ----D---- C:\Documents and Settings\user\Application Data\vlc
      2009-08-08 19:43:17 ----D---- C:\Documents and Settings\user\Application Data\CyberLink
      2009-08-02 23:45:08 ----D---- C:\Program Files\Microsoft

      ======List of files/folders modified in the last 1 months======

      2009-08-29 22:05:04 ----D---- C:\Program Files\Mozilla Firefox
      2009-08-29 22:03:50 ----D---- C:\WINDOWS\Prefetch
      2009-08-29 21:50:11 ----A---- C:\WINDOWS\ModemLog_HDAUDIO SoftV92 Data Fax Modem with SmartCP.txt
      2009-08-29 20:50:10 ----AD---- C:\WINDOWS\Temp
      2009-08-29 20:47:11 ----SHD---- C:\RECYCLER
      2009-08-29 20:44:16 ----D---- C:\Documents and Settings\user\Application Data\WTablet
      2009-08-29 20:44:14 ----D---- C:\WINDOWS\Registration
      2009-08-29 20:44:09 ----D---- C:\WINDOWS
      2009-08-29 20:42:32 ----A---- C:\WINDOWS\SchedLgU.Txt
      2009-08-29 20:41:21 ----D---- C:\Documents and Settings\user\Application Data\DNA
      2009-08-29 13:39:03 ----RD---- C:\Program Files
      2009-08-29 02:07:06 ----D---- C:\Program Files\DNA
      2009-08-29 02:06:26 ----D---- C:\WINDOWS\system32\drivers
      2009-08-29 02:05:28 ----D---- C:\WINDOWS\system32
      2009-08-29 00:48:07 ----RSHDC---- C:\WINDOWS\system32\dllcache
      2009-08-29 00:47:57 ----D---- C:\WINDOWS\system32\CatRoot2
      2009-08-28 23:37:51 ----D---- C:\WINDOWS\system32\config
      2009-08-28 23:37:30 ----D---- C:\WINDOWS\system32\wbem
      2009-08-28 23:37:16 ----D---- C:\WINDOWS\ehome
      2009-08-28 23:37:16 ----D---- C:\Program Files\PowerISO
      2009-08-28 23:37:16 ----D---- C:\Program Files\HomePlayer
      2009-08-28 23:37:15 ----D---- C:\Program Files\Spybot - Search & Destroy
      2009-08-28 23:37:15 ----D---- C:\Program Files\Adobe
      2009-08-28 23:37:00 ----D---- C:\WINDOWS\system32\Restore
      2009-08-28 19:46:37 ----SD---- C:\WINDOWS\Tasks
      2009-08-28 19:01:41 ----D---- C:\Program Files\Fichiers communs
      2009-08-28 11:13:12 ----RSD---- C:\WINDOWS\Fonts
      2009-08-27 23:58:50 ----D---- C:\Documents and Settings\user\Application Data\BitTorrent
      2009-08-26 21:40:27 ----D---- C:\Program Files\MultipleIEs
      2009-08-26 21:10:25 ----D---- C:\Documents and Settings\user\Application Data\Adobe
      2009-08-26 18:29:43 ----A---- C:\WINDOWS\win.ini
      2009-08-24 17:19:06 ----D---- C:\Program Files\Flickr Uploadr
      2009-08-24 14:54:26 ----SHD---- C:\WINDOWS\Installer
      2009-08-24 14:54:25 ----HD---- C:\Config.Msi
      2009-08-24 14:54:25 ----D---- C:\Documents and Settings\user\Application Data\Mozilla

      ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R1 DMICall;Sony DMI Call service; C:\WINDOWS\system32\DRIVERS\DMICall.sys [2006-10-18 10216]
      R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
      R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
      R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2008-11-02 56572]
      R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2008-12-04 12544]
      R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
      R3 BCM43XX;LAN-Express BCM IEEE 802.11 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ExpbcmAG.sys [2006-05-16 428928]
      R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
      R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
      R3 HidIr;Pilote HID infrarouge Microsoft; C:\WINDOWS\system32\DRIVERS\hidir.sys [2008-04-13 19200]
      R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
      R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2008-12-04 998656]
      R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2008-12-04 202112]
      R3 IrBus;Pilote de filtre de bus infrarouge pour les contrôles distants eHome; C:\WINDOWS\system32\DRIVERS\IrBus.sys [2008-04-13 46592]
      R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
      R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
      R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-12-04 3662400]
      R3 SNC;Périphérique de contrôle d'ordinateur portable Sony; C:\WINDOWS\system32\DRIVERS\SonyNC.sys [2001-08-17 20752]
      R3 SonyImgF;Sony Image Conversion Filter Driver; C:\WINDOWS\system32\DRIVERS\SonyImgF.sys [2008-12-04 30976]
      R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2008-12-04 1177032]
      R3 ti21sony;ti21sony; C:\WINDOWS\system32\drivers\ti21sony.sys [2008-12-04 807424]
      R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
      R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
      R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
      R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
      R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
      R3 usbvm321;Sony Visual Communication Camera VGP-VCC1; C:\WINDOWS\System32\Drivers\usbvm321.sys [2008-12-04 234496]
      R3 wacommousefilter;Wacom Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
      R3 wacomvhid;Wacom Virtual Hid Driver; C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2008-08-18 13352]
      R3 WacomVKHid;Virtual Keyboard Driver; C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys [2007-02-15 11440]
      R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2008-12-04 721280]
      R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2008-12-04 243328]
      S3 AVerM115S;AVerM115S service; C:\WINDOWS\system32\DRIVERS\AVerM115S.sys [2006-06-14 745600]
      S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\ax88772.sys [2006-09-06 19072]
      S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
      S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
      S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
      S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
      S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
      S3 MHNDRV;Pilote MHN; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
      S3 MPE;Filtre BDA MPE; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
      S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
      S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
      S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
      S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
      S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
      S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
      S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
      S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
      S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-06-05 39424]
      S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
      S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
      S3 wacmoumonitor;Wacom Mode Helper; C:\WINDOWS\system32\DRIVERS\wacmoumonitor.sys [2008-10-06 15656]
      S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
      S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

      ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-06-05 144712]
      R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
      R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2004-08-10 194560]
      R2 ehSched;Service de planification Media Center; C:\WINDOWS\eHome\ehSched.exe [2004-08-10 103424]
      R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-01-06 152984]
      R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-12-04 143428]
      R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
      R2 TabletServicePen;TabletServicePen; C:\WINDOWS\system32\Pen_Tablet.exe [2008-12-11 2749736]
      R3 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-12-09 72704]
      S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
      S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
      S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-01 136120]
      S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
      S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
      S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2008-11-17 195752]
      S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
      S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
      S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
      S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
      S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-10 38912]

      -----------------EOF-----------------


      :)
      0
  18. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Fais ceci :

    R-hosts ----->

    Télécharge R-Hosts ( de S!ri ) à cette adresse : http://siri.urz.free.fr/RHosts.php

    Clique sur " download " , puis télécharge le sur ton bureau

    Execute le puis clique sur restaurer

    Confirme, puis quitte le programme

    Comment se porte le PC ?
    0
    1. dekaki
       
      Ben a merveille depuis hier déjà :)
      Mais là du coup il est tout clean ???
      0
  19. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Apparement oui, fait ceci maintenant :

    Toolscleaner ---->

    Afin de supprimer tout les logiciels qui ont été utilisés pour ta désinfection,

    [x] Télécharge ToolsCleaner sur ton bureau à cette adresse : https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/
    [x] Double-clique sur « Toolscleaner.exe »
    [x] Clique sur "restauration" pour créer un point de restauration.
    [x] Puis clique sur « recherche »
    [x] Quand la recherche sera terminée, clique sur "suppression".
    [x] A la fin (il y aura des indications dans le cadre en-dessous), clique sur "quitter" et poste le rapport qui se trouve dans C:\Tcleaner.txt
    0
  20. dekaki
     
    Voilà :

    [ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

    --> Recherche:

    C:\UsbFix.txt: trouvé !
    C:\UsbFix: trouvé !
    C:\Rsit: trouvé !
    C:\Documents and Settings\user\Bureau\UsbFix.exe: trouvé !
    C:\Documents and Settings\user\Bureau\UsbFix.lnk: trouvé !
    C:\Documents and Settings\user\Bureau\Rsit.exe: trouvé !
    C:\Documents and Settings\user\Menu Démarrer\Programmes\UsbFix: trouvé !
    C:\Documents and Settings\user\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
    C:\Program Files\HJT\hijackthis.log: trouvé !

    ---------------------------------
    --> Suppression:

    C:\UsbFix.txt: supprimé !
    C:\Documents and Settings\user\Bureau\UsbFix.exe: supprimé !
    C:\Documents and Settings\user\Bureau\UsbFix.lnk: supprimé !
    C:\Documents and Settings\user\Bureau\Rsit.exe: supprimé !
    C:\Documents and Settings\user\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
    C:\Program Files\HJT\hijackthis.log: supprimé !
    C:\UsbFix: ERREUR DE SUPPRESSION !!
    C:\Rsit: supprimé !
    C:\Documents and Settings\user\Menu Démarrer\Programmes\UsbFix: supprimé !
    0
    1. dekaki
       
      C'est fini ??
      0
  21. kittysan Messages postés 1 Statut Membre
     
    Par contre je n'ai plus internet sur mes autres navigateurs, juste sur Firefox... :'(
    0
  • 1
  • 2

Discussions similaires

FOTOSE (allemagne)
lix -
Yves -

13 réponses
ATTENTION : escroquerie à la carte bleue !!
dvrg -
dvrg -

80 réponses