VIRUS OU PROBLEME DE WINDOWS?

Question

Bonjour,

Depuis quelques mois, jai un virus sur mon ordinateur, en gros sur google, qd je clique sur une page, ca en ouvre une autre a la place, puis en fermant, la bonne page apparait au deuxieme coup.. bref ca me derangait pas tant que ca..
avast avait trouve des virus (kernel32.ddl + winsock.dll + wsock32.ddl), mais ne pouvait pas les supprimer donc comme j avais pa envie de reformater, jai juste mis en quarantaine..

Finalement, il y a 10 jours, jai telecharge spybot, mais mon ordi ne voulai pa fair les MAJ donc impossible de m'en servir du coup jai desisnstalle..puis jai installee the cleaner, mais il ne ma detecte aucun virus, donc je lai desinstalle..puis jai telecharge Glary utility qui mavait trouve 800 erreurs, qui ont ete reparees..depuis plus de probleme apparent...

Maintenant, mon ordi marche tres tres bien pour tout sauf Internet. A chaque fois que je veux me connecter sur internet, mon ordi se connecte, la premiere page apparait, puis plus rien!!! ca beugue, ca met des heures puis lordi ne repond meme plus du tout..meme alt ctr supp ne marche pas donc je suis obligee de debrancher en eteignant mon ordi en appuyant sur le bouton.

Est ce un virus? Est ce un pb de Windows? Que faire, je suis completement perdue...
Merci bcp

Trying2 · Answer

Hello,


Afin d'y voir plus clair:



- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

- Double-clique sur RSIT.exe afin de lancer le programme.

- Clique sur Continue à l'écran Disclaimer.

-Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches) dans deux messages différents.


@+

PAULINE1311 · Answer

merci beaucoup, voila le log et info que jenvoie juste apres...que puis je faire maintenant?

Logfile of random's system information tool 1.06 (written by random/random)
Run by Pauline at 2009-09-07 04:01:41
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 45 GB (41%) free of 109 GB
Total RAM: 1013 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:04:06, on 07/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\Users\Pauline\Desktop\RSIT.exe
C:\Users\Pauline\Desktop\Pauline.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix: 
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{51645E9D-64DF-4B07-ABFC-A8872EC6F540}: NameServer = 10.188.66.103 10.176.66.71
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F4BA525-C518-4C61-BB90-4A22EAEA1C6F}: NameServer = 85.255.112.126,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5F453FC-7878-4259-A7CB-9DAD2F23E65C}: NameServer = 85.255.112.126,85.255.112.150
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.126,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.126,85.255.112.150
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Update Service (gupdate1c9a671ccca2970) (gupdate1c9a671ccca2970) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

PAULINE1311 · Answer

info.txt logfile of random's system information tool 1.06 2009-09-07 04:04:12

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Adobe Acrobat 5.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.3 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
ASL_HS_Installer32-->MsiExec.exe /I{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
BHVideo-->"C:\Program Files\BHVideo\Uninstall.exe"
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Conexant HD Audio-->C:\Program Files\CONEXANT\CNXT_HDAUDIO\HUFSetup.EXE -U -IwisVenza.inf
Glary Utilities 2.15.0.738-->"C:\Program Files\Glary Utilities\unins000.exe"
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_AK_SH_VI_VEN_14F1&DEV_5045\HXFSETUP.EXE -U -IwiVeUniz.inf
Hewlett-Packard Active Check-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
HijackThis 2.0.2-->"C:\Users\Pauline\Desktop\HijackThis.exe" /uninstall
HP Active Support Library-->C:\Program Files\InstallShield Installation Information\{21E62565-8639-457C-B64C-A3FF0A8B4D80}\setup.exe -runfromtemp -l0x0409
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}\setup.exe" -l0x9  -removeonly
HP Easy Setup - Core-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F94234DB-FD06-42C3-B88D-6FC4DC9F988C}\setup.exe" -l0x9 
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40F7AED3-0C7D-4582-99F6-484A515C73F2}\setup.exe" -l0x9  -removeonly
HP Help and Support-->MsiExec.exe /I{E4DDBA93-769B-49D8-BA33-8814E45ED0C1}
HP Pavilion Webcam Driver for Vista v061.001.00006-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CA81D12-9EC2-4082-972B-43ECA63F41F2}\setup.exe" -l0x40c  -removeonly
HP Quick Launch Buttons 6.10 B9-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe" -l0x40c  uninst
HP QuickPlay 3.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\setup.exe"  -uninstall
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
HP User Guide 0052-->MsiExec.exe /I{91DBD16F-BA92-4B2E-A65A-56DB3EE67AC4}
HP Wireless Assistant-->MsiExec.exe /I{02F33FB0-F7D5-4C0A-B4AD-8CE5CE230BBE}
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
IZArc 3.81-->"C:\Program Files\IZArc\unins000.exe"
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Project 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-00B4-040C-0000-0000000FF1CE} /uninstall {77A1E93A-2EE6-414B-A972-71D7C2B77E84}
Microsoft Office Project 2007 Service Pack 1 (SP1)-->msiexec /package {91120000-003B-0000-0000-0000000FF1CE} /uninstall {C1877F6E-C1C8-486D-A697-86431029690C}
Microsoft Office Project MUI (French) 2007-->MsiExec.exe /X{90120000-00B4-040C-0000-0000000FF1CE}
Microsoft Office Project Professional 2007 Trial-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRJPROR /dll OSETUP.DLL
Microsoft Office Project Professional 2007-->MsiExec.exe /X{91120000-003B-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
Mise à jour Microsoft Office Excel 2007 Help  (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Word 2007 Help  (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Mozilla Firefox (3.0.12)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Roxio Creator Audio-->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator Basic v9-->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Copy-->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data-->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator EasyArchive-->MsiExec.exe /I{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}
Roxio Creator Tools-->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Express Labeler 3-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio MyDVD Basic v9-->MsiExec.exe /I{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {91120000-003B-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {91120000-003B-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-003B-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office OneNote 2007 (KB950130)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Project 2007 (KB949046)-->msiexec /package {91120000-003B-0000-0000-0000000FF1CE} /uninstall {B14B8A2C-6EB4-4FB6-B589-F6A5ABEC5B00}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {91120000-003B-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Skype 2.5-->"C:\Program Files\Skype\Phone\unins000.exe"
Sonic Activation Module-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-003B-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
VLC media player 0.9.6-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Vuze-->C:\Program Files\Vuze\uninstall.exe
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}

======Security center information======

AS: Spybot - Search and Destroy (disabled) (outdated)
AS: Windows Defender (outdated)

======System event log======

Computer Name: PC-de-Pauline
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.
Record Number: 119239
Source Name: Tcpip
Time Written: 20090907000700.120800-000
Event Type: Avertissement
User: 

Computer Name: PC-de-Pauline
Event Code: 1003
Message: Votre ordinateur n'a pas pu renouveler son adresse à partir du réseau (à partir du serveur DHCP) pour la carte réseau dont l'adresse réseau est 0019D261F691. Il s'est produit l'erreur suivante : 
L'opération a été annulée par l'utilisateur.. Votre ordinateur va continuer à essayer d'obtenir sa propre adresse auprès du serveur d'adresse réseau (DHCP).
Record Number: 119244
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20090907000728.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-Pauline
Event Code: 134
Message: NtpClient n'a pas pu définir d'homologue manuel à utiliser comme source de temps en raison d'une erreur de résolution DNS sur " time.windows.com,0x9 ". NtpClient réessaiera dans 15 minutes, et à nouveau une fois le double de l'intervalle de nouvelle tentative écoulé. L'erreur était : Hôte inconnu. (0x80072AF9)
Record Number: 119246
Source Name: Microsoft-Windows-Time-Service
Time Written: 20090907000740.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-Pauline
Event Code: 134
Message: NtpClient n'a pas pu définir d'homologue manuel à utiliser comme source de temps en raison d'une erreur de résolution DNS sur " time.windows.com,0x9 ". NtpClient réessaiera dans 15 minutes, et à nouveau une fois le double de l'intervalle de nouvelle tentative écoulé. L'erreur était : Hôte inconnu. (0x80072AF9)
Record Number: 119247
Source Name: Microsoft-Windows-Time-Service
Time Written: 20090907000740.000000-000
Event Type: Avertissement
User: 

Computer Name: PC-de-Pauline
Event Code: 225
Message: L’application System avec l’ID de processus 4 a arrêté le retrait ou l’éjection pour le périphérique USB\VID_0BC2&PID_2300\2GH17GPF____.
Record Number: 119258
Source Name: Microsoft-Windows-Kernel-PnP
Time Written: 20090907020051.805200-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

=====Application event log=====

Computer Name: PC-de-Pauline
Event Code: 20
Message: 
Record Number: 10196
Source Name: Google Update
Time Written: 20090906152952.000000-000
Event Type: Erreur
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Pauline
Event Code: 11
Message: Échec de l'extraction de la liste racine tierce partie depuis le fichier CAB de mise à jour automatique à : <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> avec l'erreur : Données non valides.
.
Record Number: 10221
Source Name: Microsoft-Windows-CAPI2
Time Written: 20090906230322.000000-000
Event Type: Erreur
User: 

Computer Name: PC-de-Pauline
Event Code: 20
Message: 
Record Number: 10226
Source Name: Google Update
Time Written: 20090906232952.000000-000
Event Type: Erreur
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Pauline
Event Code: 20
Message: 
Record Number: 10227
Source Name: Google Update
Time Written: 20090907002806.000000-000
Event Type: Erreur
User: AUTORITE NT\SYSTEM

Computer Name: PC-de-Pauline
Event Code: 20
Message: 
Record Number: 10231
Source Name: Google Update
Time Written: 20090907012806.000000-000
Event Type: Erreur
User: AUTORITE NT\SYSTEM

=====Security event log=====

Computer Name: PC-de-Pauline
Event Code: 5032
Message: Le Pare-feu Windows n’a pas pu notifier l’utilisateur qu’il a empêché une application d’accepter des connexions entrantes sur le réseau.

Code d’erreur :	2
Record Number: 30453
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090902123754.941600-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-Pauline
Event Code: 5032
Message: Le Pare-feu Windows n’a pas pu notifier l’utilisateur qu’il a empêché une application d’accepter des connexions entrantes sur le réseau.

Code d’erreur :	2
Record Number: 30454
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090902123754.941600-000
Event Type: Échec de l'audit
User: 

Computer Name: PC-de-Pauline
Event Code: 4648
Message: Tentative d’ouverture de session en utilisant des informations d’identification explicites.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-PAULINE$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Compte dont les informations d’identification ont été utilisées :
	Nom du compte :		SYSTEM
	Domaine du compte :		AUTORITE NT
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Serveur cible :
	Nom du serveur cible :	localhost
	Informations supplémentaires :	localhost

Informations sur le processus :
	ID du processus :		0x244
	Nom du processus :		C:\WINDOWS\System32\services.exe

Informations sur le réseau :
	Adresse du réseau :	-
	Port :			-

Cet événement est généré lorsqu’un processus tente d’ouvrir une session pour un compte en spécifiant explicitement les informations d’identification de ce compte. Ceci se produit le plus souvent dans les configurations par lot comme les tâches planifiées, ou avec l’utilisation de la commande RUNAS.
Record Number: 30455
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090902125142.386200-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-Pauline
Event Code: 4624
Message: L’ouverture de session d’un compte s’est correctement déroulée.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		PC-DE-PAULINE$
	Domaine du compte :		WORKGROUP
	ID d’ouverture de session :		0x3e7

Type d’ouverture de session :			5

Nouvelle ouverture de session :
	ID de sécurité :		S-1-5-18
	Nom du compte :		SYSTEM
	Domaine du compte :		AUTORITE NT
	ID d’ouverture de session :		0x3e7
	GUID d’ouverture de session :		{00000000-0000-0000-0000-000000000000}

Informations sur le processus :
	ID du processus :		0x244
	Nom du processus :		C:\WINDOWS\System32\services.exe

Informations sur le réseau :
	Nom de la station de travail :	
	Adresse du réseau source :	-
	Port source :		-

Informations détaillées sur l’authentification :
	Processus d’ouverture de session :		Advapi  
	Package d’authentification :	Negotiate
	Services en transit :	-
	Nom du package (NTLM uniquement) :	-
	Longueur de la clé :		0

Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée.

Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe.

Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau).

Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté.

Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
	- Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
	- Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
	- Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
	- La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
Record Number: 30456
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090902125142.386200-000
Event Type: Succès de l'audit
User: 

Computer Name: PC-de-Pauline
Event Code: 4672
Message: Privilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
	ID de sécurité :		S-1-5-18
	Nom du compte :		SYSTEM
	Domaine du compte :		AUTORITE NT
	ID d’ouverture de session :		0x3e7

Privilèges :		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
Record Number: 30457
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090902125142.386200-000
Event Type: Succès de l'audit
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2
"PLATFORM"=MCD
"PCBRAND"=Pavilion
"OnlineServices"=Services en ligne
"RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\

-----------------EOF-----------------

PAULINE1311 · Answer

Ok, merci beaucoup, c est tres gentil !

===== Rapport WareOut Removal Tool ===== 
 
version 3.6.2 
 
analyse effectuée le 07/09/2009 à  4:39:50,73 
 
Résultats de l'analyse : 
======================== 
 
~~~~ Recherche d'infections dans C:\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Program Files\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Windows\system\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Windows\system32\ ~~~~ 
 
C:\Windows\system32\MSIVXcount trouvé! 
C:\Windows\system32\MSIVXcount suppression impossible 
 
 
~~~~ Recherche d'infections dans C:\Windows\system32\drivers\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Users\Pauline\AppData\Roaming\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Users\Pauline\Bureau\ ~~~~ 
 
 
~~~~ Recherche de détournement de DNS ~~~~ 
 
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8F4BA525-C518-4C61-BB90-4A22EAEA1C6F}]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F5F453FC-7878-4259-A7CB-9DAD2F23E65C}]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8F4BA525-C518-4C61-BB90-4A22EAEA1C6F}]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{F5F453FC-7878-4259-A7CB-9DAD2F23E65C}]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{8F4BA525-C518-4C61-BB90-4A22EAEA1C6F}]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{F5F453FC-7878-4259-A7CB-9DAD2F23E65C}]
    NameServer    REG_SZ    85.255.112.126,85.255.112.150
 
 
~~~~ Recherche de Rootkits ~~~~ 
 
_______________________________________________________________________ 
 
driver loading error disk not found C:\

please note that you need administrator rights to perform deep scan
_______________________________________________________________________ 


 
 
~~~~ Recherche d'infections dans C:\Users\Pauline\AppData\Local\Temp\ ~~~~ 
 
 
~~~~ Recherche d'infections dans C:\Users\Pauline\Start Menu\Programs\ ~~~~ 
 
 
~~~~ Nettoyage du registre ~~~~ 
 
 
~~~~ Tentative de réparation des entrées suivantes: ~~~~ 
 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] = "System" 
 
[HKLM\SYSTEM\CurrentControlSet\Services\Windows Tribute Service] 
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_Windows Tribute Service] 
 
~~~~ Vérification: ~~~~ 


 
 
_________________________________ 
 
développé par http://pc-system.fr 
_________________________________

Trying2 · Answer

1/
Désactive l'UAC :
• Va dans Panneau de Configuration puis Comptes d'Utilisateurs.
• Clique sur "Activer" ou "désactiver" le contrôle des comptes utilisateurs.
• Décoche la case "Utiliser le contrôle des comptes utilisateurs pour vous aider à protéger votre ordinateur".
• Clique sur OK pour enregistrer la modification et redémarre ton PC lorsque cela t'est demandé.

aide en cas de problèmes

2/
Quand ton pc a redémarré:

*Télécharge et installe UsbFix de C_XX & Chiquitine29.

*Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d'avoir été infectés sans les ouvrir.

*Double clique sur le raccourci UsbFix présent sur ton bureau.

*Choisi l'option 1 ( Recherche )

*Laisse travailler l'outil.

*Ensuite poste le rapport UsbFix.txt qui apparaîtra dans ton prochain message.

 Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )
 "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

PAULINE1311 · Answer

############################## | UsbFix V6.026 |

User : Pauline (Administrateurs) # PC-DE-PAULINE
Update on 06/09/2009 by Chiquitine29, C_XX & Chimay8
Start at: 04:59:38 | 07/09/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Core(TM)2 CPU         T5200  @ 1.60GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Enabled

C:\ -> Disque fixe local # 106,62 Go (43,2 Go free) # NTFS
D:\ -> Disque fixe local # 5,16 Go (1,22 Go free) [HP_RECOVERY] # NTFS
E:\ -> Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conime.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\mobsync.exe

################## | Fichiers # Dossiers infectieux |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |

C:\Windows\System32\MSIVXcount  

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{11aa7774-ba81-11dd-8254-0016d31f6bc8}
shell\AutoRun\command =H:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{57ce90a5-97b4-11de-83db-0016d31f6bc8}
shell\AutoRun\command =F:\AutoRun.exe 

HKCU\..\..\Explorer\MountPoints2\{7caaa324-2dd3-11de-b6dc-0016d31f6bc8}
shell\AutoRun\command =F:\PMB_P.exe 

HKCU\..\..\Explorer\MountPoints2\{9b2bd4dc-41ba-11de-8d83-0016d31f6bc8}
shell\AutoRun\command =G:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{b5a21840-6307-11de-bd98-0016d31f6bc8}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Recycled\ctfmon.exe
shell\Open(&0)\command =F:\Recycled\ctfmon.exe 

################## | ! Fin du rapport # UsbFix V6.026 ! |

PAULINE1311 · Answer

J ai un disque dur externe, que j ai branche en  faisant l analyse

PAULINE1311 · Answer

en effet j ai refait letape 1 et le resultat est different..
Voila le compte rendu:
Est ce que je passe quand meme directement a l etape 2?

############################## | UsbFix V6.026 |

User : Pauline (Administrateurs) # PC-DE-PAULINE
Update on 06/09/2009 by Chiquitine29, C_XX & Chimay8
Start at: 05:16:55 | 07/09/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Core(TM)2 CPU         T5200  @ 1.60GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Enabled

C:\ -> Disque fixe local # 106,62 Go (43,2 Go free) # NTFS
D:\ -> Disque fixe local # 5,16 Go (1,22 Go free) [HP_RECOVERY] # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque fixe local # 298,09 Go (182,49 Go free) [Expansion Drive] # NTFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Windows\system32\conime.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |

C:\Windows\System32\MSIVXcount  

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{11aa7774-ba81-11dd-8254-0016d31f6bc8}
shell\AutoRun\command =H:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{57ce90a5-97b4-11de-83db-0016d31f6bc8}
shell\AutoRun\command =F:\AutoRun.exe 

HKCU\..\..\Explorer\MountPoints2\{7caaa324-2dd3-11de-b6dc-0016d31f6bc8}
shell\AutoRun\command =F:\PMB_P.exe 

HKCU\..\..\Explorer\MountPoints2\{9b2bd4dc-41ba-11de-8d83-0016d31f6bc8}
shell\AutoRun\command =G:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{b5a21840-6307-11de-bd98-0016d31f6bc8}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Recycled\ctfmon.exe
shell\Open(&0)\command =F:\Recycled\ctfmon.exe 

################## | ! Fin du rapport # UsbFix V6.026 ! |

PAULINE1311 · Answer

############################## | UsbFix V6.026 |

User : Pauline (Administrateurs) # PC-DE-PAULINE
Update on 06/09/2009 by Chiquitine29, C_XX & Chimay8
Start at: 05:29:49 | 07/09/2009
Website : http://pagesperso-orange.fr/NosTools/index.html

Intel(R) Core(TM)2 CPU         T5200  @ 1.60GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Enabled

C:\ -> Disque fixe local # 106,62 Go (43,14 Go free) # NTFS
D:\ -> Disque fixe local # 5,16 Go (1,22 Go free) [HP_RECOVERY] # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque fixe local # 298,09 Go (182,49 Go free) [Expansion Drive] # NTFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32unonce.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |


################## | Autres |


################## | Suspect ! ... | https://www.virustotal.com/gui/ |

C:\Windows\System32\MSIVXcount  

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{11aa7774-ba81-11dd-8254-0016d31f6bc8}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{57ce90a5-97b4-11de-83db-0016d31f6bc8}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{7caaa324-2dd3-11de-b6dc-0016d31f6bc8}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{9b2bd4dc-41ba-11de-8d83-0016d31f6bc8}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{b5a21840-6307-11de-bd98-0016d31f6bc8}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[19/01/2008 09:45|-rahs----|333203] C:\bootmgr 
[18/09/2006 23:43|--a------|10] C:\config.sys 
[?|?|?] C:\hiberfil.sys 
[27/03/2009 20:55|-rahs----|0] C:\IO.SYS 
[27/03/2009 20:55|-rahs----|0] C:\MSDOS.SYS 
[?|?|?] C:\pagefile.sys 
[07/09/2009 05:33|--a------|3505] C:\UsbFix.txt 
[11/09/2005 17:18|--ahs----|340] D:\AUTOMODE 
[22/11/2008 15:24|---hs----|13] D:\BLOCK.RIN 
[04/10/2006 01:02|---hs----|438328] D:\bootmgr 
[03/11/2006 21:43|---hs----|117] D:\Desktop.ini 
[08/09/2008 15:25|--a------|0] D:\DRECOVERY 
[10/09/2002 18:14|---hs----|8134] D:\Folder.htt 
[08/02/2007 10:00|---hs----|698] D:\MASTER.LOG 
[03/11/2005 17:19|---hs----|181736] D:\protect.ed 
[08/02/2007 10:01|---hs----|0] D:\USER 
[01/09/2009 02:45|--a------|26554] F:\ARTICLES.docx 
[04/09/2009 09:09|--a------|1267595] F:\demographic.pdf 
[07/09/2009 03:59|--a------|215552] F:\Dossier Acryolic.doc 
[07/09/2009 04:03|--a------|11161] F:\finance tutorial 7.pdf 
[04/09/2009 03:18|--a------|14448] F:\http.docx 
[03/09/2009 10:03|--a------|16162] F:\Human rights and environment protection is possible under capitalism.docx 
[07/09/2009 04:16|--a------|19170] F:\info.docx 
[05/09/2009 10:50|--a------|126464] F:\Lectures.doc 
[05/09/2009 04:46|--a------|44524] F:\Lectures.docx 
[07/09/2009 04:15|--a------|19754] F:\Logfile of random.docx 
[05/09/2009 11:21|--ahs----|4] F:\metuint 
[29/08/2009 15:33|--a------|25088] F:\Michael Porter's generic strategies.doc 
[05/09/2009 11:55|--a------|319077160] F:\office2007sp2-kb953195-fullfile-fr-fr.exe 
[07/09/2009 04:11|--a------|346020] F:\partie market.docx 
[22/11/2008 15:27|--a------|44598] F:\Pauline.contact 
[31/08/2009 15:46|--a------|211928] F:\print.pptx 
[05/09/2009 05:11|--a------|30720] F:\Recette.doc 
[05/09/2009 11:23|--a------|2025768] F:\SkypeSetup.exe 
[04/09/2009 09:11|--a------|308840] F:\social economic.pdf 
[07/09/2009 05:20|--a------|4108] F:\UsbFix.txt 
[05/09/2009 11:21|--a------|18015723] F:\vlc-1.0.1-win32.exe 
[27/08/2009 12:45|--a------|9939] F:\Voyage maman.xlsx 
[07/09/2009 04:41|--a------|3226] F:\WORT_report.txt 

################## | ! Fin du rapport # UsbFix V6.026 ! |

PAULINE1311 · Answer

Eh oui, je sais cest tres interessant.. ce sont les sujets sur lesquels on nous demande de reflechir!!

Sinon le probleme des MAJ c'est que mon ordinateur ne peut pas se connecter a internet...la j en utilise un autre avec mon disque dur pour telecharger tous les logiciels...

PAULINE1311 · Answer

Je nai pas encore fait les MAJ mais il en a trouve 17. Voici le rapport:

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2551
Windows 6.0.6001 Service Pack 1

07/09/2009 06:02:06
mbam-log-2009-09-07 (06-02-06).txt

Type de recherche: Examen rapide
Eléments examinés: 79927
Temps écoulé: 6 minute(s), 28 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 9
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BHVideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\BHVideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ColdWare (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8f4ba525-c518-4c61-bb90-4a22eaea1c6f}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f5f453fc-7878-4259-a7cb-9dad2f23e65c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8f4ba525-c518-4c61-bb90-4a22eaea1c6f}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{f5f453fc-7878-4259-a7cb-9dad2f23e65c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{8f4ba525-c518-4c61-bb90-4a22eaea1c6f}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{f5f453fc-7878-4259-a7cb-9dad2f23e65c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.126,85.255.112.150 -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Users\Pauline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BHVideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Program Files\BHVideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\Pauline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BHVideo\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\Program Files\BHVideo\Uninstall.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\System32\MSIVXcount (Trojan.Agent) -> Quarantined and deleted successfully.

PAULINE1311 · Answer

J ai l impression davoir mis les MAJ, mais je ne suis pas convaincu...la date inscrite est le 8 . 3 .2009, est ce normal?

PAULINE1311 · Answer

Voila mon nouveau rapport apres la MAJ, est cuil permet de confirmer aue la MAJ a bien ete faite?

Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2551
Windows 6.0.6001 Service Pack 1

07/09/2009 06:30:59
mbam-log-2009-09-07 (06-30-59).txt

Type de recherche: Examen rapide
Eléments examinés: 80707
Temps écoulé: 6 minute(s), 52 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

PAULINE1311 · Answer

Je viens d'aller essayer de em connecter..et ja i eu le meme probleme..mon ordi a plant au bout d une minute... cela veut dire que probleme vient d ailleurs?

PAULINE1311 · Answer

Je n 'arrive pas a virer avast..du coup je nai pas encore installe lautre..

Non  l ecran n est pas devenu bleu, il a plante veut dire qu il ne repondait plus, lecran devient noir, puis redvient normal, mais je ne peux rien faire du tout..duc oup jai appuyer sur le bouton pour leteindre...

PAULINE1311 · Answer

Je suis toujours la, mais le rapport va mettre du temps a arriver! ca avance tout doucement...
Etant donne que j ai essaye tout a lheure de me connecter et que ca na pas marche, cela signifie t il qu il faille faire d autres manipulations apres celle ci?

PAULINE1311 · Answer

Avira AntiVir Personal
Report file date: lundi 7 septembre 2009  09:21

Scanning for 1684804 virus strains and unwanted programs.

Licensee        : Avira AntiVir Personal - FREE Antivirus
Serial number   : 0000149996-ADJIE-0000001
Platform        : Windows Vista
Windows version : (Service Pack 1)  [6.0.6001]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : PC-DE-PAULINE

Version information:
BUILD.DAT       : 9.0.0.407     17961 Bytes  29/07/2009 10:34:00
AVSCAN.EXE      : 9.0.3.7      466689 Bytes  21/07/2009 12:36:14
AVSCAN.DLL      : 9.0.3.0       40705 Bytes  27/02/2009 09:58:24
LUKE.DLL        : 9.0.3.2      209665 Bytes  20/02/2009 10:35:49
LUKERES.DLL     : 9.0.2.0       12033 Bytes  27/02/2009 09:58:52
ANTIVIR0.VDF    : 7.1.0.0    15603712 Bytes  27/10/2008 12:50:58
ANTIVIR1.VDF    : 7.1.4.132   5707264 Bytes  24/06/2009 12:50:58
ANTIVIR2.VDF    : 7.1.5.201   3414528 Bytes  03/09/2009 12:50:58
ANTIVIR3.VDF    : 7.1.5.210     53760 Bytes  06/09/2009 10:16:12
Engineversion   : 8.2.1.8  
AEVDF.DLL       : 8.1.1.1      106868 Bytes  30/04/2009 13:33:10
AESCRIPT.DLL    : 8.1.2.27     467321 Bytes  03/09/2009 14:24:42
AESCN.DLL       : 8.1.2.5      127346 Bytes  03/09/2009 14:24:42
AERDL.DLL       : 8.1.2.4      430452 Bytes  14/07/2009 16:08:26
AEPACK.DLL      : 8.1.3.18     401783 Bytes  27/05/2009 16:10:34
AEOFFICE.DLL    : 8.1.0.38     196987 Bytes  17/06/2009 13:32:46
AEHEUR.DLL      : 8.1.0.155   1921400 Bytes  18/08/2009 13:02:16
AEHELP.DLL      : 8.1.7.0      237940 Bytes  03/09/2009 14:24:42
AEGEN.DLL       : 8.1.1.60     364915 Bytes  03/09/2009 14:24:42
AEEMU.DLL       : 8.1.0.9      393588 Bytes  15/10/2008 09:49:36
AECORE.DLL      : 8.1.7.8      184692 Bytes  03/09/2009 14:24:42
AEBB.DLL        : 8.1.0.3       53618 Bytes  15/10/2008 09:49:34
AVWINLL.DLL     : 9.0.0.3       18177 Bytes  12/12/2008 07:47:59
AVPREF.DLL      : 9.0.0.1       43777 Bytes  05/12/2008 09:32:15
AVREP.DLL       : 8.0.0.3      155905 Bytes  20/01/2009 13:34:28
AVREG.DLL       : 9.0.0.0       36609 Bytes  05/12/2008 09:32:09
AVARKT.DLL      : 9.0.0.3      292609 Bytes  24/03/2009 14:05:41
AVEVTLOG.DLL    : 9.0.0.7      167169 Bytes  30/01/2009 09:37:08
SQLITE3.DLL     : 3.6.1.0      326401 Bytes  28/01/2009 14:03:49
SMTPLIB.DLL     : 9.2.0.25      28417 Bytes  02/02/2009 07:21:33
NETNT.DLL       : 9.0.0.0       11521 Bytes  05/12/2008 09:32:10
RCIMAGE.DLL     : 9.0.0.25    2438913 Bytes  15/05/2009 14:39:58
RCTEXT.DLL      : 9.0.37.0      86785 Bytes  17/04/2009 09:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, F:, 
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: lundi 7 septembre 2009  09:21

Starting search for hidden objects.
'90250' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'HPHC_Service.exe' - '1' Module(s) have been scanned
Scan process 'HPQTOA~1.EXE' - '1' Module(s) have been scanned
Scan process 'ehmsas.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'ONENOTEM.EXE' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'ehtray.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'HPWAMain.exe' - '1' Module(s) have been scanned
Scan process 'WiFiMsg.exe' - '1' Module(s) have been scanned
Scan process 'QLBCTRL.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'QPService.exe' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'igfxtray.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'MSASCui.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'CLSched.exe' - '1' Module(s) have been scanned
Scan process 'hpqwmiex.exe' - '1' Module(s) have been scanned
Scan process 'XAudio.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
58 processes with 58 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!
Master boot sector HD1
    [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!
Boot sector 'D:\'
    [INFO]      No virus was found!
Boot sector 'F:\'
    [INFO]      No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '43' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
    [WARNING]   The file could not be opened!
    [NOTE]      This file is a Windows system file.
    [NOTE]      This file cannot be opened for scanning.
C:\pagefile.sys
    [WARNING]   The file could not be opened!
    [NOTE]      This file is a Windows system file.
    [NOTE]      This file cannot be opened for scanning.
C:\WINDOWS\SoftwareDistribution\Download\bb3b8ccf16c00a8c45dc6a7543cd45ce\BIT1DDD.tmp
  [0] Archive type: CAB (Microsoft)
    --> 0
      [WARNING]   No further files can be extracted from this archive. The archive will be closed
    [WARNING]   No further files can be extracted from this archive. The archive will be closed
Begin scan in 'D:\' <HP_RECOVERY>
Begin scan in 'F:\'
Search path F:\ could not be opened!
System error [3]: Le chemin d'accès spécifié est introuvable.


End of the scan: lundi 7 septembre 2009  10:32
Used time:  1:11:48 Hour(s)

The scan has been done completely.

  17771 Scanned directories
 304893 Files were scanned
      0 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      0 Files were moved to quarantine
      0 Files were renamed
      2 Files cannot be scanned
 304891 Files not concerned
   1744 Archives were scanned
      4 Warnings
      2 Notes
  90250 Objects were scanned with rootkit scan
      0 Hidden objects were found

PAULINE1311 · Answer

Voila le rapport RSIT; que dois je faire maintenant?


Logfile of random's system information tool 1.06 (written by random/random)
Run by Pauline at 2009-09-07 10:43:32
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 44 GB (41%) free of 109 GB
Total RAM: 1013 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:44:04, on 07/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Pauline\Desktop\RSIT.exe
C:\Users\Pauline\Desktop\Pauline.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix: 
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{51645E9D-64DF-4B07-ABFC-A8872EC6F540}: NameServer = 10.188.66.103 10.176.66.71
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Update Service (gupdate1c9a671ccca2970) (gupdate1c9a671ccca2970) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

pauline1311 · Answer

Alors oui j'ai essayé par hasard auourdh'ui et mon ordi s'est mis à marcher! C 'est enfin bon!! Merci bcp bcp bcp bcp c'est très gentil!
Dois je tout de même faire la derniere manipulation demandée??

pauline1311 · Answer

Ok je fais cette manipulation cette nuit, cra la on va me couper mon wifi donc je n'aurai pas le temps! J'envoie le rapport plutard!

pauline1311 · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
Folder move failed. C:\Program Files\RegCure scheduled to be moved on reboot.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SRQN71U9\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RL7E2Q0V\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QPV5H4DI\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DRQ6W980\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SRQN71U9\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RL7E2Q0V\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QPV5H4DI\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DRQ6W980\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Pauline
->Temp folder emptied: 3876388 bytes
->Temporary Internet Files folder emptied: 8285330 bytes
->Java cache emptied: 18190082 bytes
->FireFox cache emptied: 51903989 bytes
->Google Chrome cache emptied: 6252361 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\Windows	emp\fwtsqmfile00.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile01.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile02.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile03.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile04.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows	emp\fwtsqmfile05.sqm scheduled to be deleted on reboot.
Windows Temp folder emptied: 1636723 bytes
RecycleBin emptied: 286874178 bytes
 
Total Files Cleaned = 359,62 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 09092009_164108

Files moved on Reboot...
Folder move failed. C:\Program Files\RegCure scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SRQN71U9\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RL7E2Q0V\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QPV5H4DI\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DRQ6W980\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SRQN71U9\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RL7E2Q0V\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QPV5H4DI\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DRQ6W980\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows	emp\fwtsqmfile00.sqm scheduled to be moved on reboot.
File move failed. C:\Windows	emp\fwtsqmfile01.sqm scheduled to be moved on reboot.
File move failed. C:\Windows	emp\fwtsqmfile02.sqm scheduled to be moved on reboot.
File move failed. C:\Windows	emp\fwtsqmfile03.sqm scheduled to be moved on reboot.
File move failed. C:\Windows	emp\fwtsqmfile04.sqm scheduled to be moved on reboot.
File move failed. C:\Windows	emp\fwtsqmfile05.sqm scheduled to be moved on reboot.

Registry entries deleted on Reboot...

pauline1311 · Answer

Voila mon rapport, cependant je n'ai pas pu purger ma restauration, mais je ne pense pas avoir d epoint de restauratioN.

[ Rapport ToolsCleaner version 2.3.10 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\UsbFix.txt: trouvé !
C:\_OTM: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\WORT: trouvé !
C:\Users\Pauline\Desktop\HijackThis.exe: trouvé !
C:\Users\Pauline\Desktop\Logiciels Virus\OTM.exe: trouvé !
C:\Users\Pauline\Desktop\Logiciels Virus\WareOut Removal Tool.bat: trouvé !
C:\Users\Pauline\Desktop\Logiciels Virus\UsbFix.exe: trouvé !
C:\Users\Pauline\Desktop\Logiciels Virus\Rsit.exe: trouvé !
C:\Users\Pauline\Desktop\Logiciels Virus\WORT.exe: trouvé !
C:\Users\Pauline\Desktop\Logiciels Virus\WORT: trouvé !
C:\Users\Pauline\Desktop\Logiciels Virus\WORT\catchme.exe: trouvé !

---------------------------------
--> Suppression: 

C:\Users\Pauline\Desktop\HijackThis.exe: supprimé !
C:\Users\Pauline\Desktop\Logiciels Virus\OTM.exe: supprimé !
C:\Users\Pauline\Desktop\Logiciels Virus\WareOut Removal Tool.bat: supprimé !
C:\Users\Pauline\Desktop\Logiciels Virus\WORT\catchme.exe: supprimé !
C:\UsbFix.txt: supprimé !
C:\Users\Pauline\Desktop\Logiciels Virus\UsbFix.exe: supprimé !
C:\Users\Pauline\Desktop\Logiciels Virus\Rsit.exe: supprimé !
C:\Users\Pauline\Desktop\Logiciels Virus\WORT.exe: supprimé !
C:\_OTM: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\WORT: supprimé !
C:\Users\Pauline\Desktop\Logiciels Virus\WORT: supprimé !

pauline1311 · Answer

Je n'ai juste pasc trop compris comment creer un point de restauration. Car la mon ordi est au top donc autant le creer maintenant!
En tout cas merci beaucoup beaucoup pour tout le temps passé à m'aider, je ne m'en serais jamais sorti! C'est très sympa!!
Merci:)

pauline1311 · Answer

Bon et bien je suis une nouvelle fois perdue, j ai bien effacer les anciens points de restauration, j en ai creer un nouveau. Maintenant a chaque fois que je me connecte a internet, ca marche, ce n est pas bloque comme avant mais au bout d un moment, tout devient tre lent, et je ne peux plus rien faire a moins d attendre 1 heure pour une page...Cela veut il dire qu j ai toujours des virus?

VIRUS OU PROBLEME DE WINDOWS?

24 réponses

Votre réponse

Newsletters