gros probléme pc!,mon rappoert est il clean??Fermé

Question

Bonjour,
je ne peux plus éteindre mon pc,vista bloque sur arrêt en cours ,comme j'ai tout essayé... vraiment ,reste l'infection... mon rapport est il clean??  MERCIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII

plopus · Answer

salut

de quel rapport tu parle ? poste le deja ou fait ceci :

    *  Télécharge Random's system information tool (RSIT) et enregistre le sur ton bureau.
http://images.malwareremoval.com/random/RSIT.exe
    * Double clique sur RSIT.exe pour lancer l'outil.
    * Clique sur ' continue ' à l'écran Disclaimer.
    * Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
    * Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports.


( C:\RSIT\log.txt & C:\RSIT\info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

ultraboom · Answer

pardon voici mon rapport...............


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:29, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Evidence Eliminator\Ee.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Trend Micro\HijackThis\best.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\ee.exe /m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

ultraboom · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:29, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Evidence Eliminator\Ee.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Trend Micro\HijackThis\best.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\ee.exe /m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

plopus · Answer

re

tu as quoi comme probleme exactement ?

va dans le panneau de configuration et desinstalle :

Evidence Eliminator

ensuite poste le rapport RSIT que j'ai demandé au poste 1 stp

ultraboom · Answer

voici le rapport .... Merci

Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 10:56:52
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 64 GB (46%) free of 141 GB
Total RAM: 2046 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:21, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\alexdiane\Documents\Downloads\Programs\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\ee.exe /m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

plopus · Answer

peut tu repondre a mes questions....

qu'as tu comme probleme ?


tu n'as pas desinstaller :

Evidence Eliminator


clic ici https://www.virustotal.com/gui/
et clic sur parourir en milieu de page dans la nouvelle fentre tu copie colle la ligne ci dessous et clic sir ouvrir puis envoyer.
un rapport va s'etablir copie colle le ici en entier avec le nom du fichier en entete

fait sa avec  :

C:\Windows\system32\rotscxxfvvcnic.dll     
C:\Windows\system32\rotscxukfpxvrb.dll    


il y a 2 ou 3 trcu a supprimer dans ton log, on s'en charge dès que tu reponds a mes questions et poste les rapports demandés

ultraboom · Answer

voila je suis de retour ,encore merci....

Srpski | &#1052;&#1072;&#1082;&#1077;&#1076;&#1086;&#1085;&#1089;&#1082;&#1080; | &#1575;&#1604;&#1593;&#1585;&#1576;&#1610;&#1577; | Suomi | ihMdI |  | &#1506;&#1489;&#1512;&#1497;&#1514; |  | Slovenš&#269;ina | Dansk | &#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081; | Român&#259; | Türkçe | Nederlands | &#917;&#955;&#955;&#951;&#957;&#953;&#954;&#940; | Svenska | Português | Italiano |  |  | Magyar | Deutsch | &#268;esky | Polski | Español | English
Virus Total 	
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier 77EB16EE001178ABB2E400D105F8EF00A95B04F4.dll reçu le 2009.09.06 11:36:56 (UTC)
Situation actuelle: terminé
Résultat: 6/41 (14.63%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.24 	2009.09.06 	-
AhnLab-V3 	5.0.0.2 	2009.09.05 	-
AntiVir 	7.9.1.8 	2009.09.06 	-
Antiy-AVL 	2.0.3.7 	2009.09.04 	-
Authentium 	5.1.2.4 	2009.09.05 	-
Avast 	4.8.1351.0 	2009.09.05 	Win32:Alureon-CW
AVG 	8.5.0.409 	2009.09.06 	Win32/Rustock.Q
BitDefender 	7.2 	2009.09.06 	-
CAT-QuickHeal 	10.00 	2009.09.05 	-
ClamAV 	0.94.1 	2009.09.06 	-
Comodo 	2196 	2009.09.06 	-
DrWeb 	5.0.0.12182 	2009.09.06 	-
eSafe 	7.0.17.0 	2009.09.03 	-
eTrust-Vet 	31.6.6721 	2009.09.04 	-
F-Prot 	4.5.1.85 	2009.09.05 	-
F-Secure 	8.0.14470.0 	2009.09.06 	-
Fortinet 	3.120.0.0 	2009.09.06 	-
GData 	19 	2009.09.06 	Win32:Alureon-CW
Ikarus 	T3.1.1.72.0 	2009.09.06 	-
Jiangmin 	11.0.800 	2009.09.06 	-
K7AntiVirus 	7.10.837 	2009.09.05 	-
Kaspersky 	7.0.0.125 	2009.09.06 	Packed.Win32.TDSS.z
McAfee 	5732 	2009.09.05 	-
McAfee+Artemis 	5732 	2009.09.05 	-
McAfee-GW-Edition 	6.8.5 	2009.09.06 	-
Microsoft 	1.5005 	2009.09.06 	Trojan:Win32/Alureon.gen!U
NOD32 	4399 	2009.09.05 	-
Norman 	6.01.09 	2009.09.04 	-
nProtect 	2009.1.8.0 	2009.09.06 	-
Panda 	10.0.2.2 	2009.09.06 	-
PCTools 	4.4.2.0 	2009.09.04 	-
Prevx 	3.0 	2009.09.06 	High Risk Rootkit
Rising 	21.45.14.00 	2009.09.01 	-
Sophos 	4.45.0 	2009.09.06 	-
Sunbelt 	3.2.1858.2 	2009.09.05 	-
Symantec 	1.4.4.12 	2009.09.06 	-
TheHacker 	6.3.4.3.396 	2009.09.04 	-
TrendMicro 	8.950.0.1094 	2009.09.05 	-
VBA32 	3.12.10.10 	2009.09.05 	-
ViRobot 	2009.9.4.1919 	2009.09.04 	-
VirusBuster 	4.6.5.0 	2009.09.05 	-
Information additionnelle
File size: 45568 bytes
MD5   : 562d5d9fcf5be8a2b88e2026ccb59a6c
SHA1  : 3d19cac477a294dcff1da5094a8eb4786f44f12e
SHA256: 61dbc7b47b6e16ea56a7e1ffb8c570e37e4ce45627ed5925686ba5fbe499379b
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1632
timedatestamp.....: 0x4A9BC9EE (Mon Aug 31 15:02:38 2009)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3070 0x3200 7.41 9dec78f8bb5b6d22a81d9b09abd3491a
.rdata 0x5000 0x2A50 0x2C00 7.49 85bc5eeceb48d24946a00c5cd6dfac8c
.data 0x8000 0x22B7 0x2400 7.74 30f281f0cc53792b3c1f644bed7c9519
.rsrc 0xB000 0x28CB 0x2A00 7.48 378b078079c52a27d777c01df4e69c96
.reloc 0xE000 0x36 0x200 0.83 4e7b24ccd5522e7f06caecf8bd5151e7

( 5 imports )

> comdlg32.dll: LoadAlterBitmap, Ssync_ANSI_UNICODE_Struct_For_WOW, CommDlgExtendedError, FindTextA, PageSetupDlgA, GetOpenFileNameA, PrintDlgA, GetFileTitleW
> kernel32.dll: CreateDirectoryA, GetProcAddress, GetSystemDefaultLCID, SetCurrentDirectoryW, GetLongPathNameA, DosDateTimeToFileTime, GetEnvironmentVariableA, FreeLibraryAndExitThread, VirtualFree, GetLastError, GetCurrentProcess, GetLocaleInfoA, EraseTape, AddAtomA, GetTempPathA, GetVersionExW, CallNamedPipeA, VerLanguageNameW, FindResourceA, FindFirstFileExW, GetProcessHeap, GetComputerNameA, GetStartupInfoW, GetFileSize, DeleteFiber, HeapDestroy, GetFileType, VirtualAlloc, SetFileTime, MoveFileExA, CreateSemaphoreA
> msvcrt.dll: __crtLCMapStringA, _tolower, ___7bad_typeid@@6B@, _wexecv, _fstati64, _terminate@@YAXXZ, atoi, memcpy, _fstat, __0bad_cast@@QAE@ABV0@@Z, rand, atan, __set_new_mode@@YAHH@Z, _getws, __p__fileinfo, sscanf
> opengl32.dll: glFrustum, GlmfEndGlsBlock, glFogi, glVertex3sv, glPixelTransferi, glEdgeFlagv, glIndexPointer, glGetIntegerv, glVertex3f, glGetTexParameterfv, wglDeleteContext, glVertex2iv, glTexCoord3iv
> winmm.dll: midiInGetNumDevs, DrvGetModuleHandle, mmioSeek, joySetThreshold, auxOutMessage, midiOutOpen, midiOutGetDevCapsW, midiInPrepareHeader, DriverCallback

( 1 exports )

> RvhooaHx, OoiEzgrqoOersrf, RngQvot, BwhCkuzsGyzfqi, ZjclvjlBu
TrID  : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 768:cYUS2m6/3dFJc8SDuqQj/TFQJTeY1WSJpEbqCs4q9NbkNwJLl+xCRHfMMJw:cYUbJvLJc8SDuqQj/TOgSTRNbR+xCR/M
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=77EB16EE001178ABB2E400D105F8EF00A95B04F4
PEiD  : -
RDS   : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier

ultraboom · Answer

voici le second.... je suis infecté!!!

Srpski | &#1052;&#1072;&#1082;&#1077;&#1076;&#1086;&#1085;&#1089;&#1082;&#1080; | &#1575;&#1604;&#1593;&#1585;&#1576;&#1610;&#1577; | Suomi | ihMdI |  | &#1506;&#1489;&#1512;&#1497;&#1514; |  | Slovenš&#269;ina | Dansk | &#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081; | Român&#259; | Türkçe | Nederlands | &#917;&#955;&#955;&#951;&#957;&#953;&#954;&#940; | Svenska | Português | Italiano |  |  | Magyar | Deutsch | &#268;esky | Polski | Español | English
Virus Total 	
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier 77EB16EE001178ABB2E400D105F8EF00A95B04F4.dll reçu le 2009.09.06 11:36:56 (UTC)
Situation actuelle: terminé
Résultat: 6/41 (14.63%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.24 	2009.09.06 	-
AhnLab-V3 	5.0.0.2 	2009.09.05 	-
AntiVir 	7.9.1.8 	2009.09.06 	-
Antiy-AVL 	2.0.3.7 	2009.09.04 	-
Authentium 	5.1.2.4 	2009.09.05 	-
Avast 	4.8.1351.0 	2009.09.05 	Win32:Alureon-CW
AVG 	8.5.0.409 	2009.09.06 	Win32/Rustock.Q
BitDefender 	7.2 	2009.09.06 	-
CAT-QuickHeal 	10.00 	2009.09.05 	-
ClamAV 	0.94.1 	2009.09.06 	-
Comodo 	2196 	2009.09.06 	-
DrWeb 	5.0.0.12182 	2009.09.06 	-
eSafe 	7.0.17.0 	2009.09.03 	-
eTrust-Vet 	31.6.6721 	2009.09.04 	-
F-Prot 	4.5.1.85 	2009.09.05 	-
F-Secure 	8.0.14470.0 	2009.09.06 	-
Fortinet 	3.120.0.0 	2009.09.06 	-
GData 	19 	2009.09.06 	Win32:Alureon-CW
Ikarus 	T3.1.1.72.0 	2009.09.06 	-
Jiangmin 	11.0.800 	2009.09.06 	-
K7AntiVirus 	7.10.837 	2009.09.05 	-
Kaspersky 	7.0.0.125 	2009.09.06 	Packed.Win32.TDSS.z
McAfee 	5732 	2009.09.05 	-
McAfee+Artemis 	5732 	2009.09.05 	-
McAfee-GW-Edition 	6.8.5 	2009.09.06 	-
Microsoft 	1.5005 	2009.09.06 	Trojan:Win32/Alureon.gen!U
NOD32 	4399 	2009.09.05 	-
Norman 	6.01.09 	2009.09.04 	-
nProtect 	2009.1.8.0 	2009.09.06 	-
Panda 	10.0.2.2 	2009.09.06 	-
PCTools 	4.4.2.0 	2009.09.04 	-
Prevx 	3.0 	2009.09.06 	High Risk Rootkit
Rising 	21.45.14.00 	2009.09.01 	-
Sophos 	4.45.0 	2009.09.06 	-
Sunbelt 	3.2.1858.2 	2009.09.05 	-
Symantec 	1.4.4.12 	2009.09.06 	-
TheHacker 	6.3.4.3.396 	2009.09.04 	-
TrendMicro 	8.950.0.1094 	2009.09.05 	-
VBA32 	3.12.10.10 	2009.09.05 	-
ViRobot 	2009.9.4.1919 	2009.09.04 	-
VirusBuster 	4.6.5.0 	2009.09.05 	-
Information additionnelle
File size: 45568 bytes
MD5   : 562d5d9fcf5be8a2b88e2026ccb59a6c
SHA1  : 3d19cac477a294dcff1da5094a8eb4786f44f12e
SHA256: 61dbc7b47b6e16ea56a7e1ffb8c570e37e4ce45627ed5925686ba5fbe499379b
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1632
timedatestamp.....: 0x4A9BC9EE (Mon Aug 31 15:02:38 2009)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3070 0x3200 7.41 9dec78f8bb5b6d22a81d9b09abd3491a
.rdata 0x5000 0x2A50 0x2C00 7.49 85bc5eeceb48d24946a00c5cd6dfac8c
.data 0x8000 0x22B7 0x2400 7.74 30f281f0cc53792b3c1f644bed7c9519
.rsrc 0xB000 0x28CB 0x2A00 7.48 378b078079c52a27d777c01df4e69c96
.reloc 0xE000 0x36 0x200 0.83 4e7b24ccd5522e7f06caecf8bd5151e7

( 5 imports )

> comdlg32.dll: LoadAlterBitmap, Ssync_ANSI_UNICODE_Struct_For_WOW, CommDlgExtendedError, FindTextA, PageSetupDlgA, GetOpenFileNameA, PrintDlgA, GetFileTitleW
> kernel32.dll: CreateDirectoryA, GetProcAddress, GetSystemDefaultLCID, SetCurrentDirectoryW, GetLongPathNameA, DosDateTimeToFileTime, GetEnvironmentVariableA, FreeLibraryAndExitThread, VirtualFree, GetLastError, GetCurrentProcess, GetLocaleInfoA, EraseTape, AddAtomA, GetTempPathA, GetVersionExW, CallNamedPipeA, VerLanguageNameW, FindResourceA, FindFirstFileExW, GetProcessHeap, GetComputerNameA, GetStartupInfoW, GetFileSize, DeleteFiber, HeapDestroy, GetFileType, VirtualAlloc, SetFileTime, MoveFileExA, CreateSemaphoreA
> msvcrt.dll: __crtLCMapStringA, _tolower, ___7bad_typeid@@6B@, _wexecv, _fstati64, _terminate@@YAXXZ, atoi, memcpy, _fstat, __0bad_cast@@QAE@ABV0@@Z, rand, atan, __set_new_mode@@YAHH@Z, _getws, __p__fileinfo, sscanf
> opengl32.dll: glFrustum, GlmfEndGlsBlock, glFogi, glVertex3sv, glPixelTransferi, glEdgeFlagv, glIndexPointer, glGetIntegerv, glVertex3f, glGetTexParameterfv, wglDeleteContext, glVertex2iv, glTexCoord3iv
> winmm.dll: midiInGetNumDevs, DrvGetModuleHandle, mmioSeek, joySetThreshold, auxOutMessage, midiOutOpen, midiOutGetDevCapsW, midiInPrepareHeader, DriverCallback

( 1 exports )

> RvhooaHx, OoiEzgrqoOersrf, RngQvot, BwhCkuzsGyzfqi, ZjclvjlBu
TrID  : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ssdeep: 768:cYUS2m6/3dFJc8SDuqQj/TFQJTeY1WSJpEbqCs4q9NbkNwJLl+xCRHfMMJw:cYUbJvLJc8SDuqQj/TOgSTRNbR+xCR/M
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=77EB16EE001178ABB2E400D105F8EF00A95B04F4
PEiD  : -
RDS   : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier
VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

ultraboom · Answer

c'est dingue rootkit buster ne vois rien, nod 32 ne vois rien, trojan remover ne voit rien!!! et le rapport hijack this ne paraissait pas infecté!!! je ne comprend pas????

plopus · Answer

salut

normal que l'infection etait pas trés visible c'est un rootkit, qui ne se voit pas ou peut dans les rapport et n'est pas ou trés peu detecté par les antivirus (comme tu vois sur les rapport virus total) mais cela ne suffit pas


clic droit sur le lien ci dessous et choisit "enregsitré la cible du lien sous"
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

tu enregsitre le fichier sur ton BUREAU, et tu le renomme en ton prenom

puis deconnecte toi d'internet et DESACTIVE ton antivirus, lance le fichier et ne touche + a rien jusqu' a la fin et poste le rapport

puis

    *  Télécharge Malwarebytes
    http://www.malwarebytes.org/mbam/program/mbam-setup.exe
    * Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
    * Lance une analyse complète en cliquant sur "Exécuter un examen complet"
    * Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
    * L'analyse peut durer un bon moment.....
    * Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
    * Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
    * Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée

ultraboom · Answer

encore merci de prendre du temps pour moi...


Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 17:46:16
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 64 GB (46%) free of 141 GB
Total RAM: 2046 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:46:21, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\IELowutil.exe
C:\Windows\system32\msfeedssync.exe
C:\Users\alexdiane\Desktop\alexdiane.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

ultraboom · Answer

encore merci de prndre du temps pour m'aider........


Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 17:46:16
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 64 GB (46%) free of 141 GB
Total RAM: 2046 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:46:21, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\IELowutil.exe
C:\Windows\system32\msfeedssync.exe
C:\Users\alexdiane\Desktop\alexdiane.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

plopus · Answer

j'ai edité mon lien du precedent poste je me suis trompé....


refait le stp et renomme bien le fichier sur ton bureau et lance le

ultraboom · Answer

voila j'espére que c'est bon.......



Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 18:21:23
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 64 GB (46%) free of 141 GB
Total RAM: 2046 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:26, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\alexdiane\Desktop\alex.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

plopus · Answer

non fait sa :

clic droit sur le lien ci dessous et choisit "enregsitré la cible du lien sous"
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

tu enregsitre le fichier sur ton BUREAU, et tu le renomme en ton prenom

puis deconnecte toi d'internet et DESACTIVE ton antivirus, lance le fichier et ne touche + a rien jusqu' a la fin et poste le rapport

puis

* Télécharge Malwarebytes
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
* Fais la mise à jour du logiciel (elle se fait normalement à l'installation)
* Lance une analyse complète en cliquant sur "Exécuter un examen complet"
* Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"
* L'analyse peut durer un bon moment.....
* Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"
* Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"
* Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum

* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée

ultraboom · Answer

alors j'ai un probléme,il m'est impossible de désactivé le scanner de zone alarm,alors que j'ai éteint zone alarm.....
que faire?

plopus · Answer

tu clic droit sur l'icone de zone alarm en bas a droite et choisit quitté

si sa marche pas lance le comme sa mais autorise combofix (qui doit etre renommé) si on te demande un acces a internet ou autres

ultraboom · Answer

ca je l'avais bien évidement fait.... mais en fait avanit d'éteindre zone alarm il faut entrée dans l'anti spyware de zone alarm et l'éteindre sinon  le scan de l'anti spaware continu même zone alarm éteint!!! dingue!!

ComboFix 09-09-17.04 - alexdiane 18/09/2009 19:03.1.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.2046.1212 [GMT 2:00]
Lancé depuis: c:\users\alexdiane\Desktop\alexandre.exe
FW: ZoneAlarm Pro Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
SP: Spy Emergency *disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: ZoneAlarm Pro Anti-Spyware *disabled* (Updated) {F245A209-1085-48B4-B927-35D56015EC60}
 * Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\alexdiane\AppData\Roaming\inst.exe
c:\users\alexdiane\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
c:\users\alexdiane\AppData\Roaming\Microsoft\svchost.exe
c:\users\alexdiane\AppData\Roaming\msnmsgr.exe
c:\windowsefsdm.dll
c:\windows\system32\drivers
pf.sys
c:\windows\system32\oem2.inf
c:\windows\system32\oem4.inf
c:\windows\system32\oem46.inf
c:\windows\system32\Packet.dll
c:\windows\system32otscxsgcpsnbe.dat
c:\windows\system32otscxsqqvitmk.dll
c:\windows\system32otscxukfpxvrb.dll
c:\windows\system32otscxxfvvcnic.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


(((((((((((((((((((((((((((((   Fichiers créés du 2009-08-18 au 2009-09-18  ))))))))))))))))))))))))))))))))))))
.

2009-09-18 16:44 . 2009-09-18 16:49	--------	d-----w-	c:\windows\vf_hip
2009-09-18 16:44 . 2009-09-18 16:47	--------	d-----w-	c:\program files\Hide IP Platinum
2009-09-18 08:56 . 2009-09-18 08:57	--------	d-----w-	C:sit
2009-09-18 08:50 . 2009-09-18 08:50	2560	----a-w-	c:\windows\_MSRSTRT.EXE
2009-09-16 12:07 . 2009-09-16 12:07	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\TuneUp Software
2009-09-16 12:07 . 2009-09-16 12:07	--------	d-----w-	c:\programdata\TuneUp Software
2009-09-14 20:54 . 2009-09-14 23:15	--------	d-----w-	c:\users\alexdiane\{d1bf494b-9102-4956-9235-227abdda7cab}
2009-09-14 20:53 . 2009-08-05 14:10	831488	----a-w-	c:\windows\RtlExUpd.dll
2009-09-14 20:39 . 2009-09-14 20:39	--------	d-----w-	C:\found.001
2009-09-14 20:18 . 2009-09-14 23:15	--------	d--h--w-	c:\program files\Temp
2009-09-14 20:03 . 2009-09-14 20:05	--------	d-----w-	c:\program files\Trojan Remover
2009-09-14 20:03 . 2009-09-14 20:03	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\Simply Super Software
2009-09-14 18:46 . 2009-09-14 18:46	--------	d-----w-	C:\found.000
2009-09-12 21:31 . 2009-09-12 21:31	153104	----a-w-	c:\windows\system32\drivers	mcomm.sys
2009-09-11 08:48 . 2009-02-15 21:10	69000	----a-w-	c:\windows\system32\zlcomm.dll
2009-09-11 08:48 . 2009-02-15 21:10	103816	----a-w-	c:\windows\system32\zlcommdb.dll
2009-09-11 08:48 . 2009-02-15 21:10	1221512	----a-w-	c:\windows\system32\zpeng25.dll
2009-09-11 08:48 . 2009-09-11 08:48	--------	d-----w-	c:\program files\Zone Labs
2009-09-11 08:47 . 2009-09-17 16:31	--------	d-----w-	c:\windows\system32\ZoneLabs
2009-09-11 08:47 . 2009-02-15 21:11	293528	----a-w-	c:\windows\system32\drivers\vsdatant.sys
2009-09-11 08:46 . 2009-09-18 16:42	--------	d-----w-	c:\windows\Internet Logs
2009-09-09 08:58 . 2009-08-14 16:27	904776	----a-w-	c:\windows\system32\drivers	cpip.sys
2009-09-09 08:58 . 2009-08-14 13:48	105984	----a-w-	c:\windows\system32
etiohlp.dll
2009-09-09 08:58 . 2009-08-14 13:49	9728	----a-w-	c:\windows\system32\TCPSVCS.EXE
2009-09-09 08:58 . 2009-08-14 13:49	27136	----a-w-	c:\windows\system32\NETSTAT.EXE
2009-09-09 08:58 . 2009-08-14 13:49	19968	----a-w-	c:\windows\system32\ARP.EXE
2009-09-09 08:58 . 2009-08-14 13:49	17920	----a-w-	c:\windows\system32\ROUTE.EXE
2009-09-09 08:58 . 2009-08-14 13:49	11264	----a-w-	c:\windows\system32\MRINFO.EXE
2009-09-09 08:58 . 2009-08-14 13:49	8704	----a-w-	c:\windows\system32\HOSTNAME.EXE
2009-09-09 08:58 . 2009-08-14 13:49	10240	----a-w-	c:\windows\system32\finger.exe
2009-09-09 08:58 . 2009-08-14 13:48	30720	----a-w-	c:\windows\system32\drivers	cpipreg.sys
2009-09-09 08:58 . 2009-08-14 15:53	17920	----a-w-	c:\windows\system32
etevent.dll
2009-09-09 08:57 . 2009-07-11 19:01	302592	----a-w-	c:\windows\system32\wlansec.dll
2009-09-09 08:57 . 2009-07-11 19:01	293376	----a-w-	c:\windows\system32\wlanmsm.dll
2009-09-09 08:57 . 2009-07-11 17:03	127488	----a-w-	c:\windows\system32\L2SecHC.dll
2009-09-09 08:57 . 2009-07-11 19:01	513536	----a-w-	c:\windows\system32\wlansvc.dll
2009-09-09 08:57 . 2009-07-11 19:01	65024	----a-w-	c:\windows\system32\wlanapi.dll
2009-09-09 08:57 . 2009-06-10 11:41	2868224	----a-w-	c:\windows\system32\mf.dll
2009-09-08 19:16 . 2009-09-08 19:16	--------	d-----w-	c:\programdata\Simply Super Software
2009-09-08 16:05 . 2009-09-08 16:05	--------	d-----w-	c:\users\alexdiane\AppData\Local\Evidence Eliminator
2009-09-07 16:48 . 1998-04-23 22:00	368912	----a-w-	c:\windows\system32\vbar332.dll
2009-09-06 18:32 . 2009-09-06 18:32	--------	d-----w-	c:\users\alexdiane\{7e60e431-5cbc-42ed-8184-f18fc4e026a9}
2009-09-04 16:14 . 2009-09-04 16:14	--------	d-----w-	c:\programdata\Pinnacle
2009-09-04 11:44 . 2009-09-04 12:09	--------	d-----w-	c:\windows\Internet Logs(32)
2009-09-04 10:54 . 2009-09-04 10:54	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\Publish Providers
2009-09-04 09:55 . 2009-09-06 13:03	--------	d-----w-	c:\programdata\Sony
2009-09-03 17:31 . 2009-08-29 00:14	28672	----a-w-	c:\windows\system32\Apphlpdm.dll
2009-09-03 17:31 . 2009-08-29 00:27	4240384	----a-w-	c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-01 20:18 . 2009-09-01 20:18	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\NeroDigital(TM)
2009-09-01 10:55 . 2009-09-01 10:55	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\NeatImage PS
2009-08-31 22:42 . 2009-08-31 22:42	--------	d-----w-	c:\programdata\Zillatech
2009-08-31 18:32 . 2009-09-14 22:44	--------	d-----w-	c:\program files\Advanced Registry Doctor
2009-08-30 14:34 . 2009-09-04 10:55	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\Sony
2009-08-30 14:34 . 2009-09-04 10:46	--------	d-----w-	c:\users\alexdiane\AppData\Local\Sony
2009-08-27 18:30 . 2009-06-22 10:09	2048	----a-w-	c:\windows\system32	zres.dll
2009-08-19 21:26 . 2009-08-19 21:26	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\PC Tools
2009-08-19 20:06 . 2009-08-29 19:12	--------	d-----w-	c:\programdata\PC Tools

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-18 17:16 . 2009-05-30 22:34	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\DMCache
2009-09-18 17:13 . 2009-09-11 08:47	350197	---ha-w-	c:\windows\system32\drivers\vsconfig.xml
2009-09-18 17:13 . 2009-06-14 22:42	78199	----a-w-	c:\programdata
vModes.dat
2009-09-18 16:49 . 2009-08-09 13:26	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\uTorrent
2009-09-16 17:23 . 2009-08-08 19:04	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\LimeWire
2009-09-16 15:03 . 2009-01-12 16:47	123556	----a-w-	c:\windows\system32\perfc00C.dat
2009-09-16 15:03 . 2009-01-12 16:47	0	----a-w-	c:\windows\system32\perfh00C.dat
2009-09-16 12:05 . 2009-05-30 22:46	--------	d-sh--w-	c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}
2009-09-15 17:18 . 2009-06-20 17:57	680	----a-w-	c:\users\alexdiane\AppData\Local\d3d9caps.dat
2009-09-15 10:27 . 2009-01-12 10:08	--------	d-----w-	c:\programdata\NVIDIA
2009-09-14 22:45 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-09-14 22:44 . 2009-08-15 09:29	--------	d-----w-	c:\program files\UnHackMe
2009-09-14 22:44 . 2009-06-23 21:54	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\dvdcss
2009-09-14 22:44 . 2009-06-23 21:54	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\vlc
2009-09-14 22:44 . 2009-05-30 22:50	--------	d-----w-	c:\program files\Wise Registry Cleaner
2009-09-14 22:44 . 2009-07-14 21:01	--------	d-----w-	c:\program files\QuickTime
2009-09-14 22:44 . 2009-06-01 19:51	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-09-14 22:44 . 2009-01-12 08:08	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-09-14 20:54 . 2009-01-12 09:49	319456	----a-w-	c:\windows\DIFxAPI.dll
2009-09-11 08:31 . 2009-05-31 11:36	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\Skype
2009-09-11 08:30 . 2009-05-31 12:03	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\skypePM
2009-09-10 19:25 . 2009-07-14 21:02	--------	d-----w-	c:\program files\Common Files\Apple
2009-09-09 09:06 . 2009-01-12 09:01	--------	d-----w-	c:\programdata\Microsoft Help
2009-09-08 16:14 . 2009-05-30 22:34	--------	d-----w-	c:\program files\Internet Download Manager
2009-09-08 13:48 . 2009-05-30 22:18	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\Vso
2009-09-07 16:37 . 2009-05-30 22:34	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\IDM
2009-09-06 13:04 . 2009-05-31 12:37	--------	d-----w-	c:\program files\Unlocker
2009-09-06 13:04 . 2009-08-09 16:47	--------	d-----w-	c:\program files\LimeWire
2009-09-06 12:55 . 2009-07-19 22:17	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2009-09-06 12:37 . 2009-07-28 17:05	--------	d-----w-	c:\program files\Common Files\PC Tools
2009-09-05 19:09 . 2009-07-28 17:05	206256	----a-w-	c:\windows\system32\drivers\PCTCore.sys
2009-09-05 19:09 . 2009-09-05 19:09	7396	----a-w-	c:\windows\system32\drivers\pctcore.cat
2009-09-04 09:55 . 2009-05-30 22:37	--------	d-----w-	c:\program files\Sony
2009-09-01 10:26 . 2009-06-22 20:26	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\EPSON
2009-08-31 12:47 . 2009-07-24 15:45	--------	d-----w-	c:\program files\Wise Disk Cleaner
2009-08-31 12:31 . 2009-08-08 14:24	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\Auslogics
2009-08-31 09:35 . 2009-01-12 09:26	--------	d-----w-	c:\program files\Java
2009-08-30 16:25 . 2009-08-02 18:08	--------	d-----w-	c:\program files\Yahoo!
2009-08-29 19:27 . 2009-08-12 18:26	--------	d-----w-	c:\program files\Smarty Uninstaller Pro
2009-08-21 11:17 . 2009-01-12 09:46	485920	----a-w-	c:\windows\system32\NVUNINST.EXE
2009-08-20 21:26 . 2009-06-17 09:45	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\TeamViewer
2009-08-19 11:35 . 2009-08-19 11:35	9787488	----a-w-	c:\windows\system32\drivers
vlddmkm.sys
2009-08-19 11:35 . 2009-08-19 11:35	678432	----a-w-	c:\windows\system32
vcuvid.dll
2009-08-19 11:35 . 2009-08-19 11:35	485920	----a-w-	c:\windows\system32
vudisp.exe
2009-08-19 11:35 . 2009-08-19 11:35	4224	----a-w-	c:\windows\system32\drivers
vBridge.kmd
2009-08-19 11:35 . 2009-08-19 11:35	3197952	----a-w-	c:\windows\system32
vwgf2um.dll
2009-08-19 11:35 . 2009-08-19 11:35	1740800	----a-w-	c:\windows\system32
vcuda.dll
2009-08-19 11:35 . 2009-08-19 11:35	155648	----a-w-	c:\windows\system32
vcod163.dll
2009-08-19 11:35 . 2009-08-19 11:35	155648	----a-w-	c:\windows\system32
vcod.dll
2009-08-19 11:35 . 2009-08-19 11:35	1317408	----a-w-	c:\windows\system32
vcuvenc.dll
2009-08-19 11:35 . 2009-08-19 11:35	10420224	----a-w-	c:\windows\system32
voglv32.dll
2009-08-19 11:35 . 2007-11-07 00:05	991744	----a-w-	c:\windows\system32
vapi.dll
2009-08-19 11:35 . 2007-11-07 00:05	7660544	----a-w-	c:\windows\system32
vd3dum.dll
2009-08-18 11:44 . 2009-07-20 06:34	53248	----a-w-	c:\windows\system32\CSVer.dll
2009-08-16 16:19 . 2009-08-16 16:19	--------	d-----w-	c:\program files\Super Internet TV
2009-08-16 11:08 . 2009-06-16 10:10	--------	d-----w-	c:\program files\LG PC Suite II
2009-08-15 12:03 . 2009-07-20 06:26	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\SystemRequirementsLab
2009-08-15 12:03 . 2009-07-09 22:06	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\ALLCapture
2009-08-14 20:27 . 2009-07-31 18:39	--------	d-----w-	c:\program files\Raxco
2009-08-13 20:00 . 2009-08-13 20:00	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\FireShot
2009-08-13 17:20 . 2009-08-13 17:20	--------	d-----w-	c:\program files\ESET
2009-08-13 17:17 . 2009-08-13 17:17	--------	d-----w-	c:\program files\ESET NOD32 Antivirus Business Edition 4 0 417
2009-08-12 18:59 . 2009-08-12 10:41	--------	d-----w-	c:\program files\RAR Password Unlocker
2009-08-12 18:10 . 2009-08-12 18:10	34760	----a-w-	c:\windows\system32\drivers\Partizan.sys
2009-08-12 18:10 . 2009-08-12 18:10	32480	----a-w-	c:\windows\system32\Partizan.exe
2009-08-12 18:10 . 2009-08-12 18:10	2	--shatr-	c:\windows\winstart.bat
2009-08-12 17:17 . 2009-08-09 13:27	--------	d-----w-	c:\program files\uTorrent
2009-08-12 17:17 . 2009-07-27 19:20	--------	d-----w-	c:\program files\VirtualDJ
2009-08-12 17:17 . 2009-06-06 18:37	--------	d-----w-	c:\program files\PokerStars
2009-08-12 17:17 . 2009-05-30 22:16	--------	d-----w-	c:\programdata\FLEXnet
2009-08-12 17:16 . 2009-08-02 18:08	--------	d-----w-	c:\program files\CCleaner
2009-08-12 17:16 . 2009-01-12 09:05	--------	d-----w-	c:\program files\Common Files\Adobe
2009-08-12 17:11 . 2009-08-12 17:11	--------	d-----w-	c:\program files\Auslogics
2009-08-12 17:10 . 2009-08-09 16:46	--------	d-----w-	c:\program files\Lime Wire LLC
2009-08-12 17:10 . 2009-05-30 21:38	--------	d-----w-	c:\program files\Innovative Solutions
2009-08-11 16:18 . 2009-05-30 23:47	--------	d-----w-	c:\program files\UltraSnapPRO
2009-08-11 16:18 . 2009-05-30 22:42	--------	d-----w-	c:\program files\Total Video Converter
2009-08-11 16:18 . 2009-08-02 13:41	--------	d-----w-	c:\program files\HyperSnap 6
2009-08-09 16:47 . 2009-08-09 16:47	--------	d-----w-	c:\program files\LimeWire(49)
2009-08-09 15:51 . 2009-08-11 21:49	36864	----a-w-	c:\windowsuto32.exe
2009-08-06 16:37 . 2009-07-06 17:00	--------	d-----w-	c:\programdata\Innovative Solutions
2009-08-05 15:25 . 2009-07-31 18:41	--------	d-----w-	c:\programdata\Raxco
2009-08-04 20:07 . 2009-08-04 20:07	--------	d-----w-	c:\program files\Shadow Defender
2009-08-03 11:40 . 2009-08-03 11:40	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\IObit
2009-08-03 11:24 . 2009-05-30 22:22	--------	d-----w-	c:\program files\IObit
2009-08-02 16:27 . 2009-08-02 16:27	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\Hewlett-Packard
2009-08-02 12:23 . 2009-08-02 12:23	22862224	----a-w-	C:\LimeWireWin.exe
2009-08-02 10:39 . 2009-07-20 14:11	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\Steganos
2009-08-01 19:23 . 2009-01-12 09:56	--------	d-----w-	c:\programdata\CyberLink
2009-07-31 17:10 . 2009-07-31 17:10	--------	d-----w-	c:\program files\Bodrag
2009-07-31 08:42 . 2009-06-25 11:48	--------	d-----w-	c:\program files\Windows Live Safety Center
2009-07-29 21:30 . 2009-01-12 09:50	172032	----a-w-	c:\windows\system32\drivers\Rtlh86.sys
2009-07-29 19:55 . 2009-07-29 19:55	0	----a-w-	c:\windows\diskpt.dat
2009-07-28 21:49 . 2009-07-28 21:49	--------	d-----w-	c:\users\alexdiane\AppData\Roaming\iExpert Software
2009-07-28 17:00 . 2009-01-12 08:04	--------	d-----w-	c:\program files\Hewlett-Packard
2009-07-27 18:20 . 2009-07-27 16:50	6656	----a-w-	c:\windows\system32\bcmwlrc.dll
2009-07-27 18:15 . 2009-01-12 09:49	--------	d-----w-	c:\program files\Realtek
2009-07-27 16:50 . 2009-07-27 16:50	1665016	----a-w-	c:\windows\system32\drivers\BCMWL6.SYS
2009-07-27 16:50 . 2007-10-08 20:27	91376	----a-w-	c:\windows\system32\bcmwlcoi.dll
2009-07-27 16:50 . 2009-07-27 16:50	3538944	----a-w-	c:\windows\system32\bcmihvui.dll
2009-04-29 04:29 . 2009-09-07 17:19	202168	----a-w-	c:\program files\mozilla firefox\plugins\SwDir.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-08-29 3114416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-05-05 1466368]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-03-19 2029640]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-15 981384]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"EnableShellExecuteHooks"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\acaptuser32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	PDBoot.exe\0autocheck autochk *\0dpstart\0Partizan

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Privoxy.lnk]
backup=c:\windows\pss\Privoxy.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^UltraSnap PRO.lnk]
backup=c:\windows\pss\UltraSnap PRO.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^alexdiane^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^BitTorrent Turbo Accelerator.lnk]
backup=c:\windows\pss\BitTorrent Turbo Accelerator.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnHackMe Monitor
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vidalia

[HKEY_CURRENT_USER\software\microsoft\windows\currentversionun-]
"SpeedConnectStartUp"=c:\program files\CBS Software\SpeedConnect Internet Accelerator\SpeedConnectStartUp.exe -run
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-]
"HP Software Update"=c:\program files\Hp\HP Software Update\HPWuSchd2.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):a9,5d,a2,02,d3,e2,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{379BA3CF-0D69-4D6B-912A-C695B3EE0EED}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{04E44F1B-C4D2-4CEE-B3B5-2DD19641029D}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{1BB4E03A-8CF5-489D-B29D-6C5C3DADE516}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{ED8875BD-993E-4D80-B3CD-413533B4C276}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{6FE15015-DCA1-47CA-89A7-B339F6AF6DE3}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{27B1E7AE-3D21-451D-86F0-8A0EF2C8ACB2}"= UDP:5353:Adobe CSI CS4
"{E62C8F3D-5BC9-40CD-BA2C-A6570256E184}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{DEF68ECF-C556-40D5-BA9E-4DCA0549E52D}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{DA86EFF5-4D2A-4DD4-912C-D9FC6EED1A9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{DF5C9B8C-E527-434D-8DBE-ED3EEACA303A}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{C03633A0-BA32-41B4-B25A-1A38B16FBD59}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{6B91F916-34EC-4367-83C2-EDB87EB39D62}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{327C1B88-77BF-496A-A2C3-35001D57646A}"= UDP:c:\program files\TeamViewer\Version4\TeamViewer.exe:Teamviewer Remote Control Application
"{8204C593-7470-4E54-AE35-026C90D296FF}"= TCP:c:\program files\TeamViewer\Version4\TeamViewer.exe:Teamviewer Remote Control Application
"{24B0F042-B2E4-4E4F-A27D-1A3E8BCABD1D}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{71142492-5D4C-4FFD-83F2-9131D699B0BD}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{2712874C-AA40-4A87-ADDA-F72A9FA281D0}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{DE84902E-D09F-47FC-8F53-D336B2702EA2}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{0E6E6470-C6F0-442B-8815-FEA90E6D0D38}"= UDP:c:\users\alexdiane\AppData\Local\Temp\svcchst32.exe:JDrun
"{4794DFB8-0272-47EF-9990-0E45122194A0}"= TCP:c:\users\alexdiane\AppData\Local\Temp\svcchst32.exe:JDrun
"{63311560-84BE-469A-9D52-78CE88CA686E}"= UDP:c:\users\alexdiane\AppData\Local\Temp\JDstart.exe:JDstart
"{5371A379-D8AD-486A-BD20-A557E0CF072F}"= TCP:c:\users\alexdiane\AppData\Local\Temp\JDstart.exe:JDstart

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DoNotAllowExceptions"= 0 (0x0)

R0 diskpt;diskpt;c:\windows\System32\drivers\diskpt.sys [04/08/2009 22:07 182500]
R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [19/03/2009 11:44 107256]
R1 SLEE_14_DRIVER;Steganos Live Encryption Engine 14 [Driver];c:\windows\System32\drivers\sleen14.sys [24/07/2006 12:16 72480]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [19/03/2009 11:44 731840]
R2 epfwwfpr;epfwwfpr;c:\windows\System32\drivers\epfwwfpr.sys [19/03/2009 11:45 93312]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [27/07/2009 09:37 185640]
S3 Partizan;Partizan;c:\windows\System32\drivers\Partizan.sys [12/08/2009 20:10 34760]
S4 Steganos AntiTheft;Steganos AntiTheft;c:\windows\system32\SatSrv.exe --> c:\windows\system32\SatSrv.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contenu du dossier 'Tâches planifiées'

2009-09-18 c:\windows\Tasks\User_Feed_Synchronization-{AA62B5B1-EFBC-49E7-AB99-666F195BD09E}.job
- c:\windows\system32\msfeedssync.exe [2009-07-29 20:13]
.
.
------- Examen supplémentaire -------
.
uStart Page = www.google.com
uInternet Settings,ProxyOverride = local
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
LSP: c:\windows\system32\idmmbc.dll
FF - ProfilePath - c:\users\alexdiane\AppData\Roaming\Mozilla\Firefox\Profiles\3gbqj5fb.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - component: c:\users\alexdiane\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\users\alexdiane\AppData\Roaming\Mozilla\Firefox\Profiles\3gbqj5fb.default\extensions\lazarus@interclue.com\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
p32asw.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pFoxitReaderPlugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pOGAPlugin.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file)
MSConfigStartUp-PerfectSpeed - (no file)
AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe



**************************************************************************
Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-4283788246-504816121-809313791-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):c4,7c,92,70,a6,e5,06,67,38,1d,c5,49,df,bd,ec,6e,b0,5b,15,d2,2f,
   13,b3,25,8b,e9,6d,a7,2e,96,99,92,11,fd,db,04,2a,96,fa,a5,00,00,00,00,00,00,\

[HKEY_USERS\S-1-5-21-4283788246-504816121-809313791-1000_Classes\CLSID\{fcf81100-e465-4a0a-a0ea-a3a717f84c2f}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000d6
"Therad"=dword:00000009
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,98,07,ff,fc,5d,
   df,1c,2f,3b,8a,0a,32,11,89,01,b5,42,27,1d,0b,0e,23,ad,f3,ea,3f,46,3b,a2,3f,\

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(3496)
c:\program files\Internet Download Manager\idmmkb.dll
c:\program files\Internet Download Manager\IDMIECC.dll
c:\program files\Steganos Security Suite 2007\PasswordManagerBHO.dll
c:\program files\Epson Software\Easy Photo Print\EPTBL.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\ADFSMenu.dll
c:\program files\Steganos Security Suite 2007\ShellExtension.dll
c:\program files\Unlocker\UnlockerCOM.dll
c:\progra~1\TROJAN~1\Trshlex.dll
c:\program files\ESET\ESET NOD32 Antivirus\shellExt.dll
c:\windows\system32\erasext.dll
c:\windows\system32\Eraser.dll
c:\program files\Adobe\Acrobat 9.0\Acrobat Elements\ContextMenu.dll
c:\program files\Adobe\Acrobat 9.0\Acrobat Elements\ContextMenu.fra
c:\program files\UltraISO\isoshell.dll
c:\program files\Shadow Defender\ShellExt.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32
vvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\wlanext.exe
c:\windows\System32
vvsvc.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files\Raxco\PerfectDisk10\PDAgent.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Raxco\PerfectDisk10\PDAgentS1.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Heure de fin: 2009-09-18 19:20 - La machine a redémarré
ComboFix-quarantined-files.txt  2009-09-18 17:20

Avant-CF: 67 199 520 768 octets libres
Après-CF: 67 079 663 616 octets libres

401	--- E O F ---	2009-09-09 09:10

ultraboom · Answer

MERCI à toi....
et voici malwaresbytes
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2820
Windows 6.0.6002 Service Pack 2

18/09/2009 19:36:05
mbam-log-2009-09-18 (19-36-05).txt

Type de recherche: Examen rapide
Eléments examinés: 87955
Temps écoulé: 4 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\eeshellx.shellext (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f272845d-cec2-4f95-92ee-6d08fdfbd471} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7c6e906-b0b8-4810-ae82-71809ed409eb} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{0e6117e2-c367-4be3-8045-52669e71b5df} (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

ultraboom · Answer

toujours moi,lol

aprés tout cela mon pc ne demarre s'éteint toujours pas .... bloque sur arrêt en cours

plopus · Answer

poste un rsit stp  c'est les long rapport

ultraboom · Answer

voici le log rapport de malwaresbyte............ le long
t'as raison il  y avait encore des merdes, mais mon probléme reste quand même............

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2820
Windows 6.0.6002 Service Pack 2

18/09/2009 22:15:35
mbam-log-2009-09-18 (22-15-35).txt

Type de recherche: Examen complet (C:\|D:\|E:\|H:\|)
Eléments examinés: 289763
Temps écoulé: 1 hour(s), 14 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\System32\rotscxsqqvitmk.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\System32\rotscxukfpxvrb.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\System32\rotscxxfvvcnic.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\alexdiane\Downloads\Pinnacle.Studio.Ultimate.v12.0.0.6163.Incl.Keymaker-AGAiN\Pinnacle.Studio.Ultimate.v12.0.0.6163.Incl.Keymaker-AGAiN\Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\alexdiane\Downloads\Pinnacle.Studio.Ultimate.v12.0.0.6163.Incl.Keymaker-AGAiN\Pinnacle.Studio.Ultimate.v12.0.0.6163.Plugins.Addon-AGAiN\Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

plopus · Answer

RSIT c'est sa :

* Télécharge Random's system information tool (RSIT) et enregistre le sur ton bureau.
http://images.malwareremoval.com/random/RSIT.exe
* Double clique sur RSIT.exe pour lancer l'outil.
* Clique sur ' continue ' à l'écran Disclaimer.
* Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
* Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports.


( C:\RSIT\log.txt & C:\RSIT\info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )


AVEC SA :  Keygen.exe  etc.... t'etonne pas d'etre infecté....

ultraboom · Answer

t'as raison.... excuse moi de ne pas avoir capté tout de suite,voila le rapport


Logfile of random's system information tool 1.06 (written by random/random)
Run by alexdiane at 2009-09-18 23:00:16
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2
System drive C: has 64 GB (45%) free of 141 GB
Total RAM: 2046 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:00:20, on 18/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32	askeng.exe
C:\Users\alexdiane\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\alexdiane.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Steganos Password Manager AutoFill - {1427A821-7B93-4F08-9A34-9FA03A3D93DB} - C:\Program Files\Steganos Security Suite 2007\PasswordManagerBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\System32\acaptuser32.dll
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - QLogic Corporation - (no file)
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - QLogic Corporation - (no file)
O23 - Service: Registry Management Service (RegManServ) - Unknown owner - C:\Program Files\Advanced Registry Doctor\RegManServ.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

plopus · Answer

au passage avant que je regarde ton log


ARRETE DE TELECHARGER N'IMPORTE QUOI sur le net surtout des logiciels qu'une publicité te propose et qui sont trés peu connu la plupart sont aranques...

plopus · Answer

clic ici http://www.cijoint.fr/cj200909/cijHhciCsI.txt

et suit les instruction et poste le rapport


ensuite avec internet explorer fait un scan en ligne ici et poste le rapport en entier avec les lignes detecté
http://www.bitdefender.fr/scan_fr/scan8/ie.html


ensuite 

Télécharge ZHPDiag (de Nicolas Coolman) sur ton bureau :

-> https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html


!! déconnecte toi et ferme toutes tes applications en cours !!

- double-clique sur "ZHPDiag.exe" pour lancer l'installation de l'outil et laisse toi guider ( ne modifie pas les paramètres d'installe et coche bien la case "créer une icone sur le bureau" afin d'avoir les raccourcis "ZHPDiag" et "ZHPFix" ) .

- Lance ZHPDiag depuis le raccourci du bureau .

- Une fois ZHPDiag ouvert, clique sur le bouton "option" en haut sur la droite .
( celui avec le tournevis )

Une liste apparait dans l'encadré principal > clique en bas sur le bouton " Tous " et décoche la ligne 061 ( important ! ) .

 - Puis clique sur le bouton de "la loupe" pour lancer le scan .


Laisses travailler l'outil ...


- Une fois terminé , le rapport s'affiche : clique sur bouton "disquette" pour sauvegarder le rapport obtenu ...

Enregistres bien ZHPDiag.txt de façon à le retrouver facilement ( sur le bureau par exemple ).

( Sinon le rapport sera en outre sauvegardé dans ce dossier > C:\Program files\ZHPDiag )

Puis ferme le programme ...


- rends toi ensuite sur ce site : http://www.cijoint.fr/

Clique sur "parcourir" et va jusqu'au rapport que tu as sauvegardé .
Clique ensuite sur "cliquer ici pour déposer le fichier" et patiente ...
Une fois l'upload finit , un lien apparait > copie/colle le dans ta prochaine réponse stp

ultraboom · Answer

tu as raison sage conseil...............
mais aussi hallucinant que cela puisse te paraitre  quand j'avais avast tout allait bien,alors que tout le monde le trouve pourrit... pas de merde, sauf qu'il me crée un bug avec firefox... parent lock... j'avais cherché la solution partout ,rien ne marchait.. par hasard un  jour je desinstal avast et firefox ne buggait plus....

ultraboom · Answer

merci... All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! No active process named TeaTimer.exe was found! No active process named iexplorer.exe was found! No active process named TeaTimer.exe was found! ========== FILES ========== Folder move failed. c:\windows\vf_hip\chrome\skin scheduled to be moved on reboot. Folder move failed. c:\windows\vf_hip\chrome\content scheduled to be moved on reboot. Folder move failed. c:\windows\vf_hip\chrome scheduled to be moved on reboot. Folder move failed. c:\windows\vf_hip scheduled to be moved on reboot. Folder move failed. C:\found.001 scheduled to be moved on reboot. Folder move failed. C:\found.000 scheduled to be moved on reboot. File/Folder c:\users\alexdiane\AppData\Local\Evidence Eliminator not found. c:\programdata\Zillatech\My\1.0.0.0\UPIYXUEWDBCNQ moved successfully. c:\programdata\Zillatech\My\1.0.0.0 moved successfully. c:\programdata\Zillatech\My moved successfully. c:\programdata\Zillatech moved successfully. File move failed. c:\windows\system32\perfc00C.dat scheduled to be moved on reboot. File move failed. c:\windows\system32\perfh00C.dat scheduled to be moved on reboot. File move failed. c:\windows\system32\Partizan.exe scheduled to be moved on reboot. File move failed. C:\Windows\Partizan.txt scheduled to be moved on reboot. File move failed. c:\windows\winstart.bat scheduled to be moved on reboot. File move failed. c:\windows\System32\drivers\Partizan.sys scheduled to be moved on reboot. File move failed. C:\Windows\system32\PARTIZAN.TXT scheduled to be moved on reboot. Error: Unable to interpret <:serices> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! ========== REGISTRY ========== Registry delete failed. HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Evidence Eliminator\ scheduled to be deleted on reboot. Registry delete failed. HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{485CAF81-C05D-7ACB-0F00-D4A0E08061AE}\ scheduled to be deleted on reboot. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{485CAF81-C05D-7ACB-0F00-D4A0E08061AE}\ not found. Unable to set value : HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\"AppInit_DLLs"|"" /E! Registry delete failed. HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\ scheduled to be deleted on reboot. ========== COMMANDS ========== [EMPTYTEMP] User: alexdiane File delete failed. C:\Users\alexdiane\AppData\Local\Temp\~DF3D01.tmp scheduled to be deleted on reboot. ->Temp folder emptied: 425048 bytes File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245923319845;eid1=2;ecn1=1;etm1=6;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245924887173;eid1=2;ecn1=1;etm1=4;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245925254931;eid1=2;ecn1=1;etm1=3;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245929380844;eid1=2;ecn1=1;etm1=4;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245940645904;eid1=2;ecn1=1;etm1=2;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O2EVIL1O(12)\ctivity;src=1800704;met=1;v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245926291139;eid1=2;ecn1=0;etm1=6;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\0x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=0+minutes+insides+daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=4187216995221048[1].5 scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\celebrities;sz=300x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=1578967659026528[1].2 scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\celebrities;sz=300x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=974234971001763[1].9 scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 8174388 bytes ->Java cache emptied: 5292 bytes ->FireFox cache emptied: 84275703 bytes ->Apple Safari cache emptied: 602089677 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 134 bytes User: Default User ->Temp folder emptied: 0 bytes File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 134 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes Folder delete failed. C:\Windows\msdownld.tmp scheduled to be deleted on reboot. %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes File delete failed. C:\Windows emp\HTT10C4.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTT46DE.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTT767E.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTT8A7C.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTTC8E2.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTTECD0.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTTFF96.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\ZLT03196.TMP scheduled to be deleted on reboot. Windows Temp folder emptied: 194349 bytes RecycleBin emptied: 4100534 bytes Total Files Cleaned = 666,87 mb OTM by OldTimer - Version 3.0.0.6 log created on 09182009_232624 All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! No active process named TeaTimer.exe was found! No active process named iexplorer.exe was found! No active process named TeaTimer.exe was found! ========== FILES ========== Folder move failed. c:\windows\vf_hip\chrome\skin scheduled to be moved on reboot. Folder move failed. c:\windows\vf_hip\chrome\content scheduled to be moved on reboot. Folder move failed. c:\windows\vf_hip\chrome scheduled to be moved on reboot. Folder move failed. c:\windows\vf_hip scheduled to be moved on reboot. Folder move failed. C:\found.001 scheduled to be moved on reboot. Folder move failed. C:\found.000 scheduled to be moved on reboot. File/Folder c:\users\alexdiane\AppData\Local\Evidence Eliminator not found. c:\programdata\Zillatech\My\1.0.0.0\UPIYXUEWDBCNQ moved successfully. c:\programdata\Zillatech\My\1.0.0.0 moved successfully. c:\programdata\Zillatech\My moved successfully. c:\programdata\Zillatech moved successfully. File move failed. c:\windows\system32\perfc00C.dat scheduled to be moved on reboot. File move failed. c:\windows\system32\perfh00C.dat scheduled to be moved on reboot. File move failed. c:\windows\system32\Partizan.exe scheduled to be moved on reboot. File move failed. C:\Windows\Partizan.txt scheduled to be moved on reboot. File move failed. c:\windows\winstart.bat scheduled to be moved on reboot. File move failed. c:\windows\System32\drivers\Partizan.sys scheduled to be moved on reboot. File move failed. C:\Windows\system32\PARTIZAN.TXT scheduled to be moved on reboot. Error: Unable to interpret <:serices> in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! ========== REGISTRY ========== Registry delete failed. HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Evidence Eliminator\ scheduled to be deleted on reboot. Registry delete failed. HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{485CAF81-C05D-7ACB-0F00-D4A0E08061AE}\ scheduled to be deleted on reboot. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{485CAF81-C05D-7ACB-0F00-D4A0E08061AE}\ not found. Unable to set value : HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\"AppInit_DLLs"|"" /E! Registry delete failed. HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\ scheduled to be deleted on reboot. ========== COMMANDS ========== [EMPTYTEMP] User: alexdiane File delete failed. C:\Users\alexdiane\AppData\Local\Temp\~DF3D01.tmp scheduled to be deleted on reboot. ->Temp folder emptied: 425048 bytes File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245923319845;eid1=2;ecn1=1;etm1=6;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245924887173;eid1=2;ecn1=1;etm1=4;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245925254931;eid1=2;ecn1=1;etm1=3;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245929380844;eid1=2;ecn1=1;etm1=4;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PN80MFZC(13)\v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245940645904;eid1=2;ecn1=1;etm1=2;eid2=110161;ecn2=1;etm2=0;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O2EVIL1O(12)\ctivity;src=1800704;met=1;v=1;pid=18708550;aid=215273775;ko=0;cid=31886755;rid=31904631;rv=1;×tamp=1245926291139;eid1=2;ecn1=0;etm1=6;&_dc_ck=try[1].gif scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\0x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=0+minutes+insides+daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=4187216995221048[1].5 scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\celebrities;sz=300x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=1578967659026528[1].2 scheduled to be deleted on reboot. File delete failed. C:\Users\alexdiane\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MMWTDUY(11)\celebrities;sz=300x250;kl=N;klg=fr;kt=K;kga=-1;kr=F;kw=daniel+ducruet;kgg=-1;kcr=fr;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=974234971001763[1].9 scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 8174388 bytes ->Java cache emptied: 5292 bytes ->FireFox cache emptied: 84275703 bytes ->Apple Safari cache emptied: 602089677 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 134 bytes User: Default User ->Temp folder emptied: 0 bytes File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot. File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 134 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes Folder delete failed. C:\Windows\msdownld.tmp scheduled to be deleted on reboot. %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes File delete failed. C:\Windows emp\HTT10C4.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTT46DE.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTT767E.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTT8A7C.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTTC8E2.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTTECD0.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\HTTFF96.tmp scheduled to be deleted on reboot. File delete failed. C:\Windows emp\ZLT03196.TMP scheduled to be deleted on reboot. Windows Temp folder emptied: 194349 bytes RecycleBin emptied: 4100534 bytes Total Files Cleaned = 666,87 mb OTM by OldTimer - Version 3.0.0.6 log created on 09182009_232624

ultraboom · Answer

désolé,j'ai essayé de  desinstallé ie 8 par le passé vu  que rien ne marchait... je l'ai effacé moi même ,dégagé du disk C des clefs de registre appdat.... mais comme microsoft fait bien les choses!! ils ont foutu un truc qui doit laissé des traces je ne sais ou... d'ou une impossibilité de réinstallé explorer!! ça refuse... donc le scan avec bitdefenter... je ne peux pas... j ai firefox

ultraboom · Answer

voila le log zhp.... tu m'as appris et fait decouvrir plein de choses ce soir un grand MERCI.....

http://www.cijoint.fr/cjlink.php?file=cj200909/cijkJpPvHR.txt

plopus · Answer

celui ci jme le met de coté jl'ai oubliai ::    c:\windows\ruto32.exe     


va dans demarrer/panneau de configuration et desinstalle ces programmes :

Advanced Registry Doctor     
Advanced Registry Doctor Compatibility Patch     
Auslogics BoostSpeed     
Autorun Blocker 1.0.0.0     
Java 6 Update 15     
Java 6 Update 2     
Shadow Defender     
Registry Defragmentation Compatibility Patch     
RAM Booster Expert 1.30     
UnHackMe 5.00 release     
Wise Disk Cleaner     


puis clic ici  https://www.virustotal.com/gui/
et clic sur parcourir en milieu de page et copie colle une a une les ligne ci desssous puis clic sur envoyer, un rapport va s'etablir copie colle le avec le nom du fichier en entete

C:\Windows\system32\drivers\AntiArpNdisProt.sys    
c:\users\alexdiane\AppData\Local\d3d9caps­.dat      


ensuite 

/!\ Il faut impérativement désactiver tous tes logiciels de protection pour utiliser ce programme/!\

• Rends toi sur cette page, et clique sur "Download EXE" pour télécharger Gmer (sous un nom aléatoire, pour éviter qu'il soit bloqué par une infection)
http://www.gmer.net/
• Lance Gmer
• Dans l'onglet "Rootkit", clique sur "Scan" puis patiente.
• A la fin, clique sur "Save" et enregistre le rapport sur ton Bureau.

ultraboom · Answer

bonjour, voilci ce que tu m as demandé...

Fichier d2ebd9e9803e680052a20037e13036009cf83198.EXE reçu le 2009.07.02 00:52:58 (UTC)



Srpski | &#1052;&#1072;&#1082;&#1077;&#1076;&#1086;&#1085;&#1089;&#1082;&#1080; | &#1575;&#1604;&#1593;&#1585;&#1576;&#1610;&#1577; | Suomi | ihMdI |  | &#1506;&#1489;&#1512;&#1497;&#1514; |  | Slovenš&#269;ina | Dansk | &#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081; | Român&#259; | Türkçe | Nederlands | &#917;&#955;&#955;&#951;&#957;&#953;&#954;&#940; | Svenska | Português | Italiano |  |  | Magyar | Deutsch | &#268;esky | Polski | Español | English
Virus Total 	
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier d2ebd9e9803e680052a20037e13036009cf83198.EXE reçu le 2009.07.02 00:52:58 (UTC)
Situation actuelle: terminé
Résultat: 0/40 (0.00%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.18 	2009.07.02 	-
AhnLab-V3 	5.0.0.2 	2009.07.01 	-
AntiVir 	7.9.0.199 	2009.07.01 	-
Antiy-AVL 	2.0.3.1 	2009.07.01 	-
Authentium 	5.1.2.4 	2009.07.01 	-
Avast 	4.8.1335.0 	2009.07.01 	-
AVG 	8.5.0.386 	2009.07.01 	-
BitDefender 	7.2 	2009.07.02 	-
CAT-QuickHeal 	10.00 	2009.07.01 	-
ClamAV 	0.94.1 	2009.07.02 	-
Comodo 	1527 	2009.07.01 	-
DrWeb 	5.0.0.12182 	2009.07.02 	-
eSafe 	7.0.17.0 	2009.06.29 	-
eTrust-Vet 	31.6.6592 	2009.07.02 	-
F-Prot 	4.4.4.56 	2009.07.01 	-
F-Secure 	8.0.14470.0 	2009.07.02 	-
Fortinet 	3.117.0.0 	2009.07.01 	-
GData 	19 	2009.07.02 	-
Ikarus 	T3.1.1.64.0 	2009.07.02 	-
Jiangmin 	11.0.706 	2009.07.01 	-
K7AntiVirus 	7.10.768 	2009.06.19 	-
McAfee 	5663 	2009.07.01 	-
McAfee+Artemis 	5663 	2009.07.01 	-
McAfee-GW-Edition 	6.7.6 	2009.07.01 	-
Microsoft 	1.4803 	2009.07.01 	-
NOD32 	4206 	2009.07.02 	-
Norman 		2009.07.01 	-
nProtect 	2009.1.8.0 	2009.07.01 	-
Panda 	10.0.0.14 	2009.07.01 	-
PCTools 	4.4.2.0 	2009.07.01 	-
Prevx 	3.0 	2009.07.02 	-
Rising 	21.36.24.00 	2009.07.01 	-
Sophos 	4.43.0 	2009.07.02 	-
Sunbelt 	3.2.1858.2 	2009.07.01 	-
Symantec 	1.4.4.12 	2009.07.02 	-
TheHacker 	6.3.4.3.359 	2009.07.02 	-
TrendMicro 	8.950.0.1094 	2009.07.01 	-
VBA32 	3.12.10.7 	2009.07.02 	-
ViRobot 	2009.7.1.1814 	2009.07.01 	-
VirusBuster 	4.6.5.0 	2009.07.01 	-
Information additionnelle
File size: 21120 bytes
MD5   : 5ba500977641728b26ebefa1873be730
SHA1  : 2dd6fb13b0d98fbcc49b45cae9e35c37636d0298
SHA256: c5dfe5b7704af6e4cdb1fbea988f8bc8327da5b8c0a2c09daf6df3d87929d14e
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4273
timedatestamp.....: 0x4625FE20 (Wed Apr 18 13:16:48 2007)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x1E4A 0x1E80 6.23 f71c99a3a9965517ca1d36a171b2be9c
.rdata 0x2300 0x66B 0x680 3.79 531917f3c145100ac4d32d119802cec2
.data 0x2980 0x1D0 0x200 1.75 f5b44af3d2db5a569574b848a4ba8854
PAGE 0x2B80 0x1444 0x1480 6.25 c21e588a653139136894eba64352dcaa
INIT 0x4000 0xA5E 0xA80 5.65 3f991388f8adfe112a9a92b3db0f8389
.rsrc 0x4A80 0x3C8 0x400 3.32 f65e6c1b3663efd9c9064f483999fe11
.reloc 0x4E80 0x384 0x400 5.52 d4c81524e71d0c5065449cd971080078

( 3 imports )

> hal.dll: KfReleaseSpinLock, KfAcquireSpinLock
> ndis.sys: NdisFreePacket, NdisReturnPackets, NdisAllocateBuffer, NdisOpenProtocolConfiguration, NdisReadConfiguration, NdisCloseConfiguration, NdisUnchainBufferAtFront, NdisAllocatePacketPoolEx, NdisAllocateBufferPool, NdisOpenAdapter, NdisQueryAdapterInstanceName, NdisCloseAdapter, NdisDeregisterProtocol, NdisCopyFromPacketToPacket, NdisAllocateMemoryWithTag, NdisAllocatePacket, NdisFreeMemory, NdisWaitEvent, NdisRegisterProtocol, NdisInitializeEvent, NdisSetEvent, NdisFreeBufferPool, NdisFreePacketPool
> ntoskrnl.exe: KeBugCheckEx, KeTickCount, MmMapLockedPagesSpecifyCache, IoFreeMdl, IoReleaseCancelSpinLock, InterlockedExchange, IoCreateSymbolicLink, KeInitializeSpinLock, InterlockedCompareExchange, IoDeleteDevice, InterlockedDecrement, InterlockedIncrement, IofCompleteRequest, RtlInitUnicodeString, IoDeleteSymbolicLink, MmGetSystemRoutineAddress, wcslen, ZwClose, ZwSetSecurityObject, ObOpenObjectByPointer, IoDeviceObjectType, IoCreateDevice, RtlGetDaclSecurityDescriptor, RtlGetSaclSecurityDescriptor, RtlGetGroupSecurityDescriptor, RtlGetOwnerSecurityDescriptor, _snwprintf, RtlLengthSecurityDescriptor, ExFreePoolWithTag, SeCaptureSecurityDescriptor, SeExports, IoIsWdmVersionAvailable, _wcsnicmp, RtlAddAccessAllowedAce, ExAllocatePoolWithTag, RtlLengthSid, wcschr, RtlAbsoluteToSelfRelativeSD, RtlSetDaclSecurityDescriptor, RtlCreateSecurityDescriptor, ZwOpenKey, ZwCreateKey, ZwQueryValueKey, ZwSetValueKey, RtlFreeUnicodeString

( 0 exports )
TrID  : File type identification
Clipper DOS Executable (33.3%)
Generic Win/DOS Executable (33.0%)
DOS Executable Generic (33.0%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
ssdeep: 384:ynCPx55OHsBHg7TVFkgTDTPjXvY8NA4/4UzouYE9Ijh6bNOYzem:lx/OoH0LkgTnLfY8qiNZ9ym
PEiD  : -
packers (Kaspersky): PE_Patch
CWSandbox: http://research.sunbelt-software.com/...
RDS   : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier
VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

ultraboom · Answer

Srpski | &#1052;&#1072;&#1082;&#1077;&#1076;&#1086;&#1085;&#1089;&#1082;&#1080; | &#1575;&#1604;&#1593;&#1585;&#1576;&#1610;&#1577; | Suomi | ihMdI |  | &#1506;&#1489;&#1512;&#1497;&#1514; |  | Slovenš&#269;ina | Dansk | &#1056;&#1091;&#1089;&#1089;&#1082;&#1080;&#1081; | Român&#259; | Türkçe | Nederlands | &#917;&#955;&#955;&#951;&#957;&#953;&#954;&#940; | Svenska | Português | Italiano |  |  | Magyar | Deutsch | &#268;esky | Polski | Español | English
Virus Total 	
Virustotal est un service qui analyse les fichiers suspects et facilite la détection rapide des virus, vers, chevaux de Troie et toutes sortes de malwares détectés par les moteurs antivirus. Plus d'informations...
Fichier d3d9caps.dat reçu le 2009.09.19 08:50:56 (UTC)
Situation actuelle: terminé
Résultat: 0/41 (0.00%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.24 	2009.09.19 	-
AhnLab-V3 	5.0.0.2 	2009.09.19 	-
AntiVir 	7.9.1.19 	2009.09.18 	-
Antiy-AVL 	2.0.3.7 	2009.09.18 	-
Authentium 	5.1.2.4 	2009.09.19 	-
Avast 	4.8.1351.0 	2009.09.18 	-
AVG 	8.5.0.412 	2009.09.19 	-
BitDefender 	7.2 	2009.09.19 	-
CAT-QuickHeal 	10.00 	2009.09.19 	-
ClamAV 	0.94.1 	2009.09.19 	-
Comodo 	2366 	2009.09.19 	-
DrWeb 	5.0.0.12182 	2009.09.19 	-
eSafe 	7.0.17.0 	2009.09.17 	-
eTrust-Vet 	31.6.6746 	2009.09.18 	-
F-Prot 	4.5.1.85 	2009.09.18 	-
F-Secure 	8.0.14470.0 	2009.09.18 	-
Fortinet 	3.120.0.0 	2009.09.19 	-
GData 	19 	2009.09.19 	-
Ikarus 	T3.1.1.72.0 	2009.09.19 	-
Jiangmin 	11.0.800 	2009.09.19 	-
K7AntiVirus 	7.10.848 	2009.09.18 	-
Kaspersky 	7.0.0.125 	2009.09.19 	-
McAfee 	5745 	2009.09.18 	-
McAfee+Artemis 	5745 	2009.09.18 	-
McAfee-GW-Edition 	6.8.5 	2009.09.18 	-
Microsoft 	1.5005 	2009.09.19 	-
NOD32 	4439 	2009.09.19 	-
Norman 	6.01.09 	2009.09.18 	-
nProtect 	2009.1.8.0 	2009.09.19 	-
Panda 	10.0.2.2 	2009.09.18 	-
PCTools 	4.4.2.0 	2009.09.18 	-
Prevx 	3.0 	2009.09.19 	-
Rising 	21.47.51.00 	2009.09.19 	-
Sophos 	4.45.0 	2009.09.19 	-
Sunbelt 	3.2.1858.2 	2009.09.19 	-
Symantec 	1.4.4.12 	2009.09.19 	-
TheHacker 	6.5.0.2.012 	2009.09.18 	-
TrendMicro 	8.950.0.1094 	2009.09.18 	-
VBA32 	3.12.10.10 	2009.09.18 	-
ViRobot 	2009.9.18.1943 	2009.09.18 	-
VirusBuster 	4.6.5.0 	2009.09.18 	-
Information additionnelle
File size: 680 bytes


Fichier d3d9caps.dat reçu le 2009.09.19 08:50:56 (UTC)


le second...........




MD5   : 73634b25fd49b0030b966900f485bfdf
SHA1  : efdceb15d59b448df731f9fc3a666049fe7de608
SHA256: 6bbbd7c644ec638306da3937032ef08df8e24303cfff25b185241a8ecb852c58
TrID  : File type identification
Unknown!
ssdeep: 3:spqNn+voW8jw//1lFlXm/lllelblll/Dlljlll/Dll:sAhTjw/e/l
PEiD  : -
RDS   : NSRL Reference Data Set
-

ATENTION ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

Autre fichier
VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy

ultraboom · Answer

et voici le dernié rapport gmer............



GMER 1.0.15.15087 - http://www.gmer.net
Rootkit scan 2009-09-19 11:33:23
Windows 6.0.6002 Service Pack 2
Running: u37u6skt.exe; Driver: C:\Users\ALEXDI~1\AppData\Local\Temp\ffpyykog.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwAlpcConnectPort [0x8D098880]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwConnectPort [0x8D0984E0]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwCreateFile [0x8D095828]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwCreateKey [0x8D0ABD9C]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwCreatePort [0x8D098C36]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwCreateProcess [0x8D0A9AF8]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwCreateProcessEx [0x8D0A9D12]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwCreateSection [0x8D0AD780]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwCreateWaitablePort [0x8D098CDE]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwDeleteFile [0x8D095D0A]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwDeleteKey [0x8D0AC698]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwDeleteValueKey [0x8D0AC414]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwDuplicateObject [0x8D0A94F8]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwLoadKey [0x8D0ACBC6]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwLoadKey2 [0x8D0ACC3E]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwLoadKeyEx [0x8D0ACD2E]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwMapViewOfSection [0x8D0AD9D0]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwOpenFile [0x8D095BA2]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwOpenProcess [0x8D0AAF18]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwRenameKey [0x8D0AD370]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwReplaceKey [0x8D0ACDA6]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwRequestWaitReplyPort [0x8D09816A]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwRestoreKey [0x8D0AD1B0]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwSecureConnectPort [0x8D098680]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwSetInformationFile [0x8D095EF8]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwSetValueKey [0x8D0AC11A]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwSystemDebugControl [0x8D0AA486]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwTerminateProcess [0x8D0AA362]
SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)  ZwCreateUserProcess [0x8D0A9F30]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!KeSetEvent + 13D                                                                                   820AE880 4 Bytes  [80, 88, 09, 8D]
.text           ntkrnlpa.exe!KeSetEvent + 1C1                                                                                   820AE904 4 Bytes  [E0, 84, 09, 8D]
.text           ntkrnlpa.exe!KeSetEvent + 1D9                                                                                   820AE91C 4 Bytes  [28, 58, 09, 8D]
.text           ntkrnlpa.exe!KeSetEvent + 1E9                                                                                   820AE92C 4 Bytes  [9C, BD, 0A, 8D]
.text           ntkrnlpa.exe!KeSetEvent + 205                                                                                   820AE948 12 Bytes  [36, 8C, 09, 8D, F8, 9A, 0A, ...]
.text           ...                                                                                                             

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1588] kernel32.dll!SetUnhandledExceptionFilter              776EA84F 4 Bytes  [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                          eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                         Wdf01000.sys (WDF dynamique/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread          System [4:364]                                                                                                  85F88790

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@FrequencyCorrectRate                                      4
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@PollAdjustFactor                                          5
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@LargePhaseOffset                                          50000000
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@SpikeWatchPeriod                                          900
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@LocalClockDispersion                                      10
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@HoldPeriod                                                5
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@PhaseCorrectRate                                          1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@UpdateInterval                                            360000
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@EventLogFlags                                             2
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@AnnounceFlags                                             10
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@TimeJumpAuditOffset                                       28800
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MinPollInterval                                           10
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MaxPollInterval                                           15
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MaxNegPhaseCorrection                                     54000
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MaxPosPhaseCorrection                                     54000
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config@MaxAllowedPhaseOffset                                     1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient                                          
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@DllName                                  %systemroot%\system32\w32time.dll
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@Enabled                                  1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@InputProvider                            1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@AllowNonstandardModeCombinations         1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@CrossSiteSyncFlags                       2
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@ResolvePeerBackoffMinutes                15
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@ResolvePeerBackoffMaxTimes               7
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@CompatibilityFlags                       -2147483648
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@EventLogFlags                            1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@LargeSampleSkew                          3
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@SpecialPollInterval                      604800
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@SpecialPollTimeRemaining                 time.windows.com,7b00b1e???????????
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer                                          
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@DllName                                  %systemroot%\system32\w32time.dll
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@Enabled                                  0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@InputProvider                            0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@AllowNonstandardModeCombinations         1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@EventLogFlags                            0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainEntryTimeout                        16
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainMaxEntries                          128
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainMaxHostEntries                      4
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainDisable                             0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer@ChainLoggingRate                         30
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@FrequencyCorrectRate                                          4
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@PollAdjustFactor                                              5
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@LargePhaseOffset                                              50000000
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@SpikeWatchPeriod                                              900
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@LocalClockDispersion                                          10
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@HoldPeriod                                                    5
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@PhaseCorrectRate                                              1
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@UpdateInterval                                                360000
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@EventLogFlags                                                 2
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@AnnounceFlags                                                 10
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@TimeJumpAuditOffset                                           28800
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MinPollInterval                                               10
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MaxPollInterval                                               15
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MaxNegPhaseCorrection                                         54000
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MaxPosPhaseCorrection                                         54000
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\Config@MaxAllowedPhaseOffset                                         1
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient (not active ControlSet)                      
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@DllName                                      %systemroot%\system32\w32time.dll
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@Enabled                                      1
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@InputProvider                                1
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@AllowNonstandardModeCombinations             1
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@CrossSiteSyncFlags                           2
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@ResolvePeerBackoffMinutes                    15
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@ResolvePeerBackoffMaxTimes                   7
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@CompatibilityFlags                           -2147483648
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@EventLogFlags                                1
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@LargeSampleSkew                              3
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@SpecialPollInterval                          604800
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpClient@SpecialPollTimeRemaining                     time.windows.com,7b00b1e???????????
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer (not active ControlSet)                      
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@DllName                                      %systemroot%\system32\w32time.dll
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@Enabled                                      0
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@InputProvider                                0
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@AllowNonstandardModeCombinations             1
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@EventLogFlags                                0
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainEntryTimeout                            16
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainMaxEntries                              128
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainMaxHostEntries                          4
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainDisable                                 0
Reg             HKLM\SYSTEM\ControlSet003\Services\W32Time\TimeProviders\NtpServer@ChainLoggingRate                             30

---- EOF - GMER 1.0.15 ----

ultraboom · Answer

j'en ai trop marre de ce truc....
je reinitialise completement le pc.... merci quand même

plopus · Answer

salut

ok merci de prevenir

@+

plopus · Answer

salut

rien a voir avec les mises a jour (je pense) et rien a voir avec les elements que je t'ai fait desinstallé

Poste un RSIT pour voir après le formatage

plopus · Answer

regarde dans ces 2 liens aussi  :

http://www.d2i.ch/pn/depannage/arret.html

https://support.microsoft.com/en-us

ultraboom · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by alexandre at 2009-09-20 11:19:37
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 107 GB (76%) free of 141 GB
Total RAM: 2046 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:20:12, on 20/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\WINDOWS\System32undll32.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\cg4ie\cg4ie.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\alexandre\Desktop\RSIT.exe
C:\Program Files	rend micro\alexandre.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\RunOnce: [srePostpone] rundll32.exe c:\windows\system32\zonelabs\srescan.dll,DoSpecialAction
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [CG4IE] C:\Program Files\cg4ie\cg4ie.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

plopus · Answer

c'est quoi sa 

poste un rapport GENPROC

http://ww11.genproc.com/tutorial_genproc/tutorial_genproc.html

et

    * Télécharge Rooter (créé par l'équipe IDN) sur ton bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/Rooter.exe?attachauth=ANoY7cpzQksLcJt-e1z30LGu7t4JjUhh8amzWs_oSPSJpXbXp8ythGbW2WF8ysioh5NNlarrn7zMnYCRfsT5rCwNrfw5_CZYELApylTiY_MGu0G6uKzWpLEF2YXM3tF7nKZZAWj0JSAajXlZhd8dIyI3MrZ-lAIT5ZrAdcrct9_7bshwVpaZRPizuMTv9SDvmvY31BX4Vvvh2F2Brp1cy_K0jtTTfjttEA%3D%3D&attredirects=2
    * /!\ Déconnecte toi d'internet et ferme toutes les applications en cours /!\
    * Exécute Rooter et laisse le travailler jusqu'à l'apparition du rapport dans le bloc notes
    * Ensuite poste le rapport dans ta prochaine réponse

Gros probléme pc!,mon rappoert est il clean??

40 réponses

Newsletters