Virus, trojan?? et nettoyage de pc

auguste_74 Messages postés 64 Statut Membre -  
auguste_74 Messages postés 64 Statut Membre -
Bonjour,
à l'aide, marre de ces fenêtres de pub qui s'ouvrent
et comment nettoyer au mieux mon PC sans le formater, et est ce qu'il es possible de tout supprimer et de ne laisser que windows, je suis novice et je ne veut pas supprimer des trucs qui pourraient me servir
d'avance, merci beaucoup
Configuration: Windows XP
Firefox 3.0.14

6 réponses

  1.
    toptitbal Messages postés 5341 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 232
     
    Bonjour

    • Télécharge Random's System Information Tool (RSIT) de Random / Random et sauvegarde-le sur ton Bureau,

    -> http://images.malwareremoval.com/random/RSIT.exe

    • Double-clique sur RSIT.exe pour lancer le programme,
    • Clique sur continuer sur l'écran Disclaimer,
    • Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
    • Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
    Ferme info.txt (<<qui sera réduit dans la Barre des Tâches), il ne te sera demandé qu’en cas de besoin.

    Tuto si besoin : https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm
    0
  2. auguste_74 Messages postés 64 Statut Membre 1
     
    ok, par contre le logiciel que tu m a fait télecharger ne veut pas s'ouvrir car ça me dit que ce n'est pas une application win32 valide
    0
  3. toptitbal Messages postés 5341 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 232
     
    T'as téléchargé des cracks ?

    Télécharge FindyKill de Chiquitine29 sur ton bureau :

    http://pagesperso-orange.fr/NosTools/cariboost_files/FindyKill.exe

    Double clique "FindyKill.exe"

    Tuto : http://pagesperso-orange.fr/NosTools/tuto_fyk2.html

    Choisis F pour Français puis l’option 1 (recherche)

    Laisse travailler l’outil.

    Une fois terminé, poste le rapport FindyKill.txt qui est généré ...
    0
  4. auguste_74 Messages postés 64 Statut Membre 1
     
    voici le rapport

    ############################## | FindyKill V5.011 |

    # User : Administrateur (Administrateurs) # C8E4482ED6E9433
    # Update on 11/09/2009 by Chiquitine29
    # Start at: 18:09:23 | 19/09/2009
    # Website : http://pagesperso-orange.fr/NosTools/index.html

    # AMD Sempron(tm) Processor 3200+
    # Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
    # Internet Explorer 7.0.5730.11
    # Windows Firewall Status : Enabled
    # AV : AntiVir Desktop 9.0.1.26 [ (!) Disabled | (!) Outdated ]

    # C:\ # Disque fixe local # 149,04 Go (98,57 Go free) # NTFS
    # E:\ # Disque amovible
    # F:\ # Disque amovible
    # G:\ # Disque amovible
    # H:\ # Disque CD-ROM # 181,33 Mo (0 Mo free) [Livebox] # CDFS
    # I:\ # Disque CD-ROM
    # J:\ # Disque amovible

    ############################## | Processus actifs |

    C:\WINDOWS2\System32\smss.exe
    C:\WINDOWS2\system32\csrss.exe
    C:\WINDOWS2\system32\winlogon.exe
    C:\WINDOWS2\system32\services.exe
    C:\WINDOWS2\system32\lsass.exe
    C:\WINDOWS2\system32\svchost.exe
    C:\WINDOWS2\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS2\System32\svchost.exe
    C:\WINDOWS2\system32\svchost.exe
    C:\WINDOWS2\Explorer.EXE
    C:\WINDOWS2\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\UberIcon\UberIcon Manager.exe
    C:\Program Files\styler\Styler.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\WINDOWS2\system32\RUNDLL32.EXE
    C:\WINDOWS2\RTHDCPL.EXE
    C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
    C:\WINDOWS2\system32\ctfmon.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\documents and settings\administrateur.c8e4482ed6e9433\local settings\application data\praee.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS2\System32\ALERTM~1\ALERTM~1.EXE
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\WINDOWS2\System32\FTRTSVC.exe
    C:\WINDOWS2\system32\nvsvc32.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS2\system32\svchost.exe
    C:\WINDOWS2\System32\alg.exe
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
    C:\WINDOWS2\system32\wbem\wmiprvse.exe

    ################## | C: |

    Présent ! H:\autorun.inf

    ################## | C:\WINDOWS2 |

    ################## | C:\WINDOWS2\system32 |

    ################## | C:\WINDOWS2\system32\drivers |

    ################## | C:\Documents and Settings\Administrateur.C8E4482ED6E9433\Application Data |

    ################## | Temporary Internet Files |

    ################## | Registre / Clés infectieuses |

    Présent ! [HKLM\software\microsoft\security center] "AntiVirusDisableNotify"
    Présent ! [HKLM\software\microsoft\security center] "AntiVirusOverride"
    Présent ! [HKLM\software\microsoft\security center] "FirewallDisableNotify"
    Présent ! [HKLM\software\microsoft\security center] "FirewallOverride"

    ################## | Etat / Services / Informations |

    # Affichage des fichiers cachés : OK

    # Mode sans echec : OK

    # Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
    # Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 )
    # SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
    # windefend -> Start = 2 ( Good = 2 | Bad = 4 )
    # wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
    # (!) wscsvc -> Start = 4 ( Good = 2 | Bad = 4 )

    ################## | Cracks / Keygens / Serials |

    ################## | ! Fin du rapport # FindyKill V5.011 ! |
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. toptitbal Messages postés 5341 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 232
     
    Branche toutes tes unités externes au PC ( DD externes, clé USB, lecteur mp3, ect...) mais sans les ouvrir !
    Tu les retireras après la manip ...

    Ferme toutes les applications en cours !

    Relance FindyKill :

    choisis cette fois-ci l'option 2 (suppression).

    /!\ ton PC va redémarrer de lui même , c'est normal !... Laisse travailler l'outil

    --> Poste le nouveau rapport FindyKill.txt qui est généré.

    ( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

    PS : Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier"-> "Nouvelle tâche":
    tapes explorer.exe et valide .
    0
    1. auguste_74 Messages postés 64 Statut Membre 1
       
      voici le rapport findykill


      ############################## | FindyKill V5.011 |

      # User : Administrateur (Administrateurs) # C8E4482ED6E9433
      # Update on 11/09/2009 by Chiquitine29
      # Start at: 09:32:30 | 20/09/2009
      # Website : http://pagesperso-orange.fr/NosTools/index.html

      # AMD Sempron(tm) Processor 3200+
      # Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
      # Internet Explorer 7.0.5730.11
      # Windows Firewall Status : Enabled
      # AV : AntiVir Desktop 9.0.1.26 [ (!) Disabled | (!) Outdated ]

      # C:\ # Disque fixe local # 149,04 Go (98,58 Go free) # NTFS
      # E:\ # Disque amovible
      # F:\ # Disque amovible
      # G:\ # Disque amovible
      # H:\ # Disque CD-ROM # 181,33 Mo (0 Mo free) [Livebox] # CDFS
      # I:\ # Disque CD-ROM
      # J:\ # Disque amovible

      ############################## | Processus actifs |

      C:\WINDOWS2\System32\smss.exe
      C:\WINDOWS2\system32\csrss.exe
      C:\WINDOWS2\system32\winlogon.exe
      C:\WINDOWS2\system32\services.exe
      C:\WINDOWS2\system32\lsass.exe
      C:\WINDOWS2\system32\svchost.exe
      C:\WINDOWS2\system32\svchost.exe
      C:\Program Files\Windows Defender\MsMpEng.exe
      C:\WINDOWS2\System32\svchost.exe
      C:\WINDOWS2\system32\svchost.exe
      C:\WINDOWS2\system32\logonui.exe
      C:\WINDOWS2\Explorer.EXE
      C:\WINDOWS2\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir Desktop\sched.exe
      C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      C:\WINDOWS2\System32\FTRTSVC.exe
      C:\WINDOWS2\system32\nvsvc32.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\WINDOWS2\system32\svchost.exe
      C:\WINDOWS2\system32\wbem\wmiprvse.exe
      C:\WINDOWS2\System32\alg.exe

      ################## | C: |

      (!) Non supprimé ! H:\"autorun.inf"

      ################## | C:\WINDOWS2 |


      ################## | C:\WINDOWS2\system32 |


      ################## | C:\WINDOWS2\system32\drivers |


      ################## | C:\Documents and Settings\Administrateur.C8E4482ED6E9433\Application Data |

      ################## | Autres suppression ... |


      ################## | Temporary Internet Files |


      ################## | Registre / Clés infectieuses |

      Supprimé ! [HKLM\software\microsoft\security center] "AntiVirusDisableNotify"
      Supprimé ! [HKLM\software\microsoft\security center] "AntiVirusOverride"
      Supprimé ! [HKLM\software\microsoft\security center] "FirewallDisableNotify"
      Supprimé ! [HKLM\software\microsoft\security center] "FirewallOverride"

      ################## | Etat / Services / Informations |

      # Mode sans echec : OK


      # Affichage des fichiers cachés : OK

      # Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
      # Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
      # SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
      # windefend -> Start = 2 ( Good = 2 | Bad = 4 )
      # wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
      # wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )


      ################## | PEH ... |


      ################## | Cracks / Keygens / Serials |


      ################## | ! Fin du rapport # FindyKill V5.011 ! |
      0
    2. auguste_74 Messages postés 64 Statut Membre 1
       
      Voici le rapport log.txt

      Logfile of random's system information tool 1.06 (written by random/random)
      Run by Administrateur at 2009-09-20 12:00:33
      Microsoft Windows XP Professionnel Service Pack 2
      System drive C: has 101 GB (66%) free of 153 GB
      Total RAM: 958 MB (55% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 12:00:50, on 20/09/2009
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16574)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS2\System32\smss.exe
      C:\WINDOWS2\system32\winlogon.exe
      C:\WINDOWS2\system32\services.exe
      C:\WINDOWS2\system32\lsass.exe
      C:\WINDOWS2\system32\svchost.exe
      C:\Program Files\Windows Defender\MsMpEng.exe
      C:\WINDOWS2\System32\svchost.exe
      C:\WINDOWS2\Explorer.EXE
      C:\WINDOWS2\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir Desktop\sched.exe
      C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      C:\WINDOWS2\System32\FTRTSVC.exe
      C:\WINDOWS2\system32\nvsvc32.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\WINDOWS2\system32\svchost.exe
      C:\WINDOWS2\system32\wscntfy.exe
      C:\Program Files\UberIcon\UberIcon Manager.exe
      C:\Program Files\styler\Styler.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\WINDOWS2\system32\RUNDLL32.EXE
      C:\WINDOWS2\RTHDCPL.EXE
      C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
      C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
      C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      C:\WINDOWS2\system32\ctfmon.exe
      C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
      C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
      C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
      C:\documents and settings\administrateur.c8e4482ed6e9433\local settings\application data\iterdoc.exe
      C:\PROGRA~1\Wanadoo\ComComp.exe
      C:\PROGRA~1\Wanadoo\Toaster.exe
      C:\PROGRA~1\Wanadoo\Inactivity.exe
      C:\PROGRA~1\Wanadoo\PollingModule.exe
      C:\WINDOWS2\System32\ALERTM~1\ALERTM~1.EXE
      C:\PROGRA~1\Wanadoo\Watch.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
      C:\Documents and Settings\Administrateur.C8E4482ED6E9433\Bureau\RSIT.exe
      C:\Program Files\trend micro\Administrateur.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
      O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
      O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: (no name) - {66886C4D-B307-4ECA-A228-52CA9B9851A4} - (no file)
      O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
      O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
      O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
      O4 - HKLM\..\Run: [Vistadrv] C:\Windows\system32\Vistadrive\vsdrv.exe
      O4 - HKLM\..\Run: [TransBar] C:\Windows\System32\TransBar.exe /s
      O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
      O4 - HKLM\..\Run: [TopDesk] C:\WINDOWS\system32\topdesk.exe
      O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS2\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS2\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
      O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
      O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS2\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
      O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS2\system32\sti_ci.dll,WiaCreateWizardMenu
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
      O4 - HKCU\..\Run: [iterdoc] "c:\documents and settings\administrateur.c8e4482ed6e9433\local settings\application data\iterdoc.exe" iterdoc
      O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
      O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
      O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
      O16 - DPF: {3A226D85-574D-4272-B73C-DBCAECF709B3} (TNSClickerb.Clicker) - http://www.consoclicker.com/TNSClickrb.CAB
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{29AFF8A4-182A-4217-BE94-83E2B4081E5F}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CS1\Services\Tcpip\..\{29AFF8A4-182A-4217-BE94-83E2B4081E5F}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CS2\Services\Tcpip\..\{29AFF8A4-182A-4217-BE94-83E2B4081E5F}: NameServer = 208.67.222.222,208.67.220.220
      O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
      O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS2\System32\FTRTSVC.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS2\system32\nvsvc32.exe
      End of file - 9847 bytes

      ======Scheduled tasks folder======

      C:\WINDOWS2\tasks\MP Scheduled Scan.job

      ======Registry dump======

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
      Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
      Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14 92504]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
      SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
      Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}]
      Ask Search Assistant BHO - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL [2008-01-22 57344]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
      Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]
      Ask Toolbar BHO - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL [2008-01-22 245760]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      SaveLinksOrder
      Locked
      {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - StylerToolBar - C:\Program Files\styler\TB\StylerTB.dll [2006-05-02 102400]
      {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - Ask Toolbar - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL [2008-01-22 245760]
      {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]
      {66886C4D-B307-4ECA-A228-52CA9B9851A4}

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
      "SkyTel"=C:\WINDOWS2\SkyTel.EXE [2006-05-16 2879488]
      "UberIcon"=C:\Program Files\UberIcon\UberIcon Manager.exe [2005-08-12 180224]
      "VisualTaskTips"=C:\Windows\System32\VisualTaskTips.exe []
      "Vistadrv"=C:\Windows\system32\Vistadrive\vsdrv.exe []
      "TransBar"=C:\Windows\System32\TransBar.exe /s []
      "Styler"=C:\Program Files\styler\Styler.exe [2006-05-03 307200]
      "TopDesk"=C:\WINDOWS\system32\topdesk.exe []
      "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2007-01-10 1235456]
      "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
      "NvCplDaemon"=C:\WINDOWS2\system32\NvCpl.dll [2006-08-16 7630848]
      "nwiz"=nwiz.exe /install []
      "NvMediaCenter"=C:\WINDOWS2\system32\NvMcTray.dll [2006-08-16 86016]
      "RTHDCPL"=C:\WINDOWS2\RTHDCPL.EXE [2006-12-19 16062464]
      "Alcmtr"=C:\WINDOWS2\ALCMTR.EXE [2005-05-03 69632]
      "BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-03-28 622592]
      "SetDefPrt"=C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe [2005-01-26 49152]
      "ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2006-04-10 61440]
      "NeroFilterCheck"=C:\WINDOWS2\system32\NeroCheck.exe [2001-07-09 155648]
      "NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-09-20 1836328]
      "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [2007-09-25 132496]
      "NWEReboot"= []
      "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]
      "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
      "WOOWATCH"=C:\PROGRA~1\Wanadoo\Watch.exe [2004-08-23 20480]
      "WOOTASKBARICON"=C:\PROGRA~1\Wanadoo\GestMaj.exe [2004-10-14 32768]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
      "WIAWizardMenu"=C:\WINDOWS2\system32\sti_ci.dll [2004-08-19 138240]

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"=C:\WINDOWS2\system32\ctfmon.exe [2004-08-19 15360]
      "BitTorrent"=C:\Program Files\BitTorrent\bittorrent.exe --force_start_minimized []
      "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe [2007-09-20 202024]
      "WOOKIT"=C:\PROGRA~1\Wanadoo\Shell.exe [2004-08-23 122880]
      "iterdoc"=c:\documents and settings\administrateur.c8e4482ed6e9433\local settings\application data\iterdoc.exe [2009-09-20 221184]

      C:\Documents and Settings\Administrateur.C8E4482ED6E9433\Menu Démarrer\Programmes\Démarrage
      OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
      C:\WINDOWS2\system32\WgaLogon.dll [2006-06-27 3584]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
      "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
      "dontdisplaylastusername"=0
      "legalnoticecaption"=
      "legalnoticetext"=
      "shutdownwithoutlogon"=1
      "undockwithoutlogon"=1

      [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
      "NoDriveTypeAutoRun"=95000000
      "NoSMHelp"=1

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
      "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
      "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
      "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
      "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
      "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

      ======List of files/folders created in the last 1 months======

      2009-09-20 12:00:33 ----D---- C:\rsit
      2009-09-20 09:32:10 ----A---- C:\FindyKill.txt
      2009-09-19 18:08:54 ----D---- C:\FindyKill
      2009-09-06 16:26:35 ----D---- C:\Documents and Settings\Administrateur.C8E4482ED6E9433\Application Data\vlc
      2009-09-06 16:25:46 ----D---- C:\Program Files\VideoLAN

      ======List of files/folders modified in the last 1 months======

      2009-09-20 12:00:50 ----D---- C:\Program Files\Trend Micro
      2009-09-20 11:49:12 ----D---- C:\Program Files\Mozilla Firefox
      2009-09-20 11:49:06 ----D---- C:\Documents and Settings\Administrateur.C8E4482ED6E9433\Application Data\OpenOffice.org2
      2009-09-20 11:48:48 ----D---- C:\Program Files\Wanadoo
      2009-09-20 11:39:39 ----D---- C:\Program Files\BitTorrent_DNA
      2009-09-20 10:39:49 ----D---- C:\WINDOWS2\system32
      2009-09-20 10:39:48 ----A---- C:\WINDOWS2\system32\PerfStringBackup.INI
      2009-09-20 10:37:59 ----SHD---- C:\RECYCLER
      2009-09-20 10:14:29 ----D---- C:\WINDOWS2
      2009-09-20 09:49:59 ----D---- C:\WINDOWS2\Prefetch
      2009-09-20 09:35:11 ----D---- C:\WINDOWS2\Temp
      2009-09-20 09:35:10 ----SD---- C:\WINDOWS2\Tasks
      2009-09-20 09:32:29 ----D---- C:\WINDOWS2\system32\CatRoot2
      2009-09-20 09:30:47 ----A---- C:\WINDOWS2\SchedLgU.Txt
      2009-09-19 16:53:33 ----RD---- C:\Program Files
      2009-09-19 16:51:51 ----D---- C:\MEDIA
      2009-09-19 16:44:59 ----D---- C:\Program Files\BitTorrent
      2009-09-06 16:23:37 ----A---- C:\WINDOWS2\NeroDigital.ini
      2009-09-06 16:22:02 ----D---- C:\Program Files\SLD Codec Pack
      2009-08-29 13:58:51 ----D---- C:\Program Files\Lavalys

      ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
      R1 avipbb;avipbb; C:\WINDOWS2\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
      R1 ssmdrv;ssmdrv; C:\WINDOWS2\system32\DRIVERS\ssmdrv.sys [2009-07-13 28520]
      R1 StarOpen;StarOpen; C:\WINDOWS2\system32\drivers\StarOpen.sys [2006-07-24 5632]
      R2 avgntflt;avgntflt; C:\WINDOWS2\system32\DRIVERS\avgntflt.sys [2009-08-18 55656]
      R2 fssfltr;FssFltr; C:\WINDOWS2\system32\DRIVERS\fssfltr_tdi.sys [2009-02-06 55152]
      R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS2\system32\DRIVERS\HDAudBus.sys [2006-12-24 138752]
      R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS2\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
      R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS2\system32\drivers\RtkHDAud.sys [2006-12-21 4405248]
      R3 mouhid;Pilote HID de souris; C:\WINDOWS2\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
      R3 nv;nv; C:\WINDOWS2\system32\DRIVERS\nv4_mini.sys [2006-08-16 3959712]
      R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS2\system32\DRIVERS\NVENETFD.sys [2006-07-11 57856]
      R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS2\system32\DRIVERS\nvnetbus.sys [2006-07-11 20480]
      R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS2\system32\DRIVERS\usbehci.sys [2006-10-23 30208]
      R3 usbhub;Concentrateur USB2; C:\WINDOWS2\system32\DRIVERS\usbhub.sys [2006-10-23 59264]
      R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS2\system32\DRIVERS\usbohci.sys [2006-10-23 17152]
      R3 usbstor;Pilote de stockage de masse USB; C:\WINDOWS2\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
      S1 InCDPass;InCDPass; C:\WINDOWS2\system32\drivers\InCDPass.sys []
      S1 InCDRm;InCD Reader; C:\WINDOWS2\system32\drivers\InCDRm.sys []
      S1 kbdhid;Pilote HID de clavier; C:\WINDOWS2\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
      S3 BrScnUsb;Brother USB Still Image driver; C:\WINDOWS2\system32\DRIVERS\BrScnUsb.sys [2004-10-15 15295]
      S3 NCHSSVAD;SoundTap Recorder; C:\WINDOWS2\system32\drivers\nchssvad.sys [2008-07-29 27136]
      S3 optousb;OPTO ELECTRONICS optousb; C:\WINDOWS2\system32\DRIVERS\optousb.sys [2006-10-18 18560]
      S3 optovcm;OPTO ELECTRONICS optovcm; C:\WINDOWS2\system32\DRIVERS\optovcm.sys [2006-10-19 25344]
      S3 PCANDIS5;PCANDIS5 Protocol Driver; \??\C:\WINDOWS2\system32\PCANDIS5.SYS []
      S3 QV2KUX;Appareil photo numérique Casio; C:\WINDOWS2\system32\DRIVERS\qv2kux.sys [2001-08-17 3328]
      S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS2\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
      S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS2\system32\DRIVERS\ssm_bus.sys [2005-08-30 58320]
      S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS2\system32\DRIVERS\ssm_mdfl.sys [2005-08-30 8336]
      S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS2\system32\DRIVERS\ssm_mdm.sys [2005-08-30 94000]
      S3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS2\system32\drivers\usbaudio.sys [2004-08-04 59264]
      S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS2\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
      S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS2\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
      S3 ZDCndis5;ZDCndis5 Protocol Driver; \??\C:\WINDOWS2\system32\ZDCndis5.SYS []
      S4 InCDFs;InCD File System; C:\WINDOWS2\system32\drivers\InCDFs.sys []
      S4 IntelIde;IntelIde; C:\WINDOWS2\system32\drivers\IntelIde.sys []

      ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

      R2 AntiVirSchedulerService;Avira AntiVir Planificateur; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-07-13 108289]
      R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-18 185089]
      R2 FTRTSVC;France Telecom Routing Table Service; C:\WINDOWS2\System32\FTRTSVC.exe [2004-08-23 40960]
      R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS2\system32\nvsvc32.exe [2006-08-16 155715]
      R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
      R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
      S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS2\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
      S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS2\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
      S3 fsssvc;Windows Live Contrôle parental; C:\Program Files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]

      -----------------EOF-----------------
      0
  7. toptitbal Messages postés 5341 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 232
     
    Essaie de faire RSIT maintenant

    https://forums.commentcamarche.net/forum/affich-14442746-virus-trojan-et-nettoyage-de-pc#1
    0
    1. auguste_74 Messages postés 64 Statut Membre 1
       
      voici le rapport log.txt

      Logfile of random's system information tool 1.06 (written by random/random)
      Run by Administrateur at 2009-09-20 12:00:33
      Microsoft Windows XP Professionnel Service Pack 2
      System drive C: has 101 GB (66%) free of 153 GB
      Total RAM: 958 MB (55% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 12:00:50, on 20/09/2009
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16574)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS2\System32\smss.exe
      C:\WINDOWS2\system32\winlogon.exe
      C:\WINDOWS2\system32\services.exe
      C:\WINDOWS2\system32\lsass.exe
      C:\WINDOWS2\system32\svchost.exe
      C:\Program Files\Windows Defender\MsMpEng.exe
      C:\WINDOWS2\System32\svchost.exe
      C:\WINDOWS2\Explorer.EXE
      C:\WINDOWS2\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir Desktop\sched.exe
      C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      C:\WINDOWS2\System32\FTRTSVC.exe
      C:\WINDOWS2\system32\nvsvc32.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\WINDOWS2\system32\svchost.exe
      C:\WINDOWS2\system32\wscntfy.exe
      C:\Program Files\UberIcon\UberIcon Manager.exe
      C:\Program Files\styler\Styler.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\WINDOWS2\system32\RUNDLL32.EXE
      C:\WINDOWS2\RTHDCPL.EXE
      C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
      C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
      C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      C:\WINDOWS2\system32\ctfmon.exe
      C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
      C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
      C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
      C:\documents and settings\administrateur.c8e4482ed6e9433\local settings\application data\iterdoc.exe
      C:\PROGRA~1\Wanadoo\ComComp.exe
      C:\PROGRA~1\Wanadoo\Toaster.exe
      C:\PROGRA~1\Wanadoo\Inactivity.exe
      C:\PROGRA~1\Wanadoo\PollingModule.exe
      C:\WINDOWS2\System32\ALERTM~1\ALERTM~1.EXE
      C:\PROGRA~1\Wanadoo\Watch.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
      C:\Documents and Settings\Administrateur.C8E4482ED6E9433\Bureau\RSIT.exe
      C:\Program Files\trend micro\Administrateur.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
      O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\styler\TB\StylerTB.dll
      O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: (no name) - {66886C4D-B307-4ECA-A228-52CA9B9851A4} - (no file)
      O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
      O4 - HKLM\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
      O4 - HKLM\..\Run: [VisualTaskTips] C:\Windows\System32\VisualTaskTips.exe
      O4 - HKLM\..\Run: [Vistadrv] C:\Windows\system32\Vistadrive\vsdrv.exe
      O4 - HKLM\..\Run: [TransBar] C:\Windows\System32\TransBar.exe /s
      O4 - HKLM\..\Run: [Styler] C:\Program Files\styler\Styler.exe
      O4 - HKLM\..\Run: [TopDesk] C:\WINDOWS\system32\topdesk.exe
      O4 - HKLM\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS2\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS2\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
      O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
      O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS2\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
      O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS2\system32\sti_ci.dll,WiaCreateWizardMenu
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\system32\ctfmon.exe
      O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
      O4 - HKCU\..\Run: [iterdoc] "c:\documents and settings\administrateur.c8e4482ed6e9433\local settings\application data\iterdoc.exe" iterdoc
      O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
      O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
      O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
      O16 - DPF: {3A226D85-574D-4272-B73C-DBCAECF709B3} (TNSClickerb.Clicker) - http://www.consoclicker.com/TNSClickrb.CAB
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{29AFF8A4-182A-4217-BE94-83E2B4081E5F}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CS1\Services\Tcpip\..\{29AFF8A4-182A-4217-BE94-83E2B4081E5F}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CS2\Services\Tcpip\..\{29AFF8A4-182A-4217-BE94-83E2B4081E5F}: NameServer = 208.67.222.222,208.67.220.220
      O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
      O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS2\System32\FTRTSVC.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS2\system32\nvsvc32.exe
      0