PC qui rame + Rapport

SP_Addict Messages postés 46 Statut Membre -  
SP_Addict Messages postés 46 Statut Membre -
Bonjour,
j'ai suivi l'excellent tuto [Virus] Méthode préliminaire de désinfection, et je vous poste les 2 rapports RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by YOEUNG at 2009-10-07 20:27:11
Microsoft® Windows Vista™ Édition Familiale Premium
System drive C: has 70 GB (31%) free of 230 GB
Total RAM: 1791 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:27:18, on 07/10/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\YOEUNG\Downloads\THEGRATUIT\HiJackThis.exe
C:\Users\YOEUNG\Downloads\THEGRATUIT\RSIT.exe
C:\Users\YOEUNG\Downloads\THEGRATUIT\YOEUNG.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://format.packardbell.com/...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: HopSurf toolbar - {E9FAB13D-4600-49E1-90D1-EE961C859D39} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HopSurf - {ED98F8D1-09AC-4107-B2FF-91DBE011B0C5} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
O13 - Gopher Prefix:
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Service Google Update (gupdate1ca29a125310338) (gupdate1ca29a125310338) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 8218 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Extension de garantie.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\Recovery DVD Creator.job
C:\Windows\tasks\User_Feed_Synchronization-{42FA57C4-9840-4D0A-95DE-0A120A577A1E}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\ctbr.dll [2009-08-10 1218560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll [2007-09-28 521528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}]
EoBho Class - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - Barre d'outils &Crawler - C:\PROGRA~1\Crawler\ctbr.dll [2009-08-10 1218560]
{E9FAB13D-4600-49E1-90D1-EE961C859D39} - HopSurf toolbar - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll [2009-09-04 1122496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-08-30 1006264]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2006-11-09 3784704]
""= []
"RoxWatchTray"=C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [2007-01-11 232184]
"EoEngine"= []
"EoWeather"= []
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2006-11-02 215552]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2009-03-10 2233856]
"MSConfig"=C:\Windows\system32\msconfig.exe [2006-11-02 222208]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2009-09-04 1796368]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-10 1232896]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]
"Speech Recognition"=C:\Windows\Speech\Common\sapisvr.exe [2006-11-02 49664]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe [2007-02-21 366400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmpcSys]
C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [2007-07-19 1120568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe [2007-02-20 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^YOEUNG^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
C:\PROGRA~1\OPENOF~1.ORG\program\QUICKS~1.EXE [2008-12-15 384000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" C:\Windows\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05c386d5-acc4-11dd-a150-001bb9b1cb0b}]
shell\Auto\command - cmd /C launch.bat
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f946360-a4f2-11dd-9a72-001bb9b1cb0b}]
shell\AutoRun\command - explorer.exe .

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e61d7c2-9076-11dd-ae86-001bb9b1cb0b}]
shell\Auto\command - cmd /C launch.bat
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bee8a22-ad97-11de-aa61-001bb9b1cb0b}]
shell\Auto\command - cmd /C launch.bat
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

======List of files/folders created in the last 2 months======

2009-10-07 20:27:11 ----D---- C:\rsit
2009-10-07 20:19:12 ----A---- C:\Windows\ntbtlog.txt
2009-09-14 21:01:05 ----D---- C:\Program Files\CCleaner
2009-09-09 12:58:41 ----A---- C:\Windows\system32\netiohlp.dll
2009-09-09 12:58:38 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-09-09 12:58:34 ----A---- C:\Windows\system32\ROUTE.EXE
2009-09-09 12:58:34 ----A---- C:\Windows\system32\netiougc.exe
2009-09-09 12:58:34 ----A---- C:\Windows\system32\MRINFO.EXE
2009-09-09 12:58:33 ----A---- C:\Windows\system32\TCPSVCS.EXE
2009-09-09 12:58:33 ----A---- C:\Windows\system32\NETSTAT.EXE
2009-09-09 12:58:33 ----A---- C:\Windows\system32\finger.exe
2009-09-09 12:58:33 ----A---- C:\Windows\system32\ARP.EXE
2009-09-09 12:58:32 ----A---- C:\Windows\system32\HOSTNAME.EXE
2009-09-09 12:58:29 ----A---- C:\Windows\system32\netevent.dll
2009-09-09 12:55:18 ----A---- C:\Windows\system32\wlansec.dll
2009-09-09 12:55:18 ----A---- C:\Windows\system32\wlanmsm.dll
2009-09-09 12:55:18 ----A---- C:\Windows\system32\L2SecHC.dll
2009-09-09 12:55:17 ----A---- C:\Windows\system32\wlansvc.dll
2009-09-09 12:55:17 ----A---- C:\Windows\system32\wlanhlp.dll
2009-09-09 12:55:17 ----A---- C:\Windows\system32\wlanapi.dll
2009-09-09 12:55:01 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-09-09 12:55:00 ----A---- C:\Windows\system32\mf.dll
2009-09-09 12:54:57 ----A---- C:\Windows\system32\rrinstaller.exe
2009-09-09 12:54:56 ----A---- C:\Windows\system32\mfps.dll
2009-09-09 12:54:55 ----A---- C:\Windows\system32\mfpmp.exe
2009-09-09 12:54:54 ----A---- C:\Windows\system32\mferror.dll
2009-09-09 12:54:31 ----A---- C:\Windows\system32\jscript.dll
2009-09-08 13:28:44 ----D---- C:\Program Files\Project64 1.6
2009-09-04 19:15:42 ----D---- C:\Users\YOEUNG\AppData\Roaming\Comodo
2009-09-04 19:12:45 ----D---- C:\ProgramData\Comodo
2009-09-04 19:12:38 ----A---- C:\Windows\system32\guard32.dll
2009-09-04 19:12:33 ----D---- C:\Program Files\COMODO
2009-09-03 13:00:22 ----A---- C:\Windows\system32\gameux.dll
2009-09-03 13:00:19 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-09-03 13:00:18 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2009-08-30 20:38:40 ----D---- C:\Program Files\Common Files\DivX Shared
2009-08-27 05:47:02 ----A---- C:\Windows\system32\tzres.dll
2009-08-22 15:12:55 ----A---- C:\Windows\system32\msv1_0.dll
2009-08-22 15:12:55 ----A---- C:\Windows\system32\kerberos.dll
2009-08-22 15:12:54 ----A---- C:\Windows\system32\wdigest.dll
2009-08-22 15:12:53 ----A---- C:\Windows\system32\lsasrv.dll
2009-08-22 15:12:52 ----A---- C:\Windows\system32\schannel.dll
2009-08-22 15:12:51 ----A---- C:\Windows\system32\secur32.dll
2009-08-22 15:12:51 ----A---- C:\Windows\system32\lsass.exe
2009-08-19 08:50:21 ----D---- C:\Program Files\Crawler
2009-08-12 09:02:47 ----A---- C:\Windows\system32\atl.dll
2009-08-12 09:02:43 ----A---- C:\Windows\system32\wkssvc.dll
2009-08-12 09:02:39 ----A---- C:\Windows\system32\mstscax.dll
2009-08-12 09:02:38 ----A---- C:\Windows\system32\tsgqec.dll
2009-08-12 09:02:38 ----A---- C:\Windows\system32\aaclient.dll
2009-08-12 09:02:34 ----A---- C:\Windows\system32\msvfw32.dll
2009-08-12 09:02:34 ----A---- C:\Windows\system32\mciavi32.dll
2009-08-12 09:02:34 ----A---- C:\Windows\system32\avifil32.dll
2009-08-12 09:02:34 ----A---- C:\Windows\system32\avicap32.dll
2009-08-12 09:02:33 ----A---- C:\Windows\system32\msvidc32.dll
2009-08-12 09:02:33 ----A---- C:\Windows\system32\msrle32.dll
2009-08-12 09:02:27 ----A---- C:\Windows\system32\wmp.dll
2009-08-12 09:02:26 ----A---- C:\Windows\system32\wmpdxm.dll
2009-08-12 09:02:24 ----A---- C:\Windows\system32\spwmp.dll
2009-08-12 09:02:23 ----A---- C:\Windows\system32\dxmasf.dll
2009-08-12 09:02:22 ----A---- C:\Windows\system32\wmploc.DLL
2009-08-11 13:42:12 ----D---- C:\Program Files\Connective Tools
2009-08-10 21:06:18 ----D---- C:\Windows\pss
2009-08-10 10:44:23 ----A---- C:\Windows\system32\infocardapi.dll
2009-08-10 10:44:22 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-10 10:44:18 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-08-10 10:44:18 ----A---- C:\Windows\system32\icardres.dll
2009-08-10 10:44:18 ----A---- C:\Windows\system32\icardagt.exe
2009-08-10 10:44:14 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-08-10 10:44:10 ----A---- C:\Windows\system32\PresentationHost.exe
2009-08-10 10:32:27 ----A---- C:\Windows\system32\dfshim.dll
2009-08-10 10:32:20 ----A---- C:\Windows\system32\mscoree.dll
2009-08-10 10:32:18 ----A---- C:\Windows\system32\netfxperf.dll
2009-08-10 10:31:58 ----A---- C:\Windows\system32\mscorier.dll
2009-08-10 10:31:49 ----A---- C:\Windows\system32\mscories.dll
2009-08-09 21:05:38 ----A---- C:\Windows\system32\d3dx10_37.dll
2009-08-09 21:05:38 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2009-08-09 21:05:36 ----A---- C:\Windows\system32\D3DX9_37.dll
2009-08-09 21:04:27 ----D---- C:\Program Files\Microsoft Games for Windows - LIVE

======List of files/folders modified in the last 2 months======

2009-10-07 20:23:06 ----D---- C:\Program Files\Mozilla Firefox
2009-10-07 20:19:12 ----D---- C:\Windows
2009-10-07 20:16:51 ----D---- C:\Windows\Temp
2009-10-07 20:02:30 ----D---- C:\Windows\Prefetch
2009-10-07 19:57:36 ----SHD---- C:\System Volume Information
2009-10-07 19:53:41 ----D---- C:\Windows\system32\wbem
2009-10-07 19:52:52 ----D---- C:\Windows\system32\config
2009-10-07 19:52:43 ----D---- C:\Windows\Tasks
2009-10-07 19:52:43 ----D---- C:\Windows\system32\Tasks
2009-10-07 19:52:43 ----D---- C:\Windows\system32\spool
2009-10-07 19:52:43 ----D---- C:\Windows\system32\drivers
2009-10-07 19:52:43 ----D---- C:\Windows\system32\CodeIntegrity
2009-10-07 19:52:43 ----D---- C:\Windows\system32\catroot2
2009-10-07 19:52:43 ----D---- C:\Windows\inf
2009-10-07 19:52:43 ----D---- C:\Users\YOEUNG\AppData\Roaming\Spyware Terminator
2009-10-07 19:52:43 ----D---- C:\ProgramData\Spyware Terminator
2009-10-07 19:52:43 ----D---- C:\Program Files\Spyware Terminator
2009-10-07 19:52:43 ----AD---- C:\Windows\System32
2009-10-07 19:52:42 ----D---- C:\Windows\registration
2009-10-05 13:43:31 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-09-28 21:06:47 ----D---- C:\Users\YOEUNG\AppData\Roaming\Mozilla
2009-09-21 10:48:58 ----RD---- C:\Program Files
2009-09-15 12:55:34 ----D---- C:\Downloads
2009-09-14 21:25:06 ----D---- C:\ancien disque dur
2009-09-14 21:04:28 ----D---- C:\Windows\Debug
2009-09-10 12:56:47 ----D---- C:\Windows\winsxs
2009-09-10 12:54:29 ----D---- C:\Windows\system32\migration
2009-09-10 12:54:29 ----D---- C:\Windows\system32\fr-FR
2009-09-10 12:48:42 ----D---- C:\Windows\system32\catroot
2009-09-10 12:48:35 ----D---- C:\Program Files\Windows Mail
2009-09-10 12:46:16 ----D---- C:\Windows\ehome
2009-09-08 13:28:51 ----SHD---- C:\Windows\Installer
2009-09-07 20:56:25 ----D---- C:\Program Files\Common Files
2009-09-07 20:49:05 ----D---- C:\ProgramData\Adobe
2009-09-05 13:57:42 ----D---- C:\Windows\system32\WDI
2009-09-04 19:12:45 ----HD---- C:\ProgramData
2009-09-03 23:24:06 ----D---- C:\Windows\AppPatch
2009-09-01 21:11:48 ----D---- C:\ProgramData\Roxio
2009-08-30 20:40:22 ----D---- C:\Program Files\Google
2009-08-30 20:38:52 ----D---- C:\Program Files\DivX
2009-08-28 23:38:20 ----A---- C:\Windows\system32\mrt.exe
2009-08-27 22:38:24 ----D---- C:\Windows\WindowsMobile
2009-08-22 19:17:03 ----D---- C:\Windows\Microsoft.NET
2009-08-22 17:47:06 ----D---- C:\ProgramData\Microsoft Help
2009-08-22 17:47:04 ----RSD---- C:\Windows\assembly
2009-08-22 15:21:40 ----RSD---- C:\Windows\Fonts
2009-08-22 15:21:34 ----D---- C:\Program Files\Common Files\microsoft shared
2009-08-17 13:01:56 ----D---- C:\Program Files\WinClamAVShield
2009-08-17 12:54:36 ----HD---- C:\Program Files\InstallShield Installation Information
2009-08-13 09:27:58 ----D---- C:\Program Files\Windows Media Player
2009-08-10 11:06:35 ----D---- C:\Windows\system32\XPSViewer
2009-08-10 11:06:35 ----D---- C:\Windows\system32\en-US

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2009-09-04 29520]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2009-09-04 74328]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2009-03-19 23400]
R3 RTL8023xp;Pilote Realtek 10/100 NIC Family NDIS x86; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2006-11-02 47104]
S1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2009-09-04 128888]
S1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\Windows\system32\drivers\sp_rsdrv2.sys [2009-03-10 142592]
S1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
S3 AteksoftAudio;WebCamera Plus Audio; C:\Windows\system32\drivers\ateksoftaudio.sys [2007-12-25 11776]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-02-26 3520512]
S3 audiobridge;Virtual Audio Bridge; C:\Windows\system32\DRIVERS\aubridge.sys [2007-07-23 22528]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2006-11-08 1647976]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\Windows\system32\DRIVERS\k750bus.sys [2005-02-11 55216]
S3 Ltn_stk7070P;PCTV based TV tuner device; C:\Windows\system32\DRIVERS\Ltn_stk7070P.sys [2007-06-14 466048]
S3 Ltn_stkrc;PCTV Infrared Receiver; C:\Windows\system32\DRIVERS\Ltn_stkrc.sys [2007-06-13 13440]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 PnkBstrK;PnkBstrK; \??\C:\Windows\system32\drivers\PnkBstrK.sys [2009-07-06 139904]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-02-26 3520512]
S3 usb_rndisx;Carte RNDIS USB; C:\Windows\system32\DRIVERS\usb8023x.sys [2006-11-02 14848]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-03-26 36864]
S3 WINUSB;WinUSB Service; C:\Windows\system32\DRIVERS\WinUSB.SYS [2006-11-02 31616]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
S2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-02-26 655360]
S2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2009-09-04 715392]
S2 gupdate1ca29a125310338;Service Google Update (gupdate1ca29a125310338); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-08-30 133104]
S2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2009-07-06 75064]
S2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2009-07-06 189744]
S2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2006-11-02 22016]
S2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2007-01-11 166648]
S2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2009-03-10 540672]
S2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2006-11-02 22016]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-30 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-01-11 887544]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2006-09-14 73728]

-----------------EOF-----------------
Configuration: Windows Vista
Firefox 3.5.3

34 réponses

  • 1
  • 2
Résumé de la discussion

Une infection détectée après un tutoriel de désinfection est présentée, avec des rapports RSIT et HijackThis qui révèlent un système Windows Vista où les paramètres réseau et des composants indésirables posent problème. Plusieurs éléments signalés incluent des pages de démarrage modifiées, des barres d'outils indésirables, des BHO suspects et des services comme PnkBstrA/B, Spyware Terminator ou Guard32.dll. En pratique, les meilleures réponses évoquent le passage en mode sécurité, la suppression des composants malveillants, la restauration des paramètres du navigateur et l’élimination des entrées auto‑exécutables. Une information utile supplémentaire: les journaux révèlent la présence de composants tiers tels que BitComet et Java ssv.dll, ainsi que des entrées Run et des outils de sécurité qui peuvent persister sans nettoyage approfondi.

Bobot (l'IA à votre service)
  1. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Salut,

    -+-+-+-> AD-Remover <-+-+-+-

    [x] Si tu es sous vista : Désactive l'UAC (Menu Démarrer \ Panneau de Configuration \ Comptes d'utilisateurs et protection des utilisateurs \ Comptes d'utilisateurs \ Activer ou désactiver le contrôle des comptes d'utilisateurs \ décoche la case Utiliser le contrôle ... et valide par OK , il te sera demandé de redémarrer, fais le)

    [x] Télécharge Ad-remover (de C_XX) sur ton bureau : http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

    [x] Lance l'installation avec les paramètres par défaut..

    ! Déconnecte toi et ferme toutes applications en cours !

    [x] Double-clique sur le raccourci Ad-Remover sur ton Bureau. (Clic droit -> "Exécuter en tant qu'administrateur". ( Pour Vista))

    [x] Séléctionne l'option F pour français

    [x] A la fenêtre qui s'affiche clique sur " oui "

    [x] Séléctionne l'option S

    [x] Laisse l'outil travailler.

    [x] Une fois le scan fini, appuie sur une touche, le rapport s'ouvre

    [x] Copie/colle le dans ton prochain post
    1
  2. Utilisateur anonyme
     
    Bonsoir

    A toi la main Xplode
    ;)
    @+
    0
  3. SP_Addict Messages postés 46 Statut Membre
     
    voila le rapport sur AD-remover

    .
    ======= RAPPORT D'AD-REMOVER 1.1.4.5_X | UNIQUEMENT XP/VISTA/7 =======
    .
    Mit à jour par C_XX le 07.10.2009 à 18:54
    Contact: AdRemover.contact@gmail.com
    Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
    .
    Lancé à: 20:52:55, 07/10/2009 | Mode sans echec | Option: SCAN
    Exécuté de: C:\Program Files\Ad-Remover\
    Système d'exploitation: Microsoft® Windows Vista™ Home Premium v6.0.6000
    Nom du PC: PC-DE-YOEUNG | Utilisateur actuel: YOEUNG
    .
    ============== ÉLÉMENT(S) TROUVÉ(S) ==============
    .

    HKU\S-1-5-21-472928304-1371045596-665958659-1002\Software\Eorezo
    HKLM\Software\Mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\EoEngine
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\EoWeather
    HKCU\software\microsoft\internet explorer\searchscopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
    HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
    HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
    .
    .
    ============== Scan additionnel ==============
    .
    .
    * Mozilla FireFox Version 3.5.3 [fr] *
    .
    Nom du profil: l468x7ud.default (YOEUNG)
    .
    (Prefs.js) user_pref("browser.search.selectedEngine", "Live Search");
    (Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.msn.com/");
    .
    .
    * Internet Explorer Version 7.0.6000.16890 *
    .
    [HKEY_CURRENT_USER\..\Internet Explorer\Main]
    .
    Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
    Start Page: hxxp://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
    Search Bar: hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60341
    Default_Page_URL: hxxp://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
    .
    [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
    .
    Start Page: hxxp://fr.yahoo.com
    Default_Page_URL: hxxp://fr.yahoo.com
    Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
    Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
    .
    [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
    .
    Tabs: tbr:res?id=tabs&rep=1
    .
    ============== Suspect (Cracks, Serials ... ) ==============
    .
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\Crack pes 09 + serial\pes2009.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\autorun.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\setup.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\Crack\pes2009.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\DirectX9c\DXSETUP.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\program files\KONAMI\Pro Evolution Soccer 2009\settings.exe
    .
    ===================================
    .
    3160 Octet(s) - C:\Ad-Report-SCAN[1].log
    .
    43 Fichier(s) - C:\Users\YOEUNG\AppData\Local\Temp
    39 Fichier(s) - C:\Windows\Temp
    .
    0 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
    0 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
    .
    Fin à: 20:56:14 | 07/10/2009 - SCAN[1]
    .
    ============== E.O.F ==============
    .
    0
  4. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     

    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\Crack pes 09 + serial\pes2009.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\autorun.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\setup.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\Crack\pes2009.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\DirectX9c\DXSETUP.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\program files\KONAMI\Pro Evolution Soccer 2009\pes2009.exe
    C:\Users\YOEUNG\Documents\pes09\PES 2009+Crack et serial\PES 2009\program files\KONAMI\Pro Evolution Soccer 2009\settings.exe


    ----> A supprimer, source d'infections

    -+-+-+-> Suppression - AD-Remover <-+-+-+-

    [x] Relance Ad-Remover puis séléctionne l'option " L "

    [x] Une fois le nettoyage terminé, le rapport s'affiche.

    [x] Copie/Colle le dans ton prochain message
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. SP_Addict Messages postés 46 Statut Membre
     
    voila le rapport

    .
    ======= RAPPORT D'AD-REMOVER 1.1.4.5_X | UNIQUEMENT XP/VISTA/7 =======
    .
    Mit à jour par C_XX le 07.10.2009 à 18:54
    Contact: AdRemover.contact@gmail.com
    Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
    .
    Lancé à: 21:03:32, 07/10/2009 | Mode sans echec | Option: CLEAN
    Exécuté de: C:\Program Files\Ad-Remover\
    Système d'exploitation: Microsoft® Windows Vista™ Home Premium v6.0.6000
    Nom du PC: PC-DE-YOEUNG | Utilisateur actuel: YOEUNG
    .
    ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
    .

    HKU\S-1-5-21-472928304-1371045596-665958659-1002\Software\Eorezo
    HKLM\Software\Mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\EoEngine
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\EoWeather
    HKCU\software\microsoft\internet explorer\searchscopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
    HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
    .

    (!) -- Fichiers temporaires supprimés.

    .
    ============== Scan additionnel ==============
    .
    .
    * Mozilla FireFox Version 3.5.3 [fr] *
    .
    Nom du profil: l468x7ud.default (YOEUNG)
    .
    (Prefs.js) user_pref("browser.search.selectedEngine", "Live Search");
    (Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.msn.com/");
    .
    .
    * Internet Explorer Version 7.0.6000.16890 *
    .
    [HKEY_CURRENT_USER\..\Internet Explorer\Main]
    .
    Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
    Start Page: hxxp://fr.msn.com/
    Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    .
    [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
    .
    Start Page: hxxp://fr.msn.com/
    Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
    Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    Search bar: hxxp://search.msn.com/spbasic.htm
    .
    [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
    .
    Tabs: res://ieframe.dll/tabswelcome.htm
    .
    ===================================
    .
    2367 Octet(s) - C:\Ad-Report-CLEAN[1].log
    3489 Octet(s) - C:\Ad-Report-SCAN[1].log
    .
    25 Fichier(s) - C:\Users\YOEUNG\AppData\Local\Temp
    4 Fichier(s) - C:\Windows\Temp
    .
    20 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
    0 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
    .
    Fin à: 21:07:24 | 07/10/2009 - CLEAN[1]
    .
    ============== E.O.F ==============
    .
    0
  7. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Bien.

    -+-+-+-> Toolbar S&D <-+-+-+-

    [x]Télécharge Toolbar S&D Ici : https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

    [x] Suis le tutoriel disponible à cette adresse : https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/

    [x] Lance l'option 1 ( Recherche )

    [x] Puis copie/colle le rapport dans ton prochain message ( Il se trouve sous C:\TB.txt )
    0
  8. SP_Addict Messages postés 46 Statut Membre
     
    voila le rapport

    -----------\\ ToolBar S&D 1.2.9 XP/Vista

    Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6000 )
    X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 3.00GHz )
    BIOS : Default System BIOS
    USER : YOEUNG ( Administrator )
    BOOT : Fail-safe with network boot
    Antivirus : COMODO Antivirus 3.9 (Activated)
    Firewall : COMODO Firewall 3.9 (Activated)
    C:\ (Local Disk) - NTFS - Total:224 Go (Free:76 Go)
    E:\ (USB) - FAT - Total:968 Mo (Free:0 Go)
    F:\ (USB)
    G:\ (USB)
    H:\ (CD or DVD)
    I:\ (USB)

    "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
    Option : [1] ( 07/10/2009|21:14 )

    [ UAC => 0 ]

    -----------\\ Recherche de Fichiers / Dossiers ...

    C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Barre d'outils Crawler
    C:\Program Files\Crawler
    C:\Program Files\Crawler\adrkeys.dat
    C:\Program Files\Crawler\COMMON_FF.dat
    C:\Program Files\Crawler\confirm.dat
    C:\Program Files\Crawler\ctbcomm.dll
    C:\Program Files\Crawler\ctbr.dll
    C:\Program Files\Crawler\CTConf.dat
    C:\Program Files\Crawler\CTipsDef.dll
    C:\Program Files\Crawler\CToolbar.exe
    C:\Program Files\Crawler\CUpdate.exe
    C:\Program Files\Crawler\Download
    C:\Program Files\Crawler\firefox
    C:\Program Files\Crawler\Languages
    C:\Program Files\Crawler\lookfor.dat
    C:\Program Files\Crawler\majorse.dat
    C:\Program Files\Crawler\rootmenu.dat
    C:\Program Files\Crawler\services.dat
    C:\Program Files\Crawler\STWSGLanguageAct
    C:\Program Files\Crawler\STWSG_FF.dat
    C:\Program Files\Crawler\TBR5LanguageAct
    C:\Program Files\Crawler\Update
    C:\Program Files\Crawler\WebSecurityGuard.dll
    C:\Program Files\Crawler\WSGData
    C:\Program Files\Crawler\firefox\chrome
    C:\Program Files\Crawler\firefox\chrome.manifest
    C:\Program Files\Crawler\firefox\components
    C:\Program Files\Crawler\firefox\install.ini
    C:\Program Files\Crawler\firefox\install.rdf
    C:\Program Files\Crawler\firefox\stwsg_ff.ini
    C:\Program Files\Crawler\firefox\chrome\common.jar
    C:\Program Files\Crawler\firefox\chrome\stwsg.jar
    C:\Program Files\Crawler\firefox\components\xcomm.dll
    C:\Program Files\Crawler\firefox\components\xplugin.xpt
    C:\Program Files\Crawler\firefox\components\xshared.dll
    C:\Program Files\Crawler\firefox\components\xshared.xpt
    C:\Program Files\Crawler\firefox\components\xsupport.dll
    C:\Program Files\Crawler\firefox\components\xsupport.xpt
    C:\Program Files\Crawler\firefox\components\xwsg.dll
    C:\Program Files\Crawler\Languages\STWSG_CS.cab
    C:\Program Files\Crawler\Languages\STWSG_DE.cab
    C:\Program Files\Crawler\Languages\STWSG_EN.cab
    C:\Program Files\Crawler\Languages\STWSG_ES.cab
    C:\Program Files\Crawler\Languages\STWSG_FF.cab
    C:\Program Files\Crawler\Languages\STWSG_FR.cab
    C:\Program Files\Crawler\Languages\STWSG_IT.cab
    C:\Program Files\Crawler\Languages\STWSG_NL.cab
    C:\Program Files\Crawler\Languages\STWSG_PT-BR.cab
    C:\Program Files\Crawler\Languages\STWSG_PT.cab
    C:\Program Files\Crawler\Languages\TBR5_CS.cab
    C:\Program Files\Crawler\Languages\TBR5_DE.cab
    C:\Program Files\Crawler\Languages\TBR5_EN.cab
    C:\Program Files\Crawler\Languages\TBR5_ES.cab
    C:\Program Files\Crawler\Languages\TBR5_FR.cab
    C:\Program Files\Crawler\Languages\TBR5_IT.cab
    C:\Program Files\Crawler\Languages\TBR5_NL.cab
    C:\Program Files\Crawler\Languages\TBR5_PL.cab
    C:\Program Files\Crawler\Languages\TBR5_PT-BR.cab
    C:\Program Files\Crawler\Languages\TBR5_PT.cab
    C:\Program Files\Crawler\Languages\TBR5_RU.cab
    C:\Program Files\Crawler\STWSGLanguageAct\info.ini
    C:\Program Files\Crawler\STWSGLanguageAct\language.ini
    C:\Program Files\Crawler\TBR5LanguageAct\info.ini
    C:\Program Files\Crawler\TBR5LanguageAct\language.ini
    C:\Program Files\Crawler\Update\domains.cab
    C:\Program Files\Crawler\WSGData\domains
    C:\Program Files\Crawler\WSGData\g_S-1-5-21-472928304-1371045596-665958659-1002.dat
    C:\Program Files\Crawler\WSGData\p_S-1-5-21-472928304-1371045596-665958659-1002.dat
    C:\Program Files\Crawler\WSGData\wfilter.dat
    C:\Program Files\Crawler\WSGData\w_S-1-5-21-472928304-1371045596-665958659-1002.dat
    C:\Program Files\Crawler\WSGData\domains\domains_000.dat
    C:\Program Files\Crawler\WSGData\domains\domains_000_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_001.dat
    C:\Program Files\Crawler\WSGData\domains\domains_001_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_002.dat
    C:\Program Files\Crawler\WSGData\domains\domains_002_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_003.dat
    C:\Program Files\Crawler\WSGData\domains\domains_003_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_004.dat
    C:\Program Files\Crawler\WSGData\domains\domains_004_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_005.dat
    C:\Program Files\Crawler\WSGData\domains\domains_005_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_006.dat
    C:\Program Files\Crawler\WSGData\domains\domains_006_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_007.dat
    C:\Program Files\Crawler\WSGData\domains\domains_007_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_008.dat
    C:\Program Files\Crawler\WSGData\domains\domains_008_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_009.dat
    C:\Program Files\Crawler\WSGData\domains\domains_009_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_010.dat
    C:\Program Files\Crawler\WSGData\domains\domains_010_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_011.dat
    C:\Program Files\Crawler\WSGData\domains\domains_011_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_012.dat
    C:\Program Files\Crawler\WSGData\domains\domains_012_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_013.dat
    C:\Program Files\Crawler\WSGData\domains\domains_013_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_014.dat
    C:\Program Files\Crawler\WSGData\domains\domains_014_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_015.dat
    C:\Program Files\Crawler\WSGData\domains\domains_015_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_016.dat
    C:\Program Files\Crawler\WSGData\domains\domains_016_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_017.dat
    C:\Program Files\Crawler\WSGData\domains\domains_017_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_018.dat
    C:\Program Files\Crawler\WSGData\domains\domains_018_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_019.dat
    C:\Program Files\Crawler\WSGData\domains\domains_019_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_020.dat
    C:\Program Files\Crawler\WSGData\domains\domains_020_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_021.dat
    C:\Program Files\Crawler\WSGData\domains\domains_021_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_022.dat
    C:\Program Files\Crawler\WSGData\domains\domains_022_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_023.dat
    C:\Program Files\Crawler\WSGData\domains\domains_023_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_024.dat
    C:\Program Files\Crawler\WSGData\domains\domains_024_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_025.dat
    C:\Program Files\Crawler\WSGData\domains\domains_025_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_026.dat
    C:\Program Files\Crawler\WSGData\domains\domains_026_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_027.dat
    C:\Program Files\Crawler\WSGData\domains\domains_027_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_028.dat
    C:\Program Files\Crawler\WSGData\domains\domains_028_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_029.dat
    C:\Program Files\Crawler\WSGData\domains\domains_029_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_030.dat
    C:\Program Files\Crawler\WSGData\domains\domains_030_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_031.dat
    C:\Program Files\Crawler\WSGData\domains\domains_031_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_032.dat
    C:\Program Files\Crawler\WSGData\domains\domains_032_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_033.dat
    C:\Program Files\Crawler\WSGData\domains\domains_033_diff.dat
    C:\Program Files\Crawler\WSGData\domains\domains_034.dat
    C:\Program Files\Crawler\WSGData\domains\domains_035.dat
    C:\Program Files\Crawler\WSGData\domains\domains_035_diff.dat
    C:\Program Files\Crawler\WSGData\domains\index.dat

    -----------\\ [..\Internet Explorer\Main]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
    "Local Page"="C:\\Windows\\system32\\blank.htm"
    "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
    "Start Page"="https://www.msn.com/fr-fr"
    "Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
    "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
    "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Url"="https://www.msn.com/fr-fr/actualite/"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
    "Start Page"="https://www.msn.com/fr-fr"
    "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
    "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Search bar"="http://www.bing.com/spresults.aspx"

    --------------------\\ Recherche d'autres infections

    Aucune autre infection trouvée !

    [ UAC => 1 ]

    1 - "C:\ToolBar SD\TB_1.txt" - 07/10/2009|21:15 - Option : [1]

    -----------\\ Fin du rapport a 21:15:03,79
    0
  9. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    -+-+-+-> Toolbar S&D - Nettoyage <-+-+-+-

    [x] Relance Toolbar S&D et choisi l'option 2 ( Suppression ).

    [x] Ne fait rien pendant la procédure.

    [x] Copie/Colle le rapport dans ton prochain message.
    0
  10. SP_Addict Messages postés 46 Statut Membre
     
    le rapport

    -----------\\ ToolBar S&D 1.2.9 XP/Vista

    Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6000 )
    X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 3.00GHz )
    BIOS : Default System BIOS
    USER : YOEUNG ( Administrator )
    BOOT : Fail-safe with network boot
    Antivirus : COMODO Antivirus 3.9 (Activated)
    Firewall : COMODO Firewall 3.9 (Activated)
    C:\ (Local Disk) - NTFS - Total:224 Go (Free:76 Go)
    E:\ (USB) - FAT - Total:968 Mo (Free:0 Go)
    F:\ (USB)
    G:\ (USB)
    H:\ (CD or DVD)
    I:\ (USB)

    "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
    Option : [2] ( 07/10/2009|21:18 )

    [ UAC => 1 ]

    -----------\\ SUPPRESSION

    Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Barre d'outils Crawler
    Supprime! - C:\Program Files\Crawler\adrkeys.dat
    Supprime! - C:\Program Files\Crawler\COMMON_FF.dat
    Supprime! - C:\Program Files\Crawler\confirm.dat
    Supprime! - C:\Program Files\Crawler\ctbcomm.dll
    Supprime! - C:\Program Files\Crawler\ctbr.dll
    Supprime! - C:\Program Files\Crawler\CTConf.dat
    Supprime! - C:\Program Files\Crawler\CTipsDef.dll
    Supprime! - C:\Program Files\Crawler\CToolbar.exe
    Supprime! - C:\Program Files\Crawler\CUpdate.exe
    Supprime! - C:\Program Files\Crawler\Download
    Supprime! - C:\Program Files\Crawler\firefox
    Supprime! - C:\Program Files\Crawler\Languages
    Supprime! - C:\Program Files\Crawler\lookfor.dat
    Supprime! - C:\Program Files\Crawler\majorse.dat
    Supprime! - C:\Program Files\Crawler\rootmenu.dat
    Supprime! - C:\Program Files\Crawler\services.dat
    Supprime! - C:\Program Files\Crawler\STWSGLanguageAct
    Supprime! - C:\Program Files\Crawler\STWSG_FF.dat
    Supprime! - C:\Program Files\Crawler\TBR5LanguageAct
    Supprime! - C:\Program Files\Crawler\Update
    Supprime! - C:\Program Files\Crawler\WebSecurityGuard.dll
    Supprime! - C:\Program Files\Crawler\WSGData
    Supprime! - C:\Program Files\Crawler

    -----------\\ Recherche de Fichiers / Dossiers ...

    -----------\\ [..\Internet Explorer\Main]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
    "Local Page"="C:\\Windows\\system32\\blank.htm"
    "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
    "Start Page"="https://www.msn.com/fr-fr"
    "Search Bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
    "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
    "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Url"="https://www.msn.com/fr-fr/actualite/"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
    "Start Page"="https://www.msn.com/fr-fr/"
    "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
    "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
    "Search bar"="http://www.bing.com/spresults.aspx"

    --------------------\\ Recherche d'autres infections

    Aucune autre infection trouvée !

    [ UAC => 1 ]

    1 - "C:\ToolBar SD\TB_1.txt" - 07/10/2009|21:15 - Option : [1]
    2 - "C:\ToolBar SD\TB_2.txt" - 07/10/2009|21:18 - Option : [2]

    -----------\\ Fin du rapport a 21:18:33,04
    0
  11. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Bien, fait maintenant ceci :

    -+-+-+-> USBfix <-+-+-+-

    [x] Télécharge USBfix à cette adresse : http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe

    [x] Un tutoriel est disponible ici : https://www.malekal.com/usbfix-supprimer-virus-usb/

    [x] Installe le

    [x] Branche tout tes médias amovibles ( clés USB, DD externe )

    [x] Lance USBfix en cliquant sur l'icône qui est sur ton bureau ( Clique droit -> Executer en tant qu'administrateur pour vista )

    [x] Choisis l'option F ( pour français ) et valide en appuyant sur entrée.

    [x] Au menu principal, choisi l'option 1

    [x] Laisse l'outil travailler puis poste le rapport dans ton prochain message
    0
  12. SP_Addict Messages postés 46 Statut Membre
     
    voila le rapport

    ############################## | UsbFix V6.038 |

    User : YOEUNG (Administrateurs) # PC-DE-YOEUNG
    Update on 06/10/2009 by Chiquitine29, C_XX & Chimay8
    Start at: 21:25:00 | 07/10/2009
    Website : http://pagesperso-orange.fr/NosTools/index.html

    Intel(R) Pentium(R) D CPU 3.00GHz
    Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
    Internet Explorer 7.0.6000.16890
    Windows Firewall Status : Enabled
    AV : COMODO Antivirus 3.9 [ Enabled | Updated ]
    FW : COMODO Firewall[ Enabled ]3.9

    C:\ -> Disque fixe local # 224,88 Go (76,08 Go free) [HDD] # NTFS
    E:\ -> Disque amovible # 968,25 Mo (861,06 Mo free) # FAT
    F:\ -> Disque amovible
    G:\ -> Disque amovible
    H:\ -> Disque CD-ROM
    I:\ -> Disque amovible

    ############################## | Processus actifs |

    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    ################## | Fichiers # Dossiers infectieux |

    ################## | Registre # Clés Run infectieuses |

    ################## | Registre # Mountpoints2 |

    HKCU\..\..\Explorer\MountPoints2\{05c386d5-acc4-11dd-a150-001bb9b1cb0b}
    shell\Auto\command =cmd /C launch.bat
    shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

    HKCU\..\..\Explorer\MountPoints2\{0f946360-a4f2-11dd-9a72-001bb9b1cb0b}
    shell\AutoRun\command =explorer.exe .

    HKCU\..\..\Explorer\MountPoints2\{1e61d7c2-9076-11dd-ae86-001bb9b1cb0b}
    shell\Auto\command =cmd /C launch.bat
    shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

    HKCU\..\..\Explorer\MountPoints2\{5bee8a22-ad97-11de-aa61-001bb9b1cb0b}
    shell\Auto\command =cmd /C launch.bat
    shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

    ################## | ! Fin du rapport # UsbFix V6.038 ! |
    0
  13. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    -+-+-+-> USBfix - Nettoyage <-+-+-+-

    [x] Relance USBfix mais cette fois ci choisis l'option 2

    /!\ N'oublie pas de laisser tes médias amovibles branchés sur ton PC /!\

    [x] Patiente pendant que l'outil travaille.

    [x] Ton PC redémarrera, puis USBfix analysera tes médias amovibles.

    [x] Poste le rapport situé sous C:\USBfix.txt
    0
  14. SP_Addict Messages postés 46 Statut Membre
     
    le PC a redemarer mais il n'a pas analyser mes medias amovible, je relance le programme ?
    0
  15. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Bizarre, reposte un rapport de l'option n°1, on verra si il a fait son boulot ou pas
    0
  16. SP_Addict Messages postés 46 Statut Membre
     
    je precise que j'ai demarer en mode sans echec avec partage reseau car en mode normal, la page d'accueil m'affiche un fond blanc et que ca continuer a ramer
    0
  17. SP_Addict Messages postés 46 Statut Membre
     
    voila le rapport avec option 1

    ############################## | UsbFix V6.038 |

    User : YOEUNG (Administrateurs) # PC-DE-YOEUNG
    Update on 06/10/2009 by Chiquitine29, C_XX & Chimay8
    Start at: 21:38:02 | 07/10/2009
    Website : http://pagesperso-orange.fr/NosTools/index.html

    Intel(R) Pentium(R) D CPU 3.00GHz
    Microsoft® Windows Vista™ Édition Familiale Premium (6.0.6000 32-bit) #
    Internet Explorer 7.0.6000.16890
    Windows Firewall Status : Enabled
    AV : COMODO Antivirus 3.9 [ Enabled | Updated ]
    FW : COMODO Firewall[ Enabled ]3.9

    C:\ -> Disque fixe local # 224,88 Go (76,09 Go free) [HDD] # NTFS
    D:\ -> Disque fixe local
    E:\ -> Disque amovible # 968,25 Mo (861,06 Mo free) # FAT
    F:\ -> Disque amovible
    G:\ -> Disque amovible
    H:\ -> Disque CD-ROM
    I:\ -> Disque amovible

    ############################## | Processus actifs |

    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    ################## | Fichiers # Dossiers infectieux |

    ################## | Registre # Clés Run infectieuses |

    ################## | Registre # Mountpoints2 |

    HKCU\..\..\Explorer\MountPoints2\{05c386d5-acc4-11dd-a150-001bb9b1cb0b}
    shell\Auto\command =cmd /C launch.bat
    shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

    HKCU\..\..\Explorer\MountPoints2\{0f946360-a4f2-11dd-9a72-001bb9b1cb0b}
    shell\AutoRun\command =explorer.exe .

    HKCU\..\..\Explorer\MountPoints2\{1e61d7c2-9076-11dd-ae86-001bb9b1cb0b}
    shell\Auto\command =cmd /C launch.bat
    shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

    HKCU\..\..\Explorer\MountPoints2\{5bee8a22-ad97-11de-aa61-001bb9b1cb0b}
    shell\Auto\command =cmd /C launch.bat
    shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

    ################## | ! Fin du rapport # UsbFix V6.038 ! |
    0
  18. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Ok, donc la suppression n'a pas été effectuée, réessaye l'option 2
    0
  19. SP_Addict Messages postés 46 Statut Membre
     
    impossible car au redemarrage en mode normal, je ne peux effectuer aucune action(pc qui rame trop, application qui ne se lance pas)( ca fait 30min que j'essaye..)
    0
  20. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Ok, on réessayera après.

    Refais un log RSIT
    0
  21. SP_Addict Messages postés 46 Statut Membre
     
    voila le rapport

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by YOEUNG at 2009-10-07 22:40:44
    Microsoft® Windows Vista™ Édition Familiale Premium
    System drive C: has 78 GB (34%) free of 230 GB
    Total RAM: 1791 MB (73% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:40:52, on 07/10/2009
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16890)
    Boot mode: Safe mode with network support

    Running processes:
    C:\Windows\Explorer.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Users\YOEUNG\Downloads\THEGRATUIT\RSIT.exe
    C:\Users\YOEUNG\Downloads\THEGRATUIT\YOEUNG.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O1 - Hosts: ::1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: HopSurf toolbar - {E9FAB13D-4600-49E1-90D1-EE961C859D39} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
    O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
    O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
    O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
    O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O9 - Extra button: HopSurf - {ED98F8D1-09AC-4107-B2FF-91DBE011B0C5} - C:\Program Files\Comodo\HopSurfToolbar\HopSurfToolbar_IE.dll
    O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
    O13 - Gopher Prefix:
    O20 - AppInit_DLLs: C:\Windows\system32\guard32.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
    O23 - Service: Service Google Update (gupdate1ca29a125310338) (gupdate1ca29a125310338) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
    O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    0
  • 1
  • 2