Virus autorun.inf

clala Messages postés 13 Statut Membre -  
 Utilisateur anonyme -
Bonsoir,

Je sais bien que je vais vous embêter avec ce virus, j'ai lu plein de sujet dessus, et déjà fait plein de chose mais rien ne marche...

Ma clef usb est infectée par le virun autoun.inf.
Avg, et avast n'y font rien, C cleaner non plus.
J'ai essayé avec RAV, Flash disenfector et rien n'y fait. Le fichier est toujours occupé par une autre ressource.
J'ai donc téléchargé unlock, et la ressource utilisée par autorun.inf est explorer.exe. J'ai donc désactivé celui ci, je peux alors supprimé mon fichier autorun.inf et même formater ma clef usb.
Seulement dès que je la rebranche sur mon pc je fichier reviens.

Ce virus se manifeste par une fenêtre d'interruption d'iexplore.exe, et par des publicités intempestives que je n'avais pas avant.

Pourriez vous m'aider, une petite idée s'il vous plait ?
Déjà me répondre serait une aide à mes yeux.
Bonne soirée.
Configuration: Windows XP
Firefox 3.5.3

12 réponses

  1. Utilisateur anonyme
     
    Oui vaux mieux le faire pour que Nathandre y voit un peu plus clairement ;-) tu as surement d'autre infections à traité =)"
    1
  2. qsdq
     
    Salut,

    Clique droit sur ce lien pour installer ComboFix (par sUBs) :

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    Choisis "Enregistrer sous" (dans IE c'est "Enregistrer la cible/le lien sous..")
    et sauvegarde-le (Enregistrer dans) sur le Bureau.

    Important : dans "Nom du fichier" enregistre (renomme) "combofix" en combo-fix.exe

    Prends connaissance de ce tutoriel : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

    Ferme toutes les fenêtres et applications.
    Déconnecte-toi du net et désactive tes protections résidentes :
    https://forum.pcastuces.com/default.asp

    Sur le bureau, double clique combo-fix.exe.
    Tape sur la touche Y (Yes) pour démarrer le scan.
    ComboFix redémarrera ton PC.
    Lorsque le scan sera complété, un rapport apparaîtra.
    Copie/colle ce rapport dans ta prochaine réponse.

    PS : Le rapport se trouve également ici : C:\Combofix.txt

    Ne clique pas dans la fenêtre de Combofix durant l’analyse : cela pourrait provoquer le gel du programme !
    0
  3. clala Messages postés 13 Statut Membre
     
    Merci de m'avoir répondu.
    Le rapport a été assez long.
    Suite à ce rapport j'ai l'impression d'être sous une apparence 98 et non Xp. Le virus est toujours là, car j'ai toujours la fenêtre qui s'affiche.
    Le voici:

    ComboFix 09-10-08.04 - Marlène Cxxxx 10/10/2009 21:12.1.2 - NTFSx86
    Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1279.602 [GMT 2:00]
    Lancé depuis: c:\documents and settings\Marlène Cxxxx\Bureau\combo-fix.exe
    AV: avast! antivirus 4.8.1335 [VPS 091009-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .
    [i] ADS - WINDOWS: deleted 72 bytes in 1 streams. /i
    [i] ADS - svchost.exe: deleted 31744 bytes in 1 streams. /i

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\NetworkService\ntuser.dll
    c:\recycler\S-1-5-21-0208374356-2181206355-079396765-9477
    c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1811
    c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1858
    c:\recycler\S-1-5-21-0245289987-9686493290-335870376-2847
    c:\recycler\S-1-5-21-0628706161-6088795659-537978588-1656
    c:\recycler\S-1-5-21-0892343856-2271740846-761648556-1606
    c:\recycler\S-1-5-21-0951332512-5343315443-174227498-0259
    c:\recycler\S-1-5-21-1484080291-8858831330-464184352-3359
    c:\recycler\S-1-5-21-2132614119-5863744320-667308370-5921
    c:\recycler\S-1-5-21-2467913445-7132686288-352137432-7831
    c:\recycler\S-1-5-21-2478505781-7020578900-670750353-3689
    c:\recycler\S-1-5-21-2478505781-7020578900-670750353-3689\Desktop.ini
    c:\recycler\S-1-5-21-2478505781-7020578900-670750353-3689\wnzip32.exe
    c:\recycler\S-1-5-21-2743983155-6285318407-928190796-9847
    c:\recycler\S-1-5-21-2907026870-7554786089-492674946-5545
    c:\recycler\S-1-5-21-3539946292-8063953586-335323656-7394
    c:\recycler\S-1-5-21-4386793937-4524700639-680774601-9478
    c:\recycler\S-1-5-21-4407150767-1561733905-179563447-7031
    c:\recycler\S-1-5-21-4469495292-4260688815-324929095-0094
    c:\recycler\S-1-5-21-4614510201-8890611533-499363049-7280
    c:\recycler\S-1-5-21-5060942413-4791985025-628070533-5700
    c:\recycler\S-1-5-21-5287088361-7090177700-141952692-2267
    c:\recycler\S-1-5-21-5540211268-4794550213-572687221-3699
    c:\recycler\S-1-5-21-5614638252-5671007538-913735555-1698
    c:\recycler\S-1-5-21-5661752594-2892416011-397527773-4087
    c:\recycler\S-1-5-21-6033903343-5277688092-381710061-3237
    c:\recycler\S-1-5-21-6438904790-2652938547-528198323-5059
    c:\recycler\S-1-5-21-6450961797-3279482723-089984359-4184
    c:\recycler\S-1-5-21-6594004721-4184889828-302637648-0060
    c:\recycler\S-1-5-21-6668144127-4209684199-445945401-9863
    c:\recycler\S-1-5-21-6669884855-5026225659-871457908-6117
    c:\recycler\S-1-5-21-7326129695-0507378237-029498061-1807
    c:\recycler\S-1-5-21-7636304563-0031248976-699515553-6252
    c:\recycler\S-1-5-21-7726428107-4799412952-488568901-2764
    c:\recycler\S-1-5-21-8039072132-7996001462-199017986-1688
    c:\recycler\S-1-5-21-8526701702-9534707388-204099756-8653
    c:\recycler\S-1-5-21-8584318107-6593789130-459891586-9245
    c:\recycler\S-1-5-21-8705049247-0814168968-885919000-2963
    c:\recycler\S-1-5-21-8735367446-0220211375-025514443-2870
    c:\windows\Fonts\Txtrider.fon
    c:\windows\kb913800.exe
    c:\windows\system32\_004841_.tmp.dll
    c:\windows\system32\_004842_.tmp.dll
    c:\windows\system32\_004843_.tmp.dll
    c:\windows\system32\_004844_.tmp.dll
    c:\windows\system32\_004851_.tmp.dll
    c:\windows\system32\_004852_.tmp.dll
    c:\windows\system32\_004853_.tmp.dll
    c:\windows\system32\_004854_.tmp.dll
    c:\windows\system32\_004856_.tmp.dll
    c:\windows\system32\_004857_.tmp.dll
    c:\windows\system32\_004860_.tmp.dll
    c:\windows\system32\_004861_.tmp.dll
    c:\windows\system32\_004864_.tmp.dll
    c:\windows\system32\_004865_.tmp.dll
    c:\windows\system32\_004867_.tmp.dll
    c:\windows\system32\_004869_.tmp.dll
    c:\windows\system32\_004870_.tmp.dll
    c:\windows\system32\_004871_.tmp.dll
    c:\windows\system32\_004876_.tmp.dll
    c:\windows\system32\_004878_.tmp.dll
    c:\windows\system32\_004881_.tmp.dll
    c:\windows\system32\_004883_.tmp.dll
    c:\windows\system32\_004884_.tmp.dll
    c:\windows\system32\_004885_.tmp.dll
    c:\windows\system32\_004886_.tmp.dll
    c:\windows\system32\_004887_.tmp.dll
    c:\windows\system32\_004890_.tmp.dll
    c:\windows\system32\_004891_.tmp.dll
    c:\windows\system32\_004892_.tmp.dll
    c:\windows\system32\_004893_.tmp.dll
    c:\windows\system32\_004894_.tmp.dll
    c:\windows\system32\_004899_.tmp.dll
    c:\windows\system32\_004901_.tmp.dll
    c:\windows\system32\calc.dll
    c:\windows\system32\drivers\downld
    c:\windows\system32\drivers\downld\308984.exe
    c:\windows\system32\drivers\downld\319687.exe
    c:\windows\system32\drivers\downld\320718.exe
    c:\windows\system32\drivers\downld\4487625.exe
    c:\windows\system32\drivers\downld\4488765.exe
    c:\windows\system32\drivers\downld\4520906.exe
    c:\windows\system32\drivers\downld\4523593.exe
    c:\windows\system32\drivers\downld\4526312.exe
    c:\windows\system32\drivers\downld\4575203.exe
    c:\windows\system32\drivers\downld\833187.exe
    c:\windows\system32\drivers\hldrrr .exe
    c:\windows\system32\drivers\str.sys
    c:\windows\system32\lowsec
    c:\windows\system32\lowsec\local.ds
    c:\windows\system32\lowsec\user.ds
    c:\windows\system32\lowsec\user.ds.lll
    c:\windows\system32\lsprcxs .exe
    c:\windows\system32\lvcomsx .exe
    c:\windows\system32\mssrv32.exe
    c:\windows\system32\ncmdds .exe
    c:\windows\system32\qazbrnn .exe
    c:\windows\system32\sdra64.exe
    c:\windows\system32\sysmonitor .exe

    .
    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_ICF
    -------\Service_ICF

    ((((((((((((((((((((((((((((( Fichiers créés du 2009-09-10 au 2009-10-10 ))))))))))))))))))))))))))))))))))))
    .

    2009-10-10 18:26 . 2009-10-10 18:27 -------- d-----w- c:\program files\Unlocker
    2009-10-10 16:55 . 2009-10-10 16:57 -------- d-----w- c:\windows\LastGood.Tmp
    2009-10-10 16:52 . 2009-10-10 16:52 -------- d-----w- c:\windows\system32\fr
    2009-10-10 16:52 . 2009-10-10 16:52 -------- d-----w- c:\windows\system32\bits
    2009-10-10 16:52 . 2009-10-10 16:52 -------- d-----w- c:\windows\l2schemas
    2009-10-10 16:50 . 2009-10-10 16:52 -------- d-----w- c:\windows\ServicePackFiles
    2009-10-10 16:40 . 2009-10-10 16:39 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-10-08 16:43 . 2009-10-08 16:43 56832 ----a-w- c:\windows\system32\jrnfd32.dll
    2009-10-08 15:35 . 2009-10-10 16:32 30720 --sh--r- c:\windows\system32\lsprcxs.exe
    2009-10-08 15:35 . 2009-10-10 16:32 30720 --sh--r- c:\windows\system32\ncmdds.exe
    2009-10-08 15:35 . 2009-10-10 16:26 30720 --sh--r- c:\windows\system32\qazbrnn.exe
    2009-10-08 14:40 . 2009-10-08 14:40 9440 ----a-w- c:\windows\system32\drivers\nmwcdq.sys
    2009-10-08 13:52 . 2009-10-08 16:43 82944 --sh--w- C:\klnjswpx.exe
    2009-09-24 20:59 . 2009-09-24 20:59 -------- d-----w- c:\program files\ma-config.com
    2009-09-24 20:59 . 2009-09-24 20:59 -------- d-----w- c:\documents and settings\All Users\Application Data\ma-config.com

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-10 18:06 . 2007-03-06 09:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-10-10 16:39 . 2007-03-03 10:03 -------- d-----w- c:\program files\Java
    2009-10-10 16:37 . 2006-09-08 11:17 85018 ----a-w- c:\windows\system32\perfc00C.dat
    2009-10-10 16:37 . 2006-09-08 11:17 492138 ----a-w- c:\windows\system32\perfh00C.dat
    2009-10-10 16:32 . 2004-05-21 18:11 30720 ----a-w- c:\windows\system32\lvcomsx.exe
    2009-10-10 16:32 . 2007-03-03 10:04 30720 ----a-w- c:\windows\system32\sysmonitor.exe
    2009-10-09 16:10 . 2008-05-05 18:42 -------- d-----w- c:\program files\CEDP Stealer 6.0 for Messenger
    2009-09-27 19:48 . 2009-03-20 16:57 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-09-25 15:16 . 2007-06-18 21:27 -------- d-----w- c:\program files\Windows Live
    2009-09-14 10:27 . 2007-03-06 08:43 -------- d-----w- c:\program files\eMule
    2009-09-08 16:15 . 2007-04-17 17:28 -------- d-----w- c:\program files\Nvu
    2009-09-08 16:13 . 2006-09-08 11:31 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
    .

    ------- Sigcheck -------

    [7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    [7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
    [7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\SoftwareDistribution\Download\7b6e084e897a416dad6204fec54d1e00\sp3gdr\tcpip.sys
    [-] 2008-06-20 . 0B788EE2A876D7B31DF840C13F08CD2B . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
    [7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
    [7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
    [7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\tcpip.sys
    [-] 2008-04-13 . 99BD46C2C790E52363DD1021DDCA3E8F . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys
    [-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
    [-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
    [-] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "wesspell"="c:\windows\system32\qazbrnn.exe" [2009-10-10 30720]
    "zmmclr"="c:\windows\system32\ncmdds.exe" [2009-10-10 30720]
    "mqlwindl"="c:\windows\system32\lsprcxs.exe" [2009-10-10 30720]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp"="Alaunch" [X]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2009-10-10 30720]
    "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032]
    "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]
    "Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2009-10-10 30720]
    "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2009-10-10 30720]
    "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
    "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2009-10-10 30720]
    "LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2009-10-10 30720]
    "LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2009-10-10 30720]
    "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-11-17 185896]
    "!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-10 149280]
    "\\marlene\EPSON Stylus DX3800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE" [2005-02-08 98304]
    "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
    "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-06-01 16208384]
    "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

    c:\documents and settings\MarlŠne CHERPEAU\Menu D‚marrer\Programmes\D‚marrage\
    RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-19 630784]
    scandisk.dll [2009-10-8 25088]
    scandisk.lnk - c:\windows\system32\rundll32.exe [2004-8-10 33792]

    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2007-3-3 45056]
    Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
    @="Service"

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]
    path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk
    backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk]
    path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk
    backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Marlène CHERPEAU^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.4.lnk]
    path=c:\documents and settings\Marlène CHERPEAU\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.4.lnk
    backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Marlène CHERPEAU^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 3.0.lnk]
    path=c:\documents and settings\Marlène CHERPEAU\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.0.lnk
    backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\eMule\\emule.exe"=
    "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI.SP1a\\RpcSandraSrv.exe"=
    "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite XI.SP1a\\Win32\\RpcDataSrv.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "%windir%\\explorer.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "6881:TCP"= 6881:TCP:BitTorrent
    "21758:TCP"= 21758:TCP:BitComet 21758 TCP
    "21758:UDP"= 21758:UDP:BitComet 21758 UDP
    "65534:TCP"= 65534:TCP:BitComet 65534 TCP
    "65534:UDP"= 65534:UDP:BitComet 65534 UDP

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [03/04/2008 18:58 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [03/04/2008 18:58 20560]
    R2 e4mnt4;e4mnt4;c:\windows\system32\drivers\e4mnt4.sys [07/05/2008 17:18 75360]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [24/01/2008 13:12 24652]
    R3 PID_0920;Logitech QuickCam Express(PID_0920);c:\windows\system32\drivers\LV532AV.SYS [06/03/2007 21:49 163328]
    S2 e4mservice;E4M service;e4mserv.exe --> e4mserv.exe [?]
    S2 qrdgjouxevmdq;qrdgjouxevmdq;\??\c:\windows\system32\drivers\kdehlyggwpefu.sys --> c:\windows\system32\drivers\kdehlyggwpefu.sys [?]
    S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 14:50 238960]
    S3 pohci13F;pohci13F;\??\c:\docume~1\MARLNE~1\LOCALS~1\Temp\pohci13F.sys --> c:\docume~1\MARLNE~1\LOCALS~1\Temp\pohci13F.sys [?]
    S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\w300mgmt.sys [28/03/2007 21:11 87824]
    S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;c:\windows\system32\drivers\w300obex.sys [28/03/2007 21:11 85696]

    --- Autres Services/Pilotes en mémoire ---

    *NewlyCreated* - EHRECVR
    *NewlyCreated* - EHSCHED
    .
    Contenu du dossier 'Tâches planifiées'

    2009-09-14 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
    c:\windows\Tasks\At6.job
    .
    .
    ------- Examen supplémentaire -------
    .
    uStart Page = hxxp://www.google.fr/
    mStart Page = hxxp://fr.fr.acer.yahoo.com
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = localhost
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
    IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
    IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
    IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Marlène CHERPEAU\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
    TCP: {D32D6B20-C01E-4920-AA7A-8E2B05516D9D} = 192.168.30.1,0.0.0.0
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game12.zylom.com/activex/zylomgamesplayer.cab
    FF - ProfilePath - c:\documents and settings\Marlène CHERPEAU\Application Data\Mozilla\Firefox\Profiles\leo1ccsp.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
    FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
    FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    .
    - - - - ORPHELINS SUPPRIMES - - - -

    SafeBoot-AVG Anti-Spyware Driver
    AddRemove-debug meta obj - c:\docume~1\MARLNE~1\APPLIC~1\MEETMI~1\Batvccake.exe

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-10-10 21:22
    Windows 5.1.2600 Service Pack 3 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    c:\windows\system32\lsprcxs .exe 30720 bytes executable
    c:\windows\system32\lvcomsx .exe 30720 bytes executable
    c:\windows\system32\ncmdds .exe 30720 bytes executable
    c:\windows\system32\sysmonitor .exe 30720 bytes executable
    c:\windows\system32\qazbrnn .exe 30720 bytes executable

    Scan terminé avec succès
    Fichiers cachés: 5

    **************************************************************************
    .
    --------------------- DLLs chargées dans les processus actifs ---------------------

    - - - - - - - > 'winlogon.exe'(892)
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(1840)
    c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
    c:\windows\system32\MSNCHATHOOK.DLL
    c:\windows\system32\sysenv.dll
    c:\windows\system32\CryptoAPI.dll
    c:\windows\system32\MFC71U.DLL
    c:\program files\Unlocker\UnlockerHook.dll
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
    c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
    c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_fre.nlr
    c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\program files\Alwil Software\Avast4\aswUpdSv.exe
    c:\program files\Alwil Software\Avast4\ashServ.exe
    c:\acer\Empowering Technology\ePerformance\MemCheck.exe
    c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
    c:\windows\system32\searchindexer.exe
    c:\windows\ehome\mcrdsvc.exe
    c:\acer\Empowering Technology\eRecovery\eragent .exe
    c:\program files\Logitech\Video\logitray .exe
    c:\program files\Alwil Software\Avast4\ashMaiSv.exe
    c:\program files\Alwil Software\Avast4\ashWebSv.exe
    c:\program files\Logitech\Video\FxSvr2.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\searchprotocolhost.exe
    c:\docume~1\MARLNE~1\LOCALS~1\Temp\ctv333.exe
    c:\program files\Internet Explorer\iexplore.exe
    c:\program files\Windows Live\Toolbar\wltuser.exe
    c:\windows\ehome\ehSched.exe
    c:\windows\ehome\ehrecvr.exe
    c:\windows\system32\dllhost.exe
    c:\windows\system32\searchfilterhost.exe
    .
    **************************************************************************
    .
    Heure de fin: 2009-10-10 21:30 - La machine a redémarré
    ComboFix-quarantined-files.txt 2009-10-10 19:30

    Avant-CF: 11 114 086 400 octets libres
    Après-CF: 11 098 783 744 octets libres

    WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

    Current=2 Default=2 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
    362 --- E O F --- 2009-10-10 16:55

    Que dois-je en conclure? Merci d'avance.
    0
  4. guglo
     
    bizar mon avast (sur vista) le vire sans souci et y compri sur les clé usb et disques dur de mes camarades utilisant xp.....
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. clala Messages postés 13 Statut Membre
     
    Oui je suis d'accord, c'est bizarre, mais il résiste beaucoup avec moi!
    Mais apparement finalement il n'est plus sur ma clef.

    qsdq pourrai tu m'expliquer ce que le rapport signifie globalement? D'autres virus? Celui ci est il bien supprimé?

    Merci :)
    0
    1. Utilisateur anonyme
       
      Bonsoir
      faut pas faire passer ComboFix sans savoir, car c'est un outil très puissant et qui doit etre conseillé par un helpeur expérimenté
      clala, fait moi ceci
      Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

      - http://images.malwareremoval.com/random/RSIT.exe

      ! Déconnecte toi et ferme toutes tes applications en cours !

      Double-clique sur " RSIT.exe " pour le lancer .

      - Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

      * Devant l'option "List files/folders created ..." , tu choisis : 2 months

      * clique ensuite sur " Continue " pour lancer l'analyse ...


      - laisse faire le scan et ne touche pas au PC ...


      Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note).

      Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

      Important : poste un rapport, puis l'autre dans la réponse suivante
      Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum


      ( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )
      0
  7. Utilisateur anonyme
     
    Hello tout le monde !

    Pour suivre ...

    Bonne chance ;-)
    0
  8. Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537
     
    Bonsoir,

    pour suivre aussi.

    Au passage, le tutoriel officiel de Combofix sur Bleeping Computer ne parle pas de "helpeur expérimenté", il parle de "quelqu'un qui a suivi une formation adéquate."

    Moi, je ne sais pas si qsdq a ou non reçu une telle formation.
    0
  9. clala Messages postés 13 Statut Membre
     
    Bonjour.

    Combofix m'a bien supprimé mon fichier, je n'ai pour le moment plus de problème.
    Dois je quand même faire un log de RSIT?

    Merci à tous!
    0
  10. clala Messages postés 13 Statut Membre
     
    Le rapport du Log:

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by Marlène CHERPEAU at 2009-10-11 16:41:42
    Microsoft Windows XP Professionnel Service Pack 3
    System drive C: has 10 GB (13%) free of 73 GB
    Total RAM: 1279 MB (57% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:41:55, on 11/10/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\WINDOWS\system32\e4mserv.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Acer\Empowering Technology\eRecovery\eRAgent .exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
    C:\Program Files\Logitech\Video\LogiTray .exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Windows Live\Toolbar\wltuser.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\DOCUME~1\MARLNE~1\LOCALS~1\Temp\ctv1265.exe
    C:\program files\Common Files\system\logonui.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Marlène CHERPEAU\Mes documents\Téléchargements\RSIT.exe
    C:\Program Files\trend micro\Marlène CHERPEAU.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [\\marlene\EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P36 "\\marlene\EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
    O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
    O4 - HKLM\..\Run: [Interfaz de usuario de inicio d sesión de Windows] C:\program files\Common Files\system\logonui.exe
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [wesspell] C:\WINDOWS\system32\qazbrnn.exe
    O4 - HKCU\..\Run: [zmmclr] C:\WINDOWS\system32\ncmdds.exe
    O4 - HKCU\..\Run: [mqlwindl] C:\WINDOWS\system32\lsprcxs.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    O4 - Startup: scandisk.dll
    O4 - Startup: scandisk.lnk = ?
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Marlène CHERPEAU\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game12.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D32D6B20-C01E-4920-AA7A-8E2B05516D9D}: NameServer = 192.168.30.1,0.0.0.0
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: E4M service (e4mservice) - Unknown owner - C:\WINDOWS\SYSTEM32\e4mserv.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    0
  11. clala Messages postés 13 Statut Membre
     
    le contenu de info:

    info.txt logfile of random's system information tool 1.06 2009-10-11 16:42:00

    ======Uninstall list======

    -->MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F}
    -->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Acer eDataSecurity Management 2.0.3077-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{4AD13F68-CADA-4C6B-9759-C33753F89908} /l1036
    Acer eDataSecurity Management-->C:\Acer\Empowering Technology\eDataSecurity\eDStbmngr.exe UNINSTALL 1
    Acer Empowering Technology-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x40c -removeonly
    Acer ePerformance Management-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7057702F-6D71-4F30-8000-9E72BC771887}\setup.exe" -l0x40c -removeonly
    Acer WLAN 11g USB Dongle-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{0CB98AC0-D691-4B21-AD3D-95982517021D} /l1036
    Ad-Aware SE Personal-->C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
    Adobe Acrobat 5.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.dll"
    Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    AnyDVD-->"C:\Program Files\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Program Files\SlySoft\AnyDVD"
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
    Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
    ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
    AVG Anti-Spyware 7.5-->C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
    BitComet 0.92-->C:\Program Files\BitComet\uninst.exe
    CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
    CloneDVD2-->"C:\Program Files\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneDVD2"
    comsummer-1024x768-->MsiExec.exe /I{D27E6ABB-AF22-4618-838E-B4A3A1B02F98}
    Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
    DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
    DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
    DVD Shrink 3.2-->"C:\Program Files\DVD Shrink\unins000.exe"
    E4M-->C:\WINDOWS\e4msetup.exe /u
    eMule-->"C:\Program Files\eMule\Uninstall.exe"
    EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
    Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
    GemMaster Mystic-->"C:\Program Files\GemMasterFrench\uninstallgemmaster.exe"
    Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
    Hamachi 1.0.2.2-->C:\Program Files\Hamachi\uninstall.exe
    HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
    Ink-->MsiExec.exe /I{9FCB2876-554D-491D-A2CD-58F8252D6C64}
    Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
    Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
    J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
    Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216015FF}
    Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
    Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
    K-Lite Codec Pack 2.54 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
    Language pack for Ad-Aware SE-->C:\PROGRA~1\Lavasoft\AD-AWA~1\Plugins\Langs\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\Plugins\Langs\INSTALL.LOG
    Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
    Les Sims 2-->C:\Program Files\EA GAMES\Les Sims 2\EAUninstall.exe
    Logitech Desktop Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0x40c UNINSTALL
    Logitech Print Service-->C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG
    Logitech QuickCam-->MsiExec.exe /I{0496D9E9-224B-4AFA-8F37-23B98D52F1EB}
    Luxor 3-->C:\PROGRA~1\GAMEHO~1\LUXOR3~1\UNWISE.EXE /U C:\PROGRA~1\GAMEHO~1\LUXOR3~1\INSTALL.LOG
    Ma-Config.com-->MsiExec.exe /X{425FFD94-36BD-4933-881B-FE0B9DADF2B7}
    Messenger Plus! 3-->"C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /Remove
    Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
    Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
    Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
    Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
    Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
    Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
    Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft Office PowerPoint Viewer 2007 (French)-->MsiExec.exe /X{95120000-00AF-040C-0000-0000000FF1CE}
    Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
    Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
    Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
    Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
    Microsoft User-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
    Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
    Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
    Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
    Mise à jour pour Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
    Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
    Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
    Mozilla Firefox (3.5.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    MSN Reaper-->"C:\Program Files\MSN Reaper\uninst.exe"
    MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
    MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
    Nokia Connectivity Cable Driver-->MsiExec.exe /X{11964613-805F-432D-A12B-169554B793E7}
    Nokia PC Suite-->C:\Documents and Settings\All Users\Application Data\Installations\{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}\Nokia_PC_Suite_6_84_10_3_EA.exe
    Nokia PC Suite-->MsiExec.exe /I{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}
    NTI Backup NOW! 4-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{385979FE-DC4F-4140-8EAD-A59625000D72} /l1036 BUN4
    NTI CD & DVD-Maker-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1036 CDM7
    OCA Client history tool install-->"C:\WINDOWS\$UninstallOCA-X86Fre-ENU$\spuninst\spuninst.exe"
    OpenOffice.org 3.1-->MsiExec.exe /I{B2E581DB-C4DD-432C-AC84-ED761AC056BC}
    Otto-->"C:\Program Files\FrenchOtto\uninstallotto.exe"
    Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
    Pack Vista Inspirat 2 1.0-->C:\WINDOWS\BricoPacks\Vista Inspirat 2\Remove.exe
    Package de pilotes Windows - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccswpddri_044C8712DB44F83D9DE6C376991EE9254E0A69E4\pccswpddriver.inf
    Package de pilotes Windows - Nokia Modem (02/15/2007 3.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccs_bluet_8B37DC72918CCD58A6EC20373AF6242B037A293B\pccs_bluetooth.inf
    Package de pilotes Windows - Nokia Modem (02/15/2007 3.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccs_bluet_F12A08B6F776984A95553486F64C541356F86E38\pccs_bluetooth.inf
    Package de pilotes Windows - Nokia Modem (05/24/2007 6.84.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_5E1541AFF1E1EA3554CE566743CCAD323ED1C108\nokbtmdm.inf
    PC Connectivity Solution-->MsiExec.exe /I{99A40651-0BC2-4095-8F9A-A40FAB224FEF}
    PhotoFiltre Studio-->"C:\Program Files\PhotoFiltre\Uninst2.exe"
    PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
    PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.EXE" -uninstall
    Programme de gestion Camera de Logitech®-->"C:\Program Files\Fichiers communs\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
    Quick Zip 3.06.3-->"C:\Program Files\QuickZip\unins000.exe"
    QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
    RamBoost XP 4.0.6-->"C:\Program Files\RamBoost XP\unins000.exe"
    RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
    Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x40c -removeonly
    Ridedit-->C:\WINDOWS\ST5UNST.EXE -n "C:\Program Files\Ridedit\ST5UNST.LOG"
    River Past Video Cleaner-->C:\WINDOWS\Video Cleaner Uninstaller.exe
    RollerCoaster Tycoon® 3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\Setup.exe" -l0x40c
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
    SiSoftware Sandra Lite XI.SP1a (Win64/32/CE)-->"C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a\unins000.exe"
    Sonic Encoders-->MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
    SpotAuditor 3.7.1-->"C:\Program Files\Nsasoft\SpotAuditor\unins000.exe"
    Spybot - Search & Destroy 1.4-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
    Sqirlz Morph-->C:\WINDOWS\Sqirlz Morph Uninstaller.exe
    Super Mahjong-->"C:\Program Files\Super Mahjong\unins000.exe"
    TI Connect(TM) 1.3-->C:\PROGRA~1\TIEDUC~1\TICONN~1\UNWISE.EXE C:\PROGRA~1\TIEDUC~1\TICONN~1\INSTALL.LOG
    TxtEdit-->C:\WINDOWS\unin040c.exe -f"C:\Program Files\MadCoder\TxtEdit\DeIsL1.isu" -c"C:\Program Files\MadCoder\TxtEdit\_ISREG32.DLL"
    Unlocker 1.8.7-->C:\Program Files\Unlocker\uninst.exe
    Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u
    Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
    Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
    Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
    Windows Live FolderShare-->MsiExec.exe /X{2075CB0A-D26F-4DAA-B424-5079296B43BA}
    Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
    Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
    Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
    Windows Live Writer-->MsiExec.exe /X{4634B21A-CC07-4396-890C-2B8168661FEA}
    Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
    Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
    Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
    Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
    Windows XP Media Center Edition 2005 KB973768-->"C:\WINDOWS\$NtUninstallKB973768$\spuninst\spuninst.exe"
    Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
    WinZix version 1.0-->"C:\Program Files\WinZix\unins000.exe"
    Zylom Games Player Plugin-->"C:\Program Files\Zylom Games\UninstallPlugin.exe" --uninstall

    ======Security center information======

    AV: avast! antivirus 4.8.1335 [VPS 091010-0] (disabled)

    ======System event log======

    Computer Name: CLAIRE
    Event Code: 7036
    Message: Le service Ma-Config Service est entré dans l'état : arrêté.

    Record Number: 62919
    Source Name: Service Control Manager
    Time Written: 20090924225935.000000+120
    Event Type: Informations
    User:

    Computer Name: CLAIRE
    Event Code: 7035
    Message: Un contrôle Arrêter a correctement été envoyé au service Ma-Config Service.

    Record Number: 62918
    Source Name: Service Control Manager
    Time Written: 20090924225935.000000+120
    Event Type: Informations
    User: CLAIRE\Marlène CHERPEAU

    Computer Name: CLAIRE
    Event Code: 7035
    Message: Un contrôle Démarrer a correctement été envoyé au service cpuz132.

    Record Number: 62917
    Source Name: Service Control Manager
    Time Written: 20090924225929.000000+120
    Event Type: Informations
    User: AUTORITE NT\SYSTEM

    Computer Name: CLAIRE
    Event Code: 7036
    Message: Le service Ma-Config Service est entré dans l'état : en cours d'exécution.

    Record Number: 62916
    Source Name: Service Control Manager
    Time Written: 20090924225928.000000+120
    Event Type: Informations
    User:

    Computer Name: CLAIRE
    Event Code: 7035
    Message: Un contrôle Démarrer a correctement été envoyé au service Ma-Config Service.

    Record Number: 62915
    Source Name: Service Control Manager
    Time Written: 20090924225928.000000+120
    Event Type: Informations
    User: CLAIRE\Marlène CHERPEAU

    =====Application event log=====

    Computer Name: CLAIRE
    Event Code: 11707
    Message: Produit : Windows Live Communications Platform -- L'installation s'est terminée correctement.

    Record Number: 9129
    Source Name: MsiInstaller
    Time Written: 20090320174908.000000+060
    Event Type: Informations
    User: CLAIRE\Marlène CHERPEAU

    Computer Name: CLAIRE
    Event Code: 11707
    Message: Product: MSVCRT -- Installation completed successfully.

    Record Number: 9128
    Source Name: MsiInstaller
    Time Written: 20090320174902.000000+060
    Event Type: Informations
    User: CLAIRE\Marlène CHERPEAU

    Computer Name: CLAIRE
    Event Code: 11707
    Message: Product: Microsoft Application Error Reporting -- Installation completed successfully.

    Record Number: 9127
    Source Name: MsiInstaller
    Time Written: 20090320174856.000000+060
    Event Type: Informations
    User: CLAIRE\Marlène CHERPEAU

    Computer Name: CLAIRE
    Event Code: 11728
    Message: Produit : Windows Live Messenger -- La configuration s'est terminée correctement.

    Record Number: 9126
    Source Name: MsiInstaller
    Time Written: 20090320174450.000000+060
    Event Type: Informations
    User: CLAIRE\Marlène CHERPEAU

    Computer Name: CLAIRE
    Event Code: 10005
    Message: Produit : Windows Live Mail -- Windows Installer a rencontré une erreur inattendue lors de l'installation de ce package. Il s'agit peut-être d'un problème lié au package. Le code d'erreur est 2762. Les arguments sont : , ,

    Record Number: 9125
    Source Name: MsiInstaller
    Time Written: 20090320174447.000000+060
    Event Type: erreur
    User: CLAIRE\Marlène CHERPEAU

    ======Environment variables======

    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\Program Files\QuickTime\QTSystem;C:\Program Files\Fichiers communs\Roxio Shared\DLLShared;C:\Program Files\Fichiers communs\Roxio Shared\9.0\DLLShared
    "windir"=%SystemRoot%
    "FP_NO_HOST_CHECK"=NO
    "OS"=Windows_NT
    "PROCESSOR_ARCHITECTURE"=x86
    "PROCESSOR_LEVEL"=15
    "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 2, GenuineIntel
    "PROCESSOR_REVISION"=0602
    "NUMBER_OF_PROCESSORS"=2
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "SAN_DIR"=C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI.SP1a
    "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
    "QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

    -----------------EOF-----------------
    0
    1. Utilisateur anonyme
       
      O4 - HKCU\..\Run: [wesspell] C:\WINDOWS\system32\qazbrnn.exe
      O4 - HKCU\..\Run: [zmmclr] C:\WINDOWS\system32\ncmdds.exe
      O4 - HKCU\..\Run: [mqlwindl] C:\WINDOWS\system32\lsprcxs.exe
      bizarres

      Télécharge malwarebytes' anti-malware
      https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
      Enregistre le sur le bureau
      Double-clique sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation
      Si la pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
      Il va se mettre à jour une fois faite
      Va dans l'onglet recherche
      Sélectionne exécuter un examen complet
      Clique sur rechercher
      Le scan démarre
      A la fin de l'analyse, le message s'affiche: L'examen s'est terminé normalement.
      Clique sur afficher les résultats pour afficher les objets trouvés
      Clique sur OK pour pousuivre
      Si des malwares ont été détectés, cliquer sur afficher les résultats
      Sélectionne tout (ou laisser coché)
      Clique sur supprimer la sélection
      Malwarebytes va détruire les fichiers et les clés de registre et en mettre une
      copie dans la quarantaine
      Malewarebytes va ouvrir le bloc-note et y copier le rapport
      Redémarre le PC
      Une fois redémarré, double-clique sur Malewarebytes
      Va dans l'onglet rapport/log
      Clique dessus pour l'afficher une fois affiché, cliquer sur édition en haut du
      bloc-note puis sur sélectionner tout
      Revient sur édition, puis sur copier et revient sur le forum et dans ta réponse
      Clic droit dans le cadre de la réponse et coller
      0
  12. Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537
     
    Re,

    O4 - HKCU\..\Run: [wesspell] C:\WINDOWS\system32\qazbrnn.exe
    O4 - HKCU\..\Run: [zmmclr] C:\WINDOWS\system32\ncmdds.exe
    O4 - HKCU\..\Run: [mqlwindl] C:\WINDOWS\system32\lsprcxs.exe

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
    "wesspell"="c:\windows\system32\qazbrnn.exe" [2009-10-10 30720]
    "zmmclr"="c:\windows\system32\ncmdds.exe" [2009-10-10 30720]
    "mqlwindl"="c:\windows\system32\lsprcxs.exe" [2009-10-10 30720]

    ==

    bizarres

    https://www.google.fr/search?q=qazbrnn.exe&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:fr:official&client=firefox-a&gws_rd=ssl

    https://www.google.fr/search?q=ncmdds.exe&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:fr:official&client=firefox-a&gws_rd=ssl

    https://www.google.fr/search?q=lsprcxs.exe&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:fr:official&client=firefox-a&gws_rd=ssl
    0
  13. clala Messages postés 13 Statut Membre
     
    Voici le rapport, désolée d'avoir été aussi longue mais le rapport l'a été!

    Malwarebytes' Anti-Malware 1.41
    Version de la base de données: 2941
    Windows 5.1.2600 Service Pack 3

    11/10/2009 18:58:19
    mbam-log-2009-10-11 (18-58-19).txt

    Type de recherche: Examen complet (C:\|D:\|M:\|)
    Eléments examinés: 278712
    Temps écoulé: 1 hour(s), 53 minute(s), 57 second(s)

    Processus mémoire infecté(s): 1
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 8
    Valeur(s) du Registre infectée(s): 11
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 2
    Fichier(s) infecté(s): 90

    Processus mémoire infecté(s):
    C:\Acer\Empowering Technology\eRecovery\eragent.exe (Trojan.Agent) -> Unloaded process successfully.

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CLASSES_ROOT\TypeLib\{909e1560-d810-11d0-8b18-00aa00cf90f9} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{41ca7d4d-ae77-4b13-9459-e9ab7efecaad} (Trojan.Swizzor) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{10954590-2b3a-41ec-97bb-c95a5e646da9} (Trojan.Swizzor) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\WinZixManager (Trojan.Swizzor) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers\WinZixManager (Trojan.Swizzor) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-zix (Trojan.Swizzor) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\winzix (Trojan.Swizzor) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erecoveryservice (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wesspell (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmmclr (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mqlwindl (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntimui.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntimui (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acer empowering technology monitor (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\edatasecurity loader (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvcomsx (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\logitechvideorepair (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\logitechvideotray (Trojan.Agent) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    C:\Program Files\WinZix (Trojan.Swizzor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinZix (Trojan.Swizzor) -> Quarantined and deleted successfully.

    Fichier(s) infecté(s):
    C:\Acer\Empowering Technology\eRecovery\eragent.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\qazbrnn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ncmdds.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lsprcxs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntimui.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\SysMonitor.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lvcomsx.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Logitech\Video\isstart.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Logitech\Video\logitray.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Acer\Empowering Technology\eDataSecurity\edsloader .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Acer\Empowering Technology\eRecovery\alcmtr .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Acer\Empowering Technology\eRecovery\alcmtr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Acer\Empowering Technology\eRecovery\rthdcpl .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Acer\Empowering Technology\eRecovery\rthdcpl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Acer\Empowering Technology\eRecovery\skytel .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Acer\Empowering Technology\eRecovery\skytel.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\alcmtr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\ntuser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\reader_s .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\reader_s.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\rthdcpl .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\rthdcpl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\skytel .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\skytel.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Application Data\Desktopicon\eBayShortcuts.exe (Adware.ADON) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Menu Démarrer\Programmes\Démarrage\scandisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Downloads\Slysoft CloneDVD2 2.9.1.2 + keygen\KeyGen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Program Files\Adobe\acrotray .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Adobe\acrotray.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\Documents and Settings\NetworkService\ntuser.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\RECYCLER\S-1-5-21-2478505781-7020578900-670750353-3689\wnzip32.exe.vir (Worm.Autorun.B) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\hldrrr .exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000030.exe (Worm.Pushbot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000031.exe (Worm.Pushbot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000033.exe (Trojan.Proxy) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000034.exe (Trojan.Proxy) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000039.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000077.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000079.exe (Trojan.Buzus) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000126.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000516.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000521.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000524.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP1\A0000528.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001570.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001572.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001575.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001577.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001579.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001581.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001583.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001586.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001588.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001589.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001590.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001617.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{54887473-E0E8-4E40-8CB4-34743021C726}\RP4\A0001618.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lsprcxs .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lsprcxs.exe68 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lsprcxs.exe69 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lsprcxs.exe71 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lsprcxs.exe75 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\lvcomsx .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ncmdds .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ncmdds.exe65 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ncmdds.exe67 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ncmdds.exe69 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ncmdds.exe74 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\sysmonitor .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\sfsp.cfo (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\qazbrnn .exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\qazbrnn.exe64 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\qazbrnn.exe68 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\qazbrnn.exe72 (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\WinZix\Flexi.skf (Trojan.Swizzor) -> Quarantined and deleted successfully.
    C:\Program Files\WinZix\SkinCrafterDll.dll (Trojan.Swizzor) -> Quarantined and deleted successfully.
    C:\Program Files\WinZix\unins000.dat (Trojan.Swizzor) -> Quarantined and deleted successfully.
    C:\Program Files\WinZix\unins000.exe (Trojan.Swizzor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinZix\Uninstall WinZix.lnk (Trojan.Swizzor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv1254.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv1265.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv2186.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv3106.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv4282.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv5203.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv6124.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv7045.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv7980.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Marlène CHERPEAU\Local Settings\Temp\ctv8931.exe (Trojan.Dropper) -> Delete on reboot.

    Et maintenant j'en conclu quoi ? Merci de m'aider autant!
    0
    1. Utilisateur anonyme
       
      Va dans l'onglet quarantaine de Malwarebytes, et clique sur tout supprimer

      Ensuite, tu me refait un RSIT
      0

Discussions similaires

Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
Virus dans filezilla
balnelius10 -
fabul -

9 réponses
impossible de terminer l’opération car virus Win 7
Slipt -
Malekal_morte- -

2 réponses