infecté par un spyware

Question

Bonjour,
Depuis quelques temps mon ordinateur est lent, il prends de longues minutes a ouvrir internet ou bien certain fichiers. J'ai maintenant depuis 2jours une barre blanche dans explorer qui s'agrandit à chaque fois que j'ouvre une nouvelle fenetre sur internet ....firefox n'est plus utlisable(j'ai un script pour un jeu qui est sur firefox et comme c'Est lourd je ne réussi plus à surfer sur le net avec firefox...le script a été aprouvé par un ami en informatique donc ce n'est pas le réel problème.) 

Je crois bien etre infecté par un spyware il y a qqun qui peut m'aider ?

*- $h@doW_P$yKoz -* · Answer

Salut,

ouvre le moins d'applications possible pour le moment.

Ensuite,

&#9654; Télécharge random's system information tool (RSIT)  afin de diagnostiquer les problèmes de ton PC:
http://images.malwareremoval.com/random/RSIT.exe

&#9654;Enregistre le sur ton Bureau
&#9654; Double clique sur RSIT.exe pour l’exécuter. 
&#9654; Clique sur "continue" à l'écran Disclaimer. 
&#9654; Si l'outil HIjackThis  n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu n’auras qu’à  accepter la licence. 
&#9654; Une fois le scan terminé , 2 rapports vont apparaitre. 
&#9654; Poste les dans ton prochain message 

&#9654; Note : les rapports se trouvent aussi ici : ( log.txt & info.txt )

&#9654;Tuto : https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm

moimoi · Answer

Je n'ai qu'un rapport ?  

Logfile of random's system information tool 1.06 (written by random/random)
Run by David Despres at 2009-10-14 10:21:44
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 43 GB (34%) free of 127 GB
Total RAM: 511 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:50, on 2009-10-14
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WD\WD Anywhere Backup\MemeoBackup.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\David Despres\Local Settings\Temporary Internet Files\Content.IE5\3IZDAL6V\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\David Despres.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - *{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ActivateWindows] regedit.exe /s c:\windows\activate.regs
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
O4 - HKLM\..\Run: [WD Anywhere Backup] C:\Program Files\WD\WD Anywhere Backup\MemeoLauncher2.exe --silent
O4 - HKLM\..\Run: [Memeo AutoSync] C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe --silent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\WINDOWS\system32\rundll32.exe" "C:\Program Files\NOS\bin\getPlus_Helper.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZJman000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/SignIn?ReturnUrl=%2fFileNotFound.htm%3faspxerrorpath%3d%2fupload%2factivex%2fv2_0_0_11%2ferror.aspx&aspxerrorpath=/upload/activex/v2_0_0_11/error.aspx
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MemeoBackgroundService - Memeo - C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe
O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

moimoi · Answer

voilà j'ai trouvé l'autre 
info.txt logfile of random's system information tool 1.05 2009-02-07 21:31:41

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1A99CB37-AEB0-492F-A85A-8A2536D22393}\setup.exe" -l0x40c 
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->C:\Program Files\Common Files\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe
Adobe Color Common Settings-->MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}
Adobe Color EU Extra Settings-->MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Recommended Settings-->MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2-->C:\Program Files\Common Files\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->C:\Program Files\Common Files\Adobe\Installers\719d6f144d0c086a0dfa7ff76bb9ac1\Setup.exe
Adobe Photoshop CS3-->MsiExec.exe /I{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Setup-->MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}
Adobe Setup-->MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}
Adobe Setup-->MsiExec.exe /I{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Apple Mobile Device Support-->MsiExec.exe /I{AA9768AA-FF0B-4C66-A085-31E934F77841}
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
AVG Free 8.0-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Creative Media Lite-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1A99CB37-AEB0-492F-A85A-8A2536D22393}\setup.exe" -l0x40c  /remove
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Guide de l'utilisateur Creative ZEN Stone-->"C:\Program Files\Creative\Creative ZEN Stone\UGRemove.exe" /Product_Name:ZENStoneUG
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
iTunes-->MsiExec.exe /I{41B9E2CF-0B3F-442A-B5B3-592A4A355634}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
LimeWire 4.16.6-->"C:\Program Files\LimeWire\uninstall.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRO /dll OSETUP.DLL
Microsoft Office Professional 2007-->MsiExec.exe /X{90120000-0014-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft RAW Image Thumbnailer and Viewer for Windows XP Version 1.0 (Build 50)-->MsiExec.exe /X{2E5A5B57-57FC-4C79-A239-9DB280ADEC2A}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
PhotoInPress BookDesigner-->C:\Program Files\PhotoInPress\Uninstall.exe
PokerStars-->"C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
QuickTime-->MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
Security Update for Visio 2007 (KB947590)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
SpyHunter-->"C:\Program Files\Enigma Software Group\SpyHunter\Uninstall.exe" "C:\Program Files\Enigma Software Group\SpyHunter\install.log" -u
TKexe-->C:\WINDOWS\Uninstall_tkexe -kalender
Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb959141)-->msiexec /package {90120000-0014-0000-0000-0000000FF1CE} /uninstall {CC6191C2-B0CE-473C-AD77-61EA3497D796}
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
VeohTV BETA-->C:\Program Files\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinZip 11.1-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}

======Security center information======

AV: AVG Anti-Virus Free

System event log

Computer Name: DAVID
Event Code: 1002
Message: The IP address lease 192.168.100.2 for the Network Card with network address 000C6EBA3313 has been
denied by the DHCP server 192.168.100.1 (The DHCP Server sent a DHCPNACK message).

Record Number: 2099
Source Name: Dhcp
Time Written: 20080603064317.000000-240
Event Type: error
User: 

Computer Name: DAVID
Event Code: 4201
Message: The system detected that network adapter \DEVICE\TCPIP_{048F148F-9768-47CE-AAF6-539C028519CD} was connected to the network,
and has initiated normal operation over the network adapter.

Record Number: 2098
Source Name: Tcpip
Time Written: 20080603064317.000000-240
Event Type: information
User: 

Computer Name: DAVID
Event Code: 1003
Message: Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 000C6EBA3313.  The following
error occurred: 
The operation was canceled by the user.
.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Record Number: 2097
Source Name: Dhcp
Time Written: 20080603064312.000000-240
Event Type: warning
User: 

Computer Name: DAVID
Event Code: 4202
Message: The system detected that network adapter \DEVICE\TCPIP_{048F148F-9768-47CE-AAF6-539C028519CD} was disconnected from the network,
and the adapter's network configuration has been released. If the network
adapter was not disconnected, this may indicate that it has malfunctioned.
Please contact your vendor for updated drivers.

Record Number: 2096
Source Name: Tcpip
Time Written: 20080603064312.000000-240
Event Type: information
User: 

Computer Name: DAVID
Event Code: 4201
Message: The system detected that network adapter \DEVICE\TCPIP_{048F148F-9768-47CE-AAF6-539C028519CD} was connected to the network,
and has initiated normal operation over the network adapter.

Record Number: 2095
Source Name: Tcpip
Time Written: 20080603061727.000000-240
Event Type: information
User: 

Application event log

Computer Name: DAVID
Event Code: 701
Message: msnmsgr (3900) Online defragmentation has completed a full pass on database '\.\C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\SharingMetadata\Working\database_2EF4_337E_F433_46FD\dfsr.db'.

Record Number: 9728
Source Name: ESENT
Time Written: 20090103020035.000000-300
Event Type: information
User: 

Computer Name: DAVID
Event Code: 700
Message: msnmsgr (3900) Online defragmentation is beginning a full pass on database '\.\C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\SharingMetadata\Working\database_2EF4_337E_F433_46FD\dfsr.db'.

Record Number: 9727
Source Name: ESENT
Time Written: 20090103020034.000000-300
Event Type: information
User: 

Computer Name: DAVID
Event Code: 701
Message: msnmsgr (3900) Online defragmentation has completed a full pass on database '\.\C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\SharingMetadata\Working\database_2EF4_337E_F433_46FD\dfsr.db'.

Record Number: 9726
Source Name: ESENT
Time Written: 20090103010040.000000-300
Event Type: information
User: 

Computer Name: DAVID
Event Code: 700
Message: msnmsgr (3900) Online defragmentation is beginning a full pass on database '\.\C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\SharingMetadata\Working\database_2EF4_337E_F433_46FD\dfsr.db'.

Record Number: 9725
Source Name: ESENT
Time Written: 20090103010034.000000-300
Event Type: information
User: 

Computer Name: DAVID
Event Code: 701
Message: msnmsgr (3900) Online defragmentation has completed a full pass on database '\.\C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\SharingMetadata\Working\database_2EF4_337E_F433_46FD\dfsr.db'.

Record Number: 9724
Source Name: ESENT
Time Written: 20090103000033.000000-300
Event Type: information
User: 

Security event log

Computer Name: DAVID
Event Code: 806
Message: Per User Audit Policy was refreshed.

	Number of elements:	0

	Policy ID:	(0x0,0x111DB)


Record Number: 6439
Source Name: Security
Time Written: 20081005195658.000000-240
Event Type: audit success
User: NT AUTHORITY\SYSTEM

Computer Name: DAVID
Event Code: 576
Message: Special privileges assigned to new logon:

	User Name:	

	Domain:		

	Logon ID:		(0x0,0xDC4A)

	Privileges:		SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege

Record Number: 6438
Source Name: Security
Time Written: 20081005195655.000000-240
Event Type: audit success
User: DAVID\David Despres

Computer Name: DAVID
Event Code: 528
Message: Successful Logon:

	User Name:	David Despres

	Domain:		DAVID

	Logon ID:		(0x0,0xDC4A)

	Logon Type:	2

	Logon Process:	User32  

	Authentication Package:	Negotiate

	Workstation Name:	DAVID

	Logon GUID:	-

Record Number: 6437
Source Name: Security
Time Written: 20081005195655.000000-240
Event Type: audit success
User: DAVID\David Despres

Computer Name: DAVID
Event Code: 680
Message: Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

Logon account:  David Despres

Source Workstation: DAVID

Error Code: 0x0


Record Number: 6436
Source Name: Security
Time Written: 20081005195655.000000-240
Event Type: audit success
User: NT AUTHORITY\SYSTEM

Computer Name: DAVID
Event Code: 538
Message: User Logoff:

	User Name:	David Despres

	Domain:		DAVID

	Logon ID:		(0x0,0xDC08)

	Logon Type:	2


Record Number: 6435
Source Name: Security
Time Written: 20081005195655.000000-240
Event Type: audit success
User: DAVID\David Despres

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_04\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_04\lib\ext\QTJava.zip

-----------------EOF-----------------

*- $h@doW_P$yKoz -* · Answer

Merci je vais y jeter un oeil ;-)

Ton antivirus actuellement c'est bien AVG ?

moimoi · Answer

oui c'est bien AVG Free

*- $h@doW_P$yKoz -* · Answer

Peux tu vérifier stp si ce dossier est encore présent:

C:\Program Files\Enigma Software Group\SpyHunter

moimoi · Answer

oui toujours là

*- $h@doW_P$yKoz -* · Answer

et ce fichier il est dedans : uninstall.exe

?

moimoi · Answer

dans unistall exe ??? Que veux-tu dire exactement ? si il est dans les add and remove programs ? Si c'est ça oui il est la dedans je pourrais toujours le supprimer

*- $h@doW_P$yKoz -* · Answer

Ici regarde:

C:\Program Files\Enigma Software Group\SpyHunter\uninstall.exe

moimoi · Answer

oui je l'ai je le desinstalle

moimoi · Answer

lol c'était une question je le désinstalle ?

moimoi · Answer

?!? Tu es toujours là ? Je le delete ?

moimoi · Answer

excuse moi je comprends que tu dois être débordé...

n'interprete pas ça mal, mais ça fait une heure que je suis ici...et je n'ai rien fait encore sur mon ordi ?!? 

Je vais devoir partir d.ici 1 heure peut-être moins j'aurais bien aimé savoir si c'est réglable mon probl;eme ou je vais tout simplement le faire formater  ?

J'ai souvent eu de l'excellent service ici et habituellement c.est assez rapide.

Merci

*- $h@doW_P$yKoz -* · Answer

Désolé du retard tu n'es pas seul.
Oui supprime le.

Je te prépare la suite...

moimoi · Answer

merci c'est gentil, je comprends comme je le disais que tu es surement débordé ;) Merci de ne pas m'oublier

*- $h@doW_P$yKoz -* · Answer

;)

Ensuite:

*Fais la manipulation suivante:

ctrl+alt+suppr> Gestionnaire de tâches >>Onglet "Processus" > sélectionne ALCXMNTR.EXE et clic sur 
 Terminer le processus

* Va dans  Démarrer >> Poste de travail >>Outils =>Options des dossiers >>Affichage

Coche la case Afficher les fichiers et dossiers cachés

Ensuite, plus bas
Décocher: Masquer les extensions des fichiers dont le type est connu
Décoche: Masquer les fichiers protégés du système d'exploitation
Ne pas tenir compte du message qui s’affiche

* Ensuite via "Poste de travail" vas dans C:\WINDOWS\ et supprime ALCXMNTR.EXE 

==>vide ta corbeille

* Rends toi ici:

C:\Program Files\Trend Micro\HijackThis\David Despres.exe 

et double clique sur David Despres.exe 


*Au menu qui s'affiche choisis Do a system scan only
*Laisse travailler ton ordi quelques secondes...
*Dans la fenêtre qui apparaît coche les lignes suivantes: 

R3 - URLSearchHook: (no name) - *{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE 

O8 - Extra context menu item: &Search - ?p=ZJman000

clique sur Fix checked.

Il y aura encore peut-être des lignes à fixer plus tard mais on ne peut pas tout faire en même temps.


Tu as spybot donc fais une analyse avec.

^^Marie^^ · Answer

Bonsoir

Juste en passant ;;)

En fait il y a tout ce qui suit à supprimer, mais le  &#9658; ROBOT HT ne le dit pas

R3 - URLSearchHook: (no name) - *{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) 
 R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) 

 O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
 O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" 
 O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
 O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
 O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') 
O4 - Global Startup: McAfee Security Scan.lnk = ? 
O16 - DPF: Garmin Communicator Plug-In - https://my.garmin.com/static/m/cab/2.6.4/GarminAxControl.CAB 
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab 
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab 
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx 
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab 
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/SignIn?ReturnUrl=%2fFileNotFound.htm%3faspxerrorpath%3d%2fupload%2factivex%2fv2_0_0_11%2ferror.aspx&aspxerrorpath=/upload/activex/v2_0_0_11/error.aspx


 O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe 



C:\WINDOWS\jestertb.dll       &#9658; à faire contrôler


Je passerai bien un coup de Smitfraud.

@+++

*- $h@doW_P$yKoz -* · Answer

Merci Marie mais j'y vais tranquille ;)

Et pour le service Bonjour dans le bénéfice du doute je ne le fais pas enlever car chez certains utilisateurs il fait bugger Itunes.

*- $h@doW_P$yKoz -* · Answer

Je ne me sert pas du robot hijackthis (pas fiable)
ZHP --> tu t'en doutes.

Et le reste j'interprète, je cherche, je "google".... Mais pour les lignes que tu as cité, rassure toi je connais ;)

++

^^Marie^^ · Answer

Pourquoi j'ai supputé Smitfraud >?

moimoi · Answer

shadow je ne sais pas si tu es encore ici ou bien marie ou si qqun d'autres peu m'aider ...

Est-ce que je dois supprimer tout ce que Marie a dit ? 

J'Ai fais tout ce que Shadow a dit de faire et présentement le Spybot est en train de faire une scan. 

Marie : le robot ton tu parles ? c,est le script pour mon jeu ? C'ets un ami qui travaille en informatique qui a tout vérifier et il m'a dit que tout était ok pour ce script .... il y a danger si je l'utlise selon toi ?

moimoi · Answer

Euh je n'avais pas vu qu'il y a avait 2 pages maintenant a mon post.... Marie désoler je pensais que tu me parlais. 

Mais là à ce que j'ai pu comprendre est-ce fiable d'écouter Shadow ici  ? c'est quoi il y va a peu près et essaie de m'aider à l'aide de robots qui pourrait cibler mon problème ? 

Merci de m'éclairer la dessus !

moimoi · Answer

up 

SVP qqun ?

pimprenelle27 · Answer

ils vont revenir moimoi, contact les par mp au cas ou.

*- $h@doW_P$yKoz -* · Answer

Re moimoi

=> dsl mais je ne suis pas censé être à ta dispo 24h/24.


On continue:

*Télécharge GenProc :
 http://www.genproc.com/GenProc.exe

*Double-clique sur GenProc.exe et poste le contenu du rapport qui s'affichera.

moimoi · Answer

euh ? où ai-je dis que tu devais être à ma dispo 24h/24 ? merci de ton aide

voici le rapport 

Rapport GenProc 2.640 [1] - 2009-10-15 à 18:52:04 
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.5.3) [Navigateur par défaut]

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante : 


Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :  
C:\Program Files\EsetOnlineScanner\log.txt

 


~~~~ INFORMATION COMPLEMENTAIRE ~~~~
 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:53:50, on 2009-10-15
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Memeo\AutoSync\MemeoAutoSync.exe
C:\Program Files\WD\WD Anywhere Backup\MemeoBackup.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe
C:\GenProc\outil\David Despres_GenProc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ActivateWindows] regedit.exe /s c:\windows\activate.regs
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
O4 - HKLM\..\Run: [WD Anywhere Backup] C:\Program Files\WD\WD Anywhere Backup\MemeoLauncher2.exe --silent
O4 - HKLM\..\Run: [Memeo AutoSync] C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe --silent
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Garmin Communicator Plug-In - 
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - 
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} - 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - 
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - 
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - 
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} - 
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MemeoBackgroundService - Memeo - C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe
O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

moimoi · Answer

up 

SVP qqun mon ordinateur va de plsu en plus mal ! :( Je crois que bientôt mon internet ne fonctionnera plus ça me prends de plus en plus de temps à accéder à internet

*- $h@doW_P$yKoz -* · Answer

Bon on va essayer d'accélérer alors...

"Je crois que bientôt mon internet ne fonctionnera plus ça me prends de plus en plus de temps à accéder à internet"

=> Ça te le fais seulement avec internet explorer ou bien avec d'autres applications aussi ?

 
En attendant ta réponse fais ceci:

&#9654;Démarrer > Exécuter… puis tape: services.msc et valide par OK 
&#9654;La fenêtre des Services s'ouvre => vérifie dans la partie inférieure que l'onglet Étendu est bien sélectionné, sinon fais-le.

&#9654;Recherche le service : Bonjour Service

et vérifie le chemin: C:\Program Files\Bonjour\mDNSResponder.exe

    * Dans la colonne "Nom", Double clique sur le service noté en GRAS ci dessus, pour faire apparaître "Propriétés".
    * Vérifie dans "Chemin d'accès des fichiers exécutables" qu'il s'agit bien de l'emplacement en GRAS aussi.
    * Clique sur Arrêter
    * Dans le menu déroulant "Type de démarrage", sélectionne "Désactivé".
    * Valide la modification par "Appliquer" et "OK".

Ensuite,

*Clique sur l'onglet Démarrage
*Décoche l'élément de démarrage correspondant à Ctfmon.
*Applique puis valide par OK. 

Note: l'ordinateur devra être redémarrer afin que les modifications soient prises en compte.

* Ferme la fenêtre des Services.


Ensuite,

=>Ouvre le Panneau de configuration.
=>Clique sur Options régionales, date, heure et langue.
=> Puis clique sur Options régionales et linguistiques.
=>Cliquer sur l'onglet Langues, puis sur Détails.
=>Cliquer ensuite sur l'onglet Avancé.
=>Sous Configuration du système, coche la case Arrêter les services de texte avancés.
=>Applique puis valide par OK.

Avec hijackthis (on avait pas fini):

* Rends toi ici:

C:\Program Files\Trend Micro\HijackThis\David Despres.exe


*Au menu qui s'affiche choisis Do a system scan only
*Laisse travailler ton ordi quelques secondes...
*Dans la fenêtre qui apparaît coche les lignes suivantes: 


R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) 

O16 - DPF: Garmin Communicator Plug-In -
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} - 

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe  

Clique sur Fix checked puis ferme Hijackthis.

Rends toi sur ce site: https://www.virustotal.com/gui/

*Clique sur Parcourir et cherche le fichier suivant:

C:\WINDOWS\jestertb.dl

Une fois ajouté fais Envoyer le fichier
Patiente...puis poste le rapport qui apparaît à la fin.

moimoi · Answer

j'ai fait la 1ere étape mais je cherche pour : 

Ensuite, 

*Clique sur l'onglet Démarrage 
*Décoche l'élément de démarrage correspondant à Ctfmon. 
*Applique puis valide par OK. 

Note: l'ordinateur devra être redémarrer afin que les modifications soient prises en compte. 

* Ferme la fenêtre des Services.  

c'Est ou exactement ça ? mon ordi est en anglais donc je cherche 2 fois plus lol

Pour ta question explorer va tres mal mais firefox va encore plus mal ;) 

Sinon l'ordinateur est très lent que ce soit pour ouvrir une photo ouvrir un fichier word etc

Merci de ton aide

*- $h@doW_P$yKoz -* · Answer

Pour ctfmon:

Démarrer > Exécuter > Saisir msconfig>> ok

Puis onglet démarrage.

Si tu ne trouves toujours pas fais signe.


Une fois que tu auras terminé tout cela il y aura encore du boulot.

Tu as une clé douteuse dans ton rapport:

Désactive ton antivirus le temps de la manipulation ainsi que ton parefeu si présent

&#9654; Télécharge List&Kill'em (de gen-hackman) et enregistre le sur ton bureau:
http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem.exe

Il ne nécessite pas d'installation

&#9654;double clique pour lancer le scan

choisis la langue puis choisis l'option 1 = Mode Recherche

&#9654;Laisse travailler l'outil...

le rapport va s'afficher , une fois le scan fini

&#9654;Colle le contenu dans ta prochaine réponse

moimoi · Answer

je crois que le ctfmon n'Est tout simplement plus là ça se peut ? il n'est pas dans la liste en tk 

Je fais les autre étapes j'en ai pour 2minutes ;)

moimoi · Answer

voici le fichier pour virustotal : 

Le fichier a déjà été analysé:
MD5: 65dabb831da51500dfa31b40252803e2 
First received: 2007.02.16 19:49:05 UTC 
Date 2009.10.14 16:56:51 UTC [+1D] 
Résultats 5/41 
Permalink: analisis/5124411fe82c961a2c06b518cfb54dc7dfd94f491ba5d13f752e166f80d33d99-1255539411 


je ne sais pas si tu as besoind e tout mais voilà : 

Fichier jestertb.dll reçu le 2009.10.14 16:56:51 (UTC)
Situation actuelle: terminé 

Résultat: 5/41 (12.20%)
 Formaté Impression des résultats  Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.41 2009.10.14 - 
AhnLab-V3 5.0.0.2 2009.10.13 - 
AntiVir 7.9.1.35 2009.10.14 - 
Antiy-AVL 2.0.3.7 2009.10.14 - 
Authentium 5.1.2.4 2009.10.14 W32/Trojan2.HVL 
Avast 4.8.1351.0 2009.10.13 - 
AVG 8.5.0.420 2009.10.14 - 
BitDefender 7.2 2009.10.14 - 
CAT-QuickHeal 10.00 2009.10.14 - 
ClamAV 0.94.1 2009.10.14 - 
Comodo 2599 2009.10.13 - 
DrWeb 5.0.0.12182 2009.10.14 - 
eSafe 7.0.17.0 2009.10.14 - 
eTrust-Vet 35.1.7067 2009.10.14 - 
F-Prot 4.5.1.85 2009.10.14 W32/Trojan2.HVL 
F-Secure 8.0.14470.0 2009.10.14 - 
Fortinet 3.120.0.0 2009.10.14 - 
GData 19 2009.10.14 - 
Ikarus T3.1.1.72.0 2009.10.14 - 
Jiangmin 11.0.800 2009.10.08 - 
K7AntiVirus 7.10.870 2009.10.14 Trojan.Win32.Malware.1 
Kaspersky 7.0.0.125 2009.10.14 - 
McAfee 5770 2009.10.13 - 
McAfee+Artemis 5770 2009.10.13 - 
McAfee-GW-Edition 6.8.5 2009.10.14 - 
Microsoft 1.5101 2009.10.14 - 
NOD32 4507 2009.10.14 - 
Norman 6.01.09 2009.10.14 - 
nProtect 2009.1.8.0 2009.10.14 - 
Panda 10.0.2.2 2009.10.14 Trj/Agent.LIZ 
PCTools 4.4.2.0 2009.10.14 Trojan.Agent.EAUU 
Prevx 3.0 2009.10.14 - 
Rising 21.51.24.00 2009.10.14 - 
Sophos 4.46.0 2009.10.14 - 
Sunbelt 3.2.1858.2 2009.10.14 - 
Symantec 1.4.4.12 2009.10.14 - 
TheHacker 6.5.0.2.041 2009.10.14 - 
TrendMicro 8.950.0.1094 2009.10.14 - 
VBA32 3.12.10.11 2009.10.14 - 
ViRobot 2009.10.14.1984 2009.10.14 - 
VirusBuster 4.6.5.0 2009.10.14 - 
Information additionnelle 
File size: 20992 bytes 
MD5   : 65dabb831da51500dfa31b40252803e2 
SHA1  : 82790a1b47069df4e71750ee13469b0ab13f0129 
SHA256: 5124411fe82c961a2c06b518cfb54dc7dfd94f491ba5d13f752e166f80d33d99 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x475C
timedatestamp.....: 0x2A425E19 (Sat Jun 20 00:22:17 1992)
machinetype.......: 0x14C (Intel I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x37B4 0x3800 6.49 d78b7bc3ca289532671167bfb0277962
DATA 0x5000 0xCC 0x200 1.94 db5a50cf900334485962b7400fdb11a7
BSS 0x6000 0x4E9 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0x7000 0x662 0x800 3.79 ac16988faccf8105c91efe309c85dbfa
.edata 0x8000 0x53 0x200 0.84 ba9f5961e441f7f06448ddc72f655f6d
.reloc 0x9000 0x3CC 0x400 6.40 10f1dbb256201f7741111d0b5b3ee84d
.rsrc 0xA000 0x600 0x600 3.18 a8e39005859f5e6c8e0fc80e00d4cb8c

( 0 imports )


( 0 exports )
 
TrID  : File type identification
Win32 Executable Generic (58.3%)
Win16/32 Executable Delphi generic (14.1%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.6%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
ThreatExpert: https://www.symantec.com?md5=65dabb831da51500dfa31b40252803e2 
ssdeep: 384:VtCh+FKTIqxrEvsfZg6casm3k6sXARuxzEVXuaUQkXI:VLFvqhEvsRg6casmXswRu1arU 
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=F3E96E8300C41801522B0028225A15008A57A25D 
PEiD  : - 
CWSandbox: http://research.sunbelt-software.com/... 
RDS   : NSRL Reference Data Set
-

*- $h@doW_P$yKoz -* · Answer

*EDIT*

moimoi · Answer

voici le tapport list'em.txt 

List'em by g3n-h@ckm@n 1.0.4.2 

updated on 09.10.2009 ::::: 14.30 

Windows_NT 

Microsoft Windows XP [Version 5.1.2600]
 

2009-10-16    11:09:46,18 
 
======================
Cles de demarrage "Run" 
======================
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AROReminder"="C:\Program Files\Advanced Registry Optimizer\aro.exe -rem"
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
"swg"="\"C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe\""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater]
@=""

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ActivateWindows"="regedit.exe /s c:\windows\activate.regs"
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe"
"WD Drive Manager"="C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe"
"WD Anywhere Backup"="C:\Program Files\WD\WD Anywhere Backup\MemeoLauncher2.exe --silent"
"Memeo AutoSync"="C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe --silent"
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
@=""

=====================
cles additionnelles
=====================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
@="AcroIEHelperStub"
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
@="WormRadar.com IESiteBlocker.NavFilter"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
"NoExplorer"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
@="Google Dictionary Compression sdch"
"NoExplorer"=dword:00000001

===============
Path : C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\ 
===============
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"  
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"  
"C:\WINDOWS\system32	mp.reg"  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyWebSearch bar Uninstall"  
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}  
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d}  
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca}  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll"  
HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8}  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df}  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}  
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_MYWEBSEARCHSERVICE  
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE  
 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

AVGCMGR.EXE-017B654E.pf
AVGCSRVX.EXE-31443687.pf
AVGNSX.EXE-14F0A211.pf
AVGSCANX.EXE-3A073C33.pf
AVGUPD.EXE-2AED0BE6.pf
CMD.EXE-034B0549.pf
CSCRIPT.EXE-0A13A05C.pf
CTFMON.EXE-05E57A5E.pf
CURL.EXE-2FC8A701.pf
DAVID DESPRES.EXE-0731CA30.pf
DWWIN.EXE-2C373FB7.pf
FIND.EXE-0EEAD1A7.pf
FINDSTR.EXE-1A4FC238.pf
FIREFOX.EXE-06188867.pf
FIXCFG.EXE-3A39BB3F.pf
GETVERSION.EXE-092EA979.pf
GOOGLETOOLBARNOTIFIER.EXE-0047A1C5.pf
GOOGLEUPDATERSERVICE.EXE-2F4A2F77.pf
GREP.EXE-15CF854A.pf
HELPSVC.EXE-1C192440.pf
IEXPLORE.EXE-2D97EBE6.pf
INFOCARD.EXE-0146833D.pf
JQSNOTIFY.EXE-359F83C5.pf
Layout.ini
LIST_KILLEM.EXE-36BCAFFE.pf
MMC.EXE-3B59A269.pf
MODE.COM-318FFE37.pf
MSCONFIG.EXE-1EF1EA0F.pf
MSNMSGR.EXE-0EBDBC56.pf
NOTEPAD.EXE-2F2D61E1.pf
NTOSBOOT-B00DFAAD.pf
PING.EXE-30F9CA9D.pf
QTTASK.EXE-1876A1A1.pf
REG.EXE-07FA5B3F.pf
REGEDIT.EXE-2AE3423E.pf
REGSVR32.EXE-396DEA2C.pf
RUNDLL32.EXE-5A57E1D5.pf
RUNDLL32.EXE-5BB0F89B.pf
SED.EXE-080B2B01.pf
SSMYPICS.SCR-2B33A3BB.pf
SWREG.EXE-033E4BFC.pf
TASKMGR.EXE-06144C13.pf
TOOLBARBROKER.EXE-3ADB739B.pf
WLLOGINPROXY.EXE-1423C8C5.pf
WMIPRVSE.EXE-0D449B4F.pf
WUAUCLT.EXE-1360D60A.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

*- $h@doW_P$yKoz -* · Answer

Ferme toutes tes fenêtres (y compris internet et windows live messenger si ouvertes) , puis :

&#9654; Relance List&Kill'em 

&#9654; choisis l'option 2 = Mode Destruction

laisse travailler l'outil...

après les vérifications , un rapport va s'ouvrir.

&#9654; ferme-le.

un deuxième rapport va s'ouvrir ,

&#9654; colle son contenu dans ta réponse

moimoi · Answer

voilà 

Kill'em by g3n-h@ckm@n 1.0.4.2 

updated on 09.10.2009 ::::: 14.30 

Windows_NT 

Microsoft Windows XP [Version 5.1.2600]
 

2009-10-16    11:17:49,40 

Fichiers analysés : 
================= 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"  
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"  
"C:\WINDOWS\system32	mp.reg"  
 
 
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers : 
  
Quarantaine : 

qmgr0.dat.Kill'em
qmgr1.dat.Kill'em
tmp.reg.Kill'em

¤¤¤¤¤¤¤¤¤¤ Verification : 
 

===============
Path : C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\ 
===============
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}"  
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MyWebSearch bar Uninstall"  
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}  
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d}  
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca}  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}"  
"HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll"  
HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8}  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab}  
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df}  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}  
HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}  
HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_MYWEBSEARCHSERVICE  
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MYWEBSEARCHSERVICE  
 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

Layout.ini
NTOSBOOT-B00DFAAD.pf
REG.EXE-07FA5B3F.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

moimoi · Answer

je dois partir pour environ 1h30 je reviens le plus vite possible 

merci de ton aide ! 

Écris moi le plus de trucs possible a faire pour mon retour au cas ou tu ne serais pas là :)

*- $h@doW_P$yKoz -* · Answer

Désolé mais moi aussi je dois m'absenter. 
Je serai de retour vers 20h.

*- $h@doW_P$yKoz -* · Answer

Re,

la suite:

&#9654; /!\ Désactive ton antivirus et tout autre type de protection !  /!\
&#9654; /!\ Déconnecte toi et ferme toutes les applications en cours (y compris Internet) !  /!\
&#9654; Si tu es sous Vista désactive l'UAC le temps de la désinfection :
https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html

/!\   si tu as TeaTimer (le résident de Spybot), désactive-le sinon il va gêner la désinfection en empêchant la modification des BHO et la réparation du registre :
*Démarre Spybot, clique sur Mode, coche Mode avancé 
*A gauche, clique sur Outils, puis sur Résident 
*Décoche la case devant Résident "TeaTimer" puis quitte Spybot :
&#9654; Une fois la désinfection terminée ( et pas avant ), réactive le " TeaTimer " . 


&#9654;Télécharge ComboFix de sUBs : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

&#9654;Sauvegarde le sur ton bureau et pas ailleurs ! 

&#9654; Double-clique sur ComboFix.exe Il va te poser une question, suis les invites puis attends que Combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé. 

&#9654;Poste le rapport qui se trouve ici: C:\Combofix.txt 

&#9654; clique dessus pour l'ouvrir puis clique droit >>copier
&#9654;Et dans ta prochaine réponse : clique droit >> coller

moimoi · Answer

Voilà ! J'espere que tout est ok j'ai 3 prgrammes qui on démarrer quand il y a eu le reboot ! Je les ai fermés...mais bon en espérant que ça n'affecte pas les données ! 



ComboFix 09-10-16.02 - David Despres 2009-10-16 15:50.1.2 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.511.305 [GMT -4:00]
Running from: c:\documents and settings\David Despres\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\2408494c.msp
c:\windows\Installer\2408494e.msp
c:\windows\jestertb.dll
H:\Autorun.inf

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE


(((((((((((((((((((((((((   Files Created from 2009-09-16 to 2009-10-16  )))))))))))))))))))))))))))))))
.

2009-10-16 15:17 . 2009-10-16 15:18	--------	dc----w-	C:\Kill'em
2009-10-16 02:54 . 2008-10-16 18:06	208744	----a-w-	c:\windows\system32\muweb.dll
2009-10-15 22:51 . 2009-10-15 22:51	--------	dc----w-	C:\GenProc
2009-10-13 17:27 . 2009-10-13 19:06	--------	dc----w-	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-13 17:27 . 2009-10-13 17:27	--------	d-----w-	c:\program files\Spybot - Search & Destroy
2009-10-13 01:19 . 2009-10-13 01:19	--------	d-----w-	c:\documents and settings\David Despres\Application Data\Sammsoft
2009-10-13 01:19 . 2009-10-13 01:19	--------	d-----w-	c:\program files\Advanced Registry Optimizer
2009-10-11 13:57 . 2008-04-13 18:47	25856	-c--a-w-	c:\windows\system32\dllcache\usbprint.sys
2009-10-11 13:57 . 2008-04-13 18:47	25856	----a-w-	c:\windows\system32\drivers\usbprint.sys
2009-10-11 07:07 . 2009-10-11 07:07	--------	d-----w-	c:\windows\system32\XPSViewer
2009-10-11 07:06 . 2009-10-11 07:06	--------	d-----w-	c:\program files\MSBuild
2009-10-11 07:06 . 2009-10-11 07:06	--------	d-----w-	c:\program files\Reference Assemblies
2009-10-11 07:06 . 2008-07-06 12:06	89088	-c----w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-10-11 07:06 . 2008-07-06 12:06	117760	------w-	c:\windows\system32\prntvpt.dll
2009-10-11 07:06 . 2008-07-06 10:50	597504	-c----w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-10-11 07:06 . 2008-07-06 12:06	575488	-c----w-	c:\windows\system32\dllcache\xpsshhdr.dll
2009-10-11 07:06 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\xpsshhdr.dll
2009-10-11 07:06 . 2008-07-06 12:06	1676288	-c----w-	c:\windows\system32\dllcache\xpssvcs.dll
2009-10-11 07:06 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\xpssvcs.dll
2009-10-11 07:06 . 2009-10-11 07:06	--------	dc----w-	C:\9d43262ec26c5af6eb9144c7386f
2009-10-11 02:41 . 2009-10-11 02:41	--------	dc----w-	c:\documents and settings\All Users\Application Data\McAfee
2009-10-11 02:33 . 2009-10-11 02:33	--------	d-sh--w-	c:\documents and settings\David Despres\IECompatCache
2009-10-11 02:33 . 2009-10-11 02:33	--------	dc----w-	C:\Importé depuis Internet Explorer
2009-10-11 02:32 . 2009-10-11 02:32	--------	d-----w-	c:\documents and settings\David Despres\Application Data\WD
2009-10-11 02:32 . 2009-10-11 02:32	--------	d-----w-	c:\documents and settings\David Despres\Application Data\Memeo
2009-10-10 14:46 . 2009-10-10 14:46	--------	d-sh--w-	c:\documents and settings\LocalService\IETldCache
2009-10-10 03:05 . 2009-10-12 20:51	--------	d-----w-	c:\documents and settings\David Despres\Local Settings\Application Data\Google
2009-10-10 03:04 . 2009-10-12 23:34	--------	d-----w-	c:\program files\Google
2009-10-10 02:59 . 2009-10-10 02:59	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\ServiceTest
2009-10-10 02:59 . 2009-10-10 02:59	--------	d-----w-	c:\program files\Memeo
2009-10-10 02:49 . 2009-10-10 02:49	--------	d-----w-	c:\documents and settings\David Despres\Local Settings\Application Data	emp
2009-10-10 02:47 . 2009-10-10 02:59	--------	d-----w-	c:\program files\Common Files\eSellerate
2009-10-10 02:47 . 2009-10-10 02:47	--------	d-----w-	c:\program files\WD
2009-10-10 02:32 . 2009-10-10 03:00	--------	d-----w-	c:\program files\Western Digital
2009-10-09 02:06 . 2009-10-09 02:06	--------	dc----w-	c:\documents and settings\All Users\Application Data\McAfee Security Scan
2009-10-09 02:06 . 2009-10-09 02:06	--------	d-----w-	c:\program files\McAfee Security Scan
2009-10-09 02:05 . 2009-10-14 23:14	--------	dc----w-	c:\documents and settings\All Users\Application Data\NOS
2009-10-07 02:17 . 2009-10-07 02:17	--------	d-sh--w-	c:\documents and settings\David Despres\PrivacIE
2009-10-06 23:17 . 2009-10-06 23:17	--------	d-sh--w-	c:\documents and settings\David Despres\IETldCache
2009-10-06 17:20 . 2009-08-07 08:48	100352	-c----w-	c:\windows\system32\dllcache\iecompat.dll
2009-10-06 17:19 . 2009-10-06 17:20	--------	d-----w-	c:\windows\ie8updates
2009-10-06 17:18 . 2009-07-03 17:09	12800	-c----w-	c:\windows\system32\dllcache\xpshims.dll
2009-10-06 17:18 . 2009-07-03 17:09	246272	-c----w-	c:\windows\system32\dllcache\ieproxy.dll
2009-10-06 17:14 . 2009-10-06 17:17	--------	dc-h--w-	c:\windows\ie8
2009-10-06 01:52 . 2009-10-06 01:52	--------	d-----w-	c:\program files\CCleaner
2009-10-04 21:12 . 2009-10-04 21:13	--------	d-----w-	c:\documents and settings\David Despres\Local Settings\Application Data\WinZip

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-13 22:05 . 2008-03-26 00:49	--------	d-----w-	c:\program files\Windows Media Connect 2
2009-10-11 13:45 . 2008-03-26 01:22	--------	d-----w-	c:\program files\Common Files\Adobe
2009-10-11 07:23 . 2008-03-26 01:01	70408	-c--a-w-	c:\documents and settings\David Despres\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-07 19:27 . 2008-11-04 20:50	--------	d-----w-	c:\program files\Creative
2009-10-07 19:24 . 2008-10-15 15:42	--------	d-----w-	c:\program files\PokerStars
2009-10-07 19:23 . 2008-07-16 01:34	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-10-07 19:21 . 2008-03-27 17:17	--------	d-----w-	c:\program files\Java
2009-10-07 02:17 . 2009-06-22 14:01	--------	d-----w-	c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-10-04 21:13 . 2008-03-26 00:27	--------	d-----w-	c:\documents and settings\All Users\Application Data\WinZip
2009-09-22 15:57 . 2008-03-27 17:19	--------	d-----w-	c:\documents and settings\David Despres\Application Data\LimeWire
2009-09-10 07:01 . 2008-03-26 01:45	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-27 02:40 . 2009-08-27 02:40	21568	----a-w-	c:\windows\system32\drivers\HPZius12.sys
2009-08-27 02:39 . 2009-08-27 02:39	286720	----a-w-	c:\windows\system32\HPZc3212.dll
2009-08-22 13:21 . 2008-06-22 21:52	11952	----a-w-	c:\windows\system32\avgrsstx.dll
2009-08-22 13:21 . 2008-06-22 21:52	335240	----a-w-	c:\windows\system32\drivers\avgldx86.sys
2009-08-22 13:21 . 2008-06-22 21:52	27784	----a-w-	c:\windows\system32\drivers\avgmfx86.sys
2009-08-05 09:01 . 2001-08-23 12:00	204800	-c--a-w-	c:\windows\system32\mswebdvd.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 15:58	1107200	----a-w-	c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2008-08-22 2084480]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-12 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-05 2023704]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-07-24 450560]
"WD Anywhere Backup"="c:\program files\WD\WD Anywhere Backup\MemeoLauncher2.exe" [2008-11-07 197856]
"Memeo AutoSync"="c:\program files\Memeo\AutoSync\MemeoLauncher2.exe" [2008-11-06 144608]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"ActivateWindows"="regedit.exe" - c:\windowsegedit.exe [2008-04-14 146432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]
2009-08-22 13:21	11952	----a-w-	c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\Program Files\Messenger\msmsgs.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\LimeWire\LimeWire.exe"=
"c:\Program Files\AVG\AVG8\avgupd.exe"=
"c:\Program Files\AVG\AVG8\avgemc.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Messenger\livecall.exe"=
"%windir%\system32\drivers\svchost.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\iTunes\iTunes.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-22 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-06-22 108552]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-07-04 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-04 297752]
R2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\WD\WD Anywhere Backup\MemeoBackgroundService.exe [2008-11-07 25824]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2008-07-24 102400]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2008-10-05 38528]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32undll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-10-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.ca/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\David Despres\Application Data\Mozilla\Firefox\Profiles\7869hz3i.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: keyword.URL - hxxp://cf.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_cf&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Kalender - c:\windows\Uninstall_tkexe -kalender



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-16 16:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1476)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
.
**************************************************************************
.
Completion time: 2009-10-16 16:09 - machine was rebooted
ComboFix-quarantined-files.txt  2009-10-16 20:09

Pre-Run: 45 724 299 264 bytes free
Post-Run: 45 833 875 456 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
h:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

205	--- E O F ---	2009-10-14 07:00

*- $h@doW_P$yKoz -* · Answer

Ok vérifie si ça est présent:

c:\windows\jestertb.dll

*- $h@doW_P$yKoz -* · Answer

En attendant fais ceci pour vérif:

&#9654;Télécharge Toolbar S&D:
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3 

&#9654; Lances l'installation en exécutant le fichier téléchargé... 

&#9654; Double-clique sur le raccourci de Toolbar, qui se trouve sur ton bureau, pour lancer l'application. 

&#9654;sélectionnes la langue, puis valides par la touche '' Entrée '' de ton clavier... 

&#9654; Au menu, choisis l'option 1 (recherche) et patientes jusqu'à la fin de la recherche. 

&#9654; Un rapport sera généré à la fin. Poste-le stp.

moimoi · Answer

c:\windows\jestertb.dll    n'est plus là :) 

et voici le rapport  : 


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.80GHz )
   BIOS : BIOS Date: 09/04/03 17:10:30 Ver: 08.00.08
   USER : David Despres ( Administrator )
   BOOT : Normal boot
   Antivirus : AVG Anti-Virus Free 8.5 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:123 Go (Free:46 Go)
   D:\ (USB)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (Local Disk) - FAT32 - Total:4 Go (Free:3 Go)
   I:\ (CD or DVD)
   J:\ (CD or DVD)
   K:\ (USB)
   L:\ (USB)
   M:\ (USB) - FAT - Total:975 Mo (Free:0 Go)
   N:\ (USB)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [1] ( 2009-10-16|20:51 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\DOCUME~1\DAVIDD~1\Cookies\david_despres@mywebsearch[1].txt

   -----------\  Extensions

   (David Despres) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.ca/?gws_rd=ssl"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version.zip
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\Deployment.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorService
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Lees mij.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Leggimi.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Léame.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Read Me.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Viktigt.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Zishu.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_\READ.txt
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_\ssg.nfo



   1 - "C:\ToolBar SD\TB_1.txt" - 2009-10-16|20:53 - Option : [1]

   -----------\  Fin du rapport a 20:53:02,43

*- $h@doW_P$yKoz -* · Answer

&#9654;Relances ToolBarSD 
&#9654;Choisis l'option 2 ( suppression), 
&#9654;Ne touche à rien pendant la suppression. 
&#9654;A la fin, un rapport est généré, postes le.

Supprime tes Cracks & Keygens

C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version.zip
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\Deployment.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorService
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Lees mij.html
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Leggimi.html
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Léame.html
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Read Me.html
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Viktigt.html
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Zishu.html
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll1.cab
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.boot.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.proxy.xml
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_\READ.txt
C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_\ssg.nfo

Le danger des cracks ! https://forum.malekal.com/viewtopic.php?t=893&start=

Les cracks: [Dossier] Prévention & Protection : http://www.presence-pc.com/forum/ppc/Logiciels/dossier-prevention-protection-sujet-23783-1.htm

moimoi · Answer

euhhhh ça fait très longtemps que j'ai mon crack de photoshop ça n'a jamais été le problème  ! Je travaille en plus très régulièrement avec. Si possible j'aimerais ne pas le supprimer. Mon ordinateur a toujours bien rouler même avec ce crack !

*- $h@doW_P$yKoz -* · Answer

Tu es libre de faire ce que tu veux avec tes cracks mais ça reste à tes risques et périls comme on dit ^^

Poste le rapport stp

moimoi · Answer

Mais est-ce que ça supprimera automatiquement mon crack le ToolBarSD ?

*- $h@doW_P$yKoz -* · Answer

Non, c'est pour ça que je t'avais dis de les supprimer manuellement.
L'option 2 ne te les supprimeras pas.

moimoi · Answer

voilà


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.80GHz )
   BIOS : BIOS Date: 09/04/03 17:10:30 Ver: 08.00.08
   USER : David Despres ( Administrator )
   BOOT : Normal boot
   Antivirus : AVG Anti-Virus Free 8.5 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:123 Go (Free:45 Go)
   D:\ (USB)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (Local Disk) - FAT32 - Total:4 Go (Free:3 Go)
   I:\ (CD or DVD)
   J:\ (CD or DVD)
   K:\ (USB)
   L:\ (USB)
   M:\ (USB)
   N:\ (USB)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [2] ( 2009-10-18| 9:11 )

   -----------\ SUPPRESSION

   Supprime! - C:\DOCUME~1\DAVIDD~1\Cookies\david_despres@mywebsearch[1].txt

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (David Despres) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.ca/?gws_rd=ssl"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version.zip
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\Deployment.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorService
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeALMAnchorServiceAll\AdobeALMAnchorServiceAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAssetServices3All\AdobeAssetServices3All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeAUM5.1All\AdobeAUM5.1All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeBridge2All\AdobeBridge2All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCameraRaw4.0All\AdobeCameraRaw4.0All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeCMapsAll\AdobeCMapsAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorCommonSetAll\AdobeColorCommonSetAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorEU_ExtraSettingsAll\AdobeColorEU_ExtraSettingsAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorJA_ExtraSettingsAll\AdobeColorJA_ExtraSettingsAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorNA_RecommendedAll\AdobeColorNA_RecommendedAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeColorPhotoshopAll\AdobeColorPhotoshopAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDefaultLanguageCS3All\AdobeDefaultLanguageCS3All1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\AdobeDeviceCentralAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Lees mij.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Leggimi.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Léame.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Read Me.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Viktigt.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeDeviceCentralAll\oem\Adobe Device Central CS3\Device Central CS3 Zishu.html
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeExtendScriptToolKitAll\AdobeExtendScriptToolKitAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeFontsAll\AdobeFontsAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeHelpViewerAll\AdobeHelpViewerAll1.cab
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.boot.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\Adobe CS3\payloads\AdobeLinguisticsAll\AdobeLinguisticsAll.proxy.xml
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_\READ.txt
   C:\DOCUME~1\DAVIDD~1\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Foldersosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_\ssg.nfo



   1 - "C:\ToolBar SD\TB_1.txt" - 2009-10-16|20:53 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 2009-10-18| 9:13 - Option : [2]

   -----------\  Fin du rapport a  9:13:06,23

*- $h@doW_P$yKoz -* · Answer

Ok, colle un nouveau rapport RSIT pour voir ce que ça donne.

Sinon, comment tourne le pc ?

moimoi · Answer

il v amieux mais il n'est pas comme avant non plus....il prends encore bien du temps pour ouvrir certaine fenetre internet, il a l'air de souvent chercher quelque chose ça tourne à fond dans mon pc lol mais c'Est un bon début puisque je n'ai plus cette barre blanche sous explorer qui grandissait de page en page ! 

voici le rapport 

Logfile of random's system information tool 1.06 (written by random/random)
Run by David Despres at 2009-10-18 14:55:00
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 47 GB (37%) free of 127 GB
Total RAM: 511 MB (11% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:55:17, on 2009-10-18
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Memeo\AutoSync\MemeoAutoSync.exe
C:\Program Files\WD\WD Anywhere Backup\MemeoBackup.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\David Despres\Local Settings\Temporary Internet Files\Content.IE5\7G0TQTW4\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\David Despres.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [ActivateWindows] regedit.exe /s c:\windows\activate.regs
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
O4 - HKLM\..\Run: [WD Anywhere Backup] C:\Program Files\WD\WD Anywhere Backup\MemeoLauncher2.exe --silent
O4 - HKLM\..\Run: [Memeo AutoSync] C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe --silent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MemeoBackgroundService - Memeo - C:\Program Files\WD\WD Anywhere Backup\MemeoBackgroundService.exe
O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

moimoi · Answer

ah oui et aussi mon firefox ne fonctionne toujours pas ça prends trop de jus avec mon script c'est normal ? Je n'avais jamais eu de problèmes avec avant tout fonctinnait #1

*- $h@doW_P$yKoz -* · Answer

Mouai, attends y'a encore une merde qui est venu faire son apparition:

Télécharge Killbox:
http://www.downloads.subratam.org/KillBox.exe

Double clic sur killbox.exe (Pocket Killbox)

- Dans "Full Path of File to Delete" copie et colle le texte suivant:

C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\mbr.sys

- clique sur la croix rouge
- une fenêtre va apparaître pour confirmation de suppression clique sur YES


Pour tes programmes (on verra à la fin):

tu vas dans le panneau de configuration puis ajout/supp de programmes et tu me fais une capture d'écran que tu m'envoie ensuite

moimoi · Answer

un ptit up ?

*- $h@doW_P$yKoz -* · Answer

Je t'ai répondu:

https://forums.commentcamarche.net/forum/affich-14753661-infecte-par-un-spyware?page=3#55

pimprenelle27 · Answer

Bonsoir à vous deux : 


*- $h@doW_P$yKoz -*, connais tu OTM.

*- $h@doW_P$yKoz -* · Answer

Salut pimprenelle,

"connais tu OTM"

=> Evidemment que je connais.

Mais après avoir regarder sur plusieurs sites que Temp\mbr.sys ne partait pas avec un script OTM, j'ai privilégier killbox (pas aussi bien que OTM je sais)  ;-)

pimprenelle27 · Answer

Si à côté de service tu met simplement mbr et tu verras.

moimoi · Answer

ça ne fonctionne pas j'ai copier le lien pour le le supprimer mais il doit manquer quelque chose j'ai essayé de le trouver manuellement et je ne trouve pas....c'est situé ou exactement ?

moimoi · Answer

j'ai pas mentionné ça dit que le fichier n'Existe pas...

pimprenelle27 · Answer

Bonjour à vous 2,

Pour avancer *- $h@doW_P$yKoz -*,

&#x25B6; Télécharge OTM (de Old_Timer) sur ton Bureau
 
&#x25B6; Double-clique sur OTM.exe pour le lancer.

&#x25B6; Assure toi que la case Unregister Dll's and Ocx's soit bien cochée.

&#x25B6; Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTM sous "Paste instructions for item to be moved".

-----------------------------------------------------------------------------
:services
mbr


:Commands
[purity]
[emptytemp]
[Reboot]


 
-----------------------------------------------------------------------------

&#x25B6; clique sur MoveIt! pour lancer la suppression.

&#x25B6; Le résultat apparaitra dans le cadre "Results".

&#x25B6; Clique sur Exit pour fermer.

&#x25B6; Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

&#x25B6; Il te sera peut-être demandé de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

*- $h@doW_P$yKoz -* · Answer

Ok, bon ba fais avec OTM alors ;)

https://forums.commentcamarche.net/forum/affich-14753661-infecte-par-un-spyware?page=4#63

moimoi · Answer

All processes killed
========== SERVICES/DRIVERS ==========

Service\Driver mbr deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: David Despres
->Temp folder emptied: 66721287 bytes
->Temporary Internet Files folder emptied: 184608080 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 42431855 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 466775 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1138618 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 2802731 bytes
RecycleBin emptied: 23681388 bytes
 
Total Files Cleaned = 307,01 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 10202009_143936

Files moved on Reboot...

Registry entries deleted on Reboot...



et puis en passant je ne suis pas capable de faire des copiers coller ???!!! J'ai du écrire à la main la liste en gras, par chance elle était courte ;)

pimprenelle27 · Answer

tu ne peux pas faire sélectionner et CTRL C et ensuite CTRL V?

moimoi · Answer

je ne pouvais tout simplement selectionner ce que je voulais copier, mais tu vois là maintenant ça fontcionne ? Je ne sais pas trop pourquoi ?

pimprenelle27 · Answer

Mais bon ça à marché c'est l'essentiel.

moimoi · Answer

mais maintenant je fais quoi ? Tout n'Est toujours pas en ordre dans mon PC impossible de naviguer aisement avec Firefox, on oublie de faire fonctionner mon script avec mon jeu sur firefox... c'est comme si mon pc était un ordinausaure lol quoiqu'il a quand même qques années mais bon il y a qques semaines il allait #1 !

pimprenelle27 · Answer

Je pense que *- $h@doW_P$yKoz -*, devrait revenir demain, moi pour ma part aujourd'hui je vais me coucher.

A demain.

moimoi · Answer

merci beaucoup de ton aide pimprenelle :)

pimprenelle27 · Answer

De rien j'adore faire ça.

moimoi · Answer

un petit up

pimprenelle27 · Answer

Si demain *- $h@doW_P$yKoz -* n'est pas revenu je continuerais alors.

moimoi · Answer

merci pimprenelle ! Comme ça fait déjà 1 semaine que j'essaie de me débarrasser de ça :p j'aimerais bien qu'on y arrive un jour lol !

moimoi · Answer

un ptit up, car je crois que shadow ne reviendra pas ...

pimprenelle27 · Answer

Refait moi un RSIT. STP

moimoi · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by David Despres at 2009-10-22 21:42:11
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 47 GB (37%) free of 127 GB
Total RAM: 511 MB (11% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:42:50, on 2009-10-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\David Despres\Desktop\RootkitRevealer.exe
C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\IXRUBUKFHLC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\David Despres\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\David Despres.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [ActivateWindows] regedit.exe /s c:\windows\activate.regs
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IXRUBUKFHLC - Sysinternals - www.sysinternals.com - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\IXRUBUKFHLC.exe
O23 - Service: XD - Sysinternals - www.sysinternals.com - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\XD.exe

pimprenelle27 · Answer

c'est quoi ça : C:\Documents and Settings\David Despres\Desktop\RootkitRevealer.exe


Ensuite : 


Pour les utilisateurs de Spybot Search and Destroy :

    * Si vous avez TeaTimer (le résident de Spybot S&D), désactivez-le sinon il va gêner la désinfection en empêchant la modification des BHO et la réparation du registre.
          o Démarrez Spybot, cliquez sur Mode, cochez Mode avancé
          o A gauche, cliquez sur Outils, puis sur Résident
          o Décochez la case devant Résident "TeaTimer" puis quittez Spybot :


Note importante :
Une fois la désinfection terminée ( et pas avant ), réactiver le " TeaTimer " .
/!\ Mais attention :
à ce moment là, le " TeaTimer " de Spybot proposera, par le biais de plusieurs pop-up, d'accepter ou non des modifications de registre ( survenuent lors de la désinfection ) -> il faudra alors les accepter toutes sans exeptions !

Puis part la suite , il faudra rester vigilant lorsque le "TeaTimer" donnera des alertes : accepter une modification uniquement si on en connait la provenance .
 


Puis : 

Sous Vista : &#x25B6; Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

&#x25B6; Clique sur Démarrer puis sur panneau de configuration
&#x25B6; Double Clique sur l'icône "Comptes d'utilisateurs"
&#x25B6; Clique ensuite sur désactiver et valide.
&#x25B6; Redémarre le PC.


Option 1 - Recherche :


&#x25B6; télécharge smitfraudfix et enregistre le sur le bureau
 
&#x25B6; Sous XP : Double clique sur smitfraudfix puis exécuter

&#x25B6; sous vista : Clic-droit sur SmitfraudFix présent sur le bureau et choisis "Exécuter en tant qu'administrateur"

&#x25B6; Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

(attention : N utilises pas l option 2 si je ne te l ai pas demandé !!)

&#x25B6; copier/coller le rapport dans la réponse.


Voici un tutoriel sonore et animé en cas de problème d'utilisation


(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool".
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains,
cet utilitaire pourrait arrêter des logiciels de sécurité.)

moimoi · Answer

désolé je n'ai pas eu accès a mon ordi pour 2 jours... 

je fais tout ce que tu m'as dit et je te post ça dans qques minutes ! Merci :)

moimoi · Answer

le rootkitreverler est un programme qu'un ami qui travaille en informatique m'a installer qui n'est pas activer pour le moment..lorsqu'il aura le temps il va regarder ma machine a distance de chez lui ;) mais il n'a pas le temps pour l'instant et comme mon ordi ram depuis des semaines je commence à être à bout lol

SmitFraudFix v2.394

Scan done at 10:19:16,57, 2009-10-24
Run from C:\Documents and Settings\David Despres\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David Despres


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David Despres\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DAVIDD~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler Miniport
DNS Server Search Order: 24.200.241.37
DNS Server Search Order: 24.201.245.77
DNS Server Search Order: 24.200.243.189

HKLM\SYSTEM\CCS\Services\Tcpip\..\{048F148F-9768-47CE-AAF6-539C028519CD}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{048F148F-9768-47CE-AAF6-539C028519CD}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{048F148F-9768-47CE-AAF6-539C028519CD}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

pimprenelle27 · Answer

Tu peux me refaire un scan complet Malwarebyte's STP.

moimoi · Answer

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3027
Windows 5.1.2600 Service Pack 3

2009-10-24 18:46:07
mbam-log-2009-10-24 (18-45-58).txt

Type de recherche: Examen complet (C:\|H:\|)
Eléments examinés: 213159
Temps écoulé: 1 hour(s), 19 minute(s), 15 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Windows Live\Messenger\riched20.dll (Adware.MyWebSearch) -> No action taken.

pimprenelle27 · Answer

Bonjour, 

malware no action taken il faut faire afficher rapport puis supprimer et me poster le nouveau rapport, ensuite  : 

* Sous Vista : &#x25B6; Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

* Clique sur Démarrer puis sur panneau de configuration
* Double Clique sur l'icône "Comptes d'utilisateurs"
* Clique ensuite sur désactiver et valide.
* Redémarre le PC


&#x25B6; Rends-toi à cette adresse afin de télécharger AD-Remover (créé par C_XX) : https://www.androidworld.fr/

&#x25B6; Clique sur TÉLÉCHARGER et enregistre-le sur ton bureau.

&#x25B6; tutoriel installation

&#x25B6; Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( le bureau )

&#x25B6; Ouvre le dossier Ad-remover présent sur ton bureau

&#x25B6; Double clique sur Ad-remover.bat.

* Sous Vista : clic droit sur AD-Remover et sélectionner "Exécuter en tant qu'administrateur"

&#x25B6; Au menu principal choisi l'option "L" et tape sur [entrée] .

&#x25B6; Laisse travailler l'outil et ne touche à rien ...

&#x25B6; Poste le rapport qui apparait à la fin.

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :

Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

moimoi · Answer

.Voici le ad remover en esperant que tout est ok :O et je réessaie pour l'autre programme

======= LOGFILE OF AD-REMOVER 1.1.4.6_A | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 18.10.2009 at 19:05
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at: 19:21:38, 2009-10-25 | Normal Boot | Option: CLEAN
Executed from: C:\Program Files\Ad-Remover\
Operating system: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Computer Name: DAVID | Current user: David Despres
.
============== NEUTRALIZED ELEMENT(S) ==============
.

.
C:\Program Files\Mozilla FireFox\chrome\m3ffxtbr.jar
C:\Program Files\Windows Live\Messenger\Riched20.dll 
C:\Program Files\Windows Live\Messenger\Msimg32.dll 
 
(!) -- Temp files deleted. 
 
.
============== Added scan ==============
.
.
* Mozilla FireFox Version 3.5.3 [fr] *
.
 ProfilePath: 7869hz3i.default (David Despres)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "Yahoo! Search"); 
(Prefs.js) user_pref("browser.search.selectedEngine", "Yahoo! Search"); 
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.1.3"); 
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials ... ) ==============
.
C:\Documents and Settings\David Despres\Desktop\Patch FR\Patch FR\Traduction_Us-Fr.exe
C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version.zip
C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Patch FR.zip
C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_\ssg.nfo
.
===================================
.
2784 Byte(s) - C:\Ad-Report-CLEAN[1].log 
.
0 File(s) - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp 
0 File(s) - C:\WINDOWS\Temp 
.
18 File(s) - C:\Program Files\Ad-Remover\BACKUP
3 File(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
End at: 19:25:53 | 2009-10-25 - CLEAN[1]
.
============== E.O.F ==============
.

pimprenelle27 · Answer

il va falloir me supprimer tout ça source de tes virus : 

C:\Documents and Settings\David Despres\Desktop\Patch FR\Patch FR\Traduction_Us-Fr.exe
C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version.zip
C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Patch FR.zip
C:\Documents and Settings\David Despres\Local Settings\Application Data\Microsoft\Messenger\cindy_allain@hotmail.com\Sharing Folders\rosabelle29@msn.com\Adobe Photoshop CS3 v10 with Crack full version\_crack_\ssg.nfo

moimoi · Answer

je ne comprends pas c'est un ami qui me l'a envoyé le crack de photoshop...il m'a assuré qu'il n'y avait aucun problème....ça fait des années que je l'utilise et je n'ai JAMAIS eu de problèmes ? Tu es certaine que c'Est bien la source du problème? pourquoi l'aurais-je utilisé durant 2 ans sans avoir de problème ?

moimoi · Answer

Voici le rapport malwarebytes

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3027
Windows 5.1.2600 Service Pack 3

2009-10-26 08:43:29
mbam-log-2009-10-26 (08-43-29).txt

Type de recherche: Examen complet (C:\|H:\|)
Eléments examinés: 214454
Temps écoulé: 1 hour(s), 13 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\WI1F86~1\MESSEN~1\msimg32.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\Ad-Remover\QUARANTINE\PROGRA~1\WI1F86~1\MESSEN~1\riched20.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{4E4566C4-540D-451E-8B75-34A919B382A7}\RP365\A0058845.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{4E4566C4-540D-451E-8B75-34A919B382A7}\RP365\A0058846.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

pimprenelle27 · Answer

les cracks sont souvent source de virus, donc il vaut mieux éviter dans télécharger où d'en ramener sur sont PC : 

Lire ceci : le danger des cracks


Ensuite pour vérifier qu'il n'y est pas de spyware, adware, trojans, vers, keylogger, hijacker, dialer et toutes autres menaces destinées au vol d'informations confidentielles


Télécharge Superantispyware (SAS)



Choisis "enregistrer" et enregistre-le sur ton bureau.

Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.

Créé une icône sur le bureau.

Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.

- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
- Sous Configuration and Préférences, clique sur le bouton "Préférences"
- Clique sur l'onglet "Scanning Control "
- Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :

Close browsers before scanning  (Fermer Navigateur avant le scan)

Scan for tracking cookies  (Scan pour dépister les cookies)

Terminate memory threats before quarantining (Terminez les menaces de mémoire avant de mettre en quarantaine)

- Laisse les autres lignes décochées.

- Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.

- Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".

Dans la colonne de gauche, coche C:\Fixed Drive.

Dans la colonne de droite, sous "Complète scan", clique sur "Perform Complète Scan"

Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.

A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.

Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".

Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.

Pour recopier les informations sur le forum, fais ceci :

- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Préférences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SuperAntiSpyware Scan Log.

- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.

- Copie son contenu dans ta réponse.


Regarde bien le tuto SuperAntiSpyware il est très bien expliqué.

moimoi · Answer

Voici le scan, la seule question ici tu disais : Terminate memory threats before quarantining (Terminez les menaces de mémoire avant de mettre en quarantaine) 

- Laisse les autres lignes décochées. 


c'est bien les laisser décochées ? Sur le tuto il n'en parlait pas....

MErci :)

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 10/26/2009 at 05:49 PM

Application Version : 4.29.1004

Core Rules Database Version : 4162
Trace Rules Database Version: 1978

Scan type       : Complete Scan
Total Scan Time : 02:14:23

Memory items scanned      : 358
Memory threats detected   : 0
Registry items scanned    : 4518
Registry threats detected : 0
File items scanned        : 106719
File threats detected     : 31

Adware.Tracking Cookie
	C:\Documents and Settings\David Despres\Cookies\david_despres@richmedia.yahoo[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@networldmedia[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@ad.yieldmanager[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@msnportal.112.2o7[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@nhl.112.2o7[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@canoe.112.2o7[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@apmebf[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@weborama[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@vitamine.networldmedia[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@doubleclick[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@bs.serving-sys[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@boursoramabanque.solution.weborama[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@videoegg.adbureau[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@serving-sys[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@ads.networldmedia[3].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@atdmt[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@adcentriconline[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@revsci[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@ads.networldmedia[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@ads.networldmedia[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@xiti[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@smartadserver[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@microsoftsto.112.2o7[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@content.yieldmanager[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@insightexpressai[2].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@advertising[1].txt
	C:\Documents and Settings\David Despres\Cookies\david_despres@mediaplex[2].txt
	C:\Documents and Settings\Cindy\Cookies\cindy@apmebf[1].txt
	C:\Documents and Settings\Cindy\Cookies\cindy@atdmt[2].txt
	C:\Documents and Settings\Cindy\Cookies\cindy@msnportal.112.2o7[1].txt
	C:\ToolBar SD\Backup-TB\DOCUME~1\DAVIDD~1\Cookies\david_despres@mywebsearch[1].txt

pimprenelle27 · Answer

Parfais supprime ce que SAS à trouvé, ensuite Vide la quarantaine et ensuite fait ceci : 

Faire un scan en ligne un scan en ligne avec Bitdefender Scan Online  afin de vérifier s'il reste encore des virus.

Veuillez vous rendre à cette adresse avec Internet Explorer :



Si vous êtes sous Vista (si vous avez XP ou 2000, passez à la suite), l’UAC doit être désactivée lors du scan.
Vous pouvez vous aider de ce lien pour désactiver l'UAC : http://www.bibou0007.com/tutos-f45/tutorial-desactiver-l-uac-sur-vista-t132.htm




1°) "Acceptez" l'accord de license :





2) Une nouvelle fenêtre apparait et affiche un message concernant un contrôle activeX :

# Sur cette page, une barre jaune apparait, faites un clic droit sur cette barre puis cliquez sur "Installer le contrôle activeX"

Voir cette image




3°) Une page d'avertissement s'ouvre, cliquez sur "Installer" :




4°) Ensuite la procédure de scan va pouvoir commencer. Cliquez sur "Démarrer l'analyse " Bitdefender va alors se mettre à jour et commencer (si cela se solde par un échec, veuillez alors recommencer car cela peut arriver) :






Soyez patient durant le scan, le temps indiqué n'est qu'une estimation.




5°) Le scan terminé, cliquez sur "Cliquer ici pour exporter le rapport" :




6°) Une page d'explorateur windows va alors s'ouvrir, nommez le rapport "Rapport Bitdefender " et enregistrez-le au format "HTML " sur le bureau :




7°) Ensuite, ouvrez le rapport de Bitdefender, rapport Bitdefender 2 maintenant présent sur votre bureau et faites un copier/coller sur votre forum.

moimoi · Answer

BitDefender Online Scanner
	

 
	

 

Rapport d'analyse généré à: Mon, Oct 26, 2009 - 21:18:42

 
	

 
	

 

Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;M:\;N:\;
	

 
	

 

 
	

 
	

 

Statistiques

Temps
	

00:48:32

Fichiers
	

97811

Directoires
	

8522

Secteurs de boot
	

0

Archives
	

961

Paquets programmes
	

12202
	

 
	

 

Résultats

Virus identifiés
	

2

Fichiers infectés
	

4

Fichiers suspects
	

0

Avertissements
	

0

Désinfectés
	

0

Fichiers effacés
	

4
	

 
	

 

Info sur les moteurs

Définition virus
	

4461650

Version des moteurs
	

AVCORE v2.1 Windows/i386 11.0.0.26 (Aug 27 2009)

Analyse des plugins
	

17

Archive des plugins
	

44

Unpack des plugins
	

8

E-mail plugins
	

6

Système plugins
	

4
	

 
	

 

Paramètres d'analyse

Première action
	

Désinfecté

Seconde Action
	

Supprimé

Heuristique
	

Oui

Acceptez les avertissements
	

Oui

Extensions analysées
	

exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions
	

 

Analyse d'emails
	

Oui

Analyse des Archives
	

Oui

Analyser paquets programmes
	

Oui

Analyse des fichiers
	

Oui

Analyse de boot
	

Oui
	

 
	

 
 

Fichier analysé
	

 Statut

C:\Documents and Settings\David Despres\Desktop\List_Killem.exe
	

Infecté par: DeepScan:Generic.Zlob.5A048607

C:\Documents and Settings\David Despres\Desktop\List_Killem.exe
	

Echec de la désinfection

C:\Documents and Settings\David Despres\Desktop\List_Killem.exe
	

Supprimé

C:\Documents and Settings\David Despres\Desktop\SmitfraudFix.exe
	

Infecté par: Trojan.Generic.1527266

C:\Documents and Settings\David Despres\Desktop\SmitfraudFix.exe
	

Supprimé

C:\System Volume Information\_restore{4E4566C4-540D-451E-8B75-34A919B382A7}\RP368\A0058965.exe
	

Infecté par: DeepScan:Generic.Zlob.5A048607

C:\System Volume Information\_restore{4E4566C4-540D-451E-8B75-34A919B382A7}\RP368\A0058965.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4E4566C4-540D-451E-8B75-34A919B382A7}\RP368\A0058965.exe
	

Supprimé

C:\System Volume Information\_restore{4E4566C4-540D-451E-8B75-34A919B382A7}\RP368\A0058966.exe
	

Infecté par: Trojan.Generic.1527266

C:\System Volume Information\_restore{4E4566C4-540D-451E-8B75-34A919B382A7}\RP368\A0058966.exe
	

Supprimé

pimprenelle27 · Answer

Parfais une dernière vérif  : 

Télécharge List&Kill'em (par Gen-Hackman) et enregistre l'exécutable sur ton bureau.

! Désactive ton antivirus le temps de la manip ainsi que ton Pare-feu si présent !

! Déconnecte toi ferme toutes tes applications en cours !

&#9654; Double-clic sur l'icône présente sur le bureau pour le lancer (sous vista : clic droit > "exécuter en tant qu'administrateur").

&#9654; Choisis la langue souhaitée et valide par "entrée".

&#9654; Au second menu choisis l'option 1 : Mode Recherche

&#9654; Laisse travailler l'outil.

&#9654; Une fois le scan Terminé ,un rapport s'ouvre .

 Ensuite héberger le rapport : 

&#x25B6;  Rendez-vous à cette adresse d'hébergement gratuit : http://www.cijoint.fr/

&#x25B6; Cliquez sur parcourir,  chercher le rapport .txt puis cliquez sur  ici pour déposer le fichier

&#x25B6; Une fois le lien crée, faite un clique droit dessus et copier l'adresse du lien pour venir le coller dans votre réponse

moimoi · Answer

http://www.cijoint.fr/cjlink.php?file=cj200910/cijVyLZtWe.txt

pimprenelle27 · Answer

Nettoyage :


! Déconnecte toi ferme toutes tes applications en cours !

    * Redémarrer ton PC en mode sans échec manuellement 
    * Tapez sur la touche F8 avant de voir apparaître la barre de progression, avant l'écran de logo Windows
    * Sélectionnez alors le mode sans échec sans prise en charge réseau et appuyez sur la touche entrée de votre clavier.



&#9654; Double-clic sur l'icône présente sur le bureau pour lancer List&Kill'em (sous vista : clic droit > "Exécuter en tant qu'administrateur").

&#9654; Choisis la langue souhaitée et valide par "entrée".

&#9654; Choisis cette fois ci l'option 2 : Mode Destruction

&#9654; Laisse travailler l'outil.

&#9654; Une fois Terminé , poste le contenu du 2éme rapport qui s'ouvre dans ta prochaine réponse.

Note: le Rapport sur trouve en outre a cet emplacement: C:\Kill'em.txt

sundae · Answer

humm est-ce que tout est beau  ? Ca ne donne pas un très gros rapport 



===============
Path : C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\QuickTime\QTSystem 
===============
¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe  
 
¤¤¤¤¤¤¤¤¤¤ C:\WINDOWS\Prefetch : 

Layout.ini
NTOSBOOT-B00DFAAD.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

moimoi · Answer

hummm je ne comprends pas pkoi ça changé de nick lol c'est bien moi ;)

pimprenelle27 · Answer

c'est la rapport de suppression ça, car il y aurait du y avoir ça : 

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat  
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat  
C:\WINDOWS\system32\404Fix.exe  
C:\WINDOWS\system32\dumphive.exe  
C:\WINDOWS\system32\IEDFix.exe  
C:\WINDOWS\system32\Process.exe  
C:\WINDOWS\system32\SrchSTS.exe  
C:\WINDOWS\system32	mp.reg  
C:\WINDOWS\system32\VACFix.exe  
C:\WINDOWS\system32\VCCLSID.exe  
C:\WINDOWS\system32\WS2Fix.exe  
C:\Documents and Settings\David Despres\LOCAL Settings\Temp\SSUPDATE.EXE

moimoi · Answer

c'est ça ??? 

Kill'em by g3n-h@ckm@n 1.0.4.7 
 
User : David Despres () # DAVID
Update on 27/10/2009 by g3n-h@ckm@n ::::: 11.30 
Start at: 19:36:29 | 2009-10-28
Contact : g3n-h@ckm@n sur CCM

              Intel(R) Pentium(R) 4 CPU 2.80GHz
Microsoft Windows XP Home Edition (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : AVG Anti-Virus Free 8.5 [ Enabled | Updated ]

A:\ -> 3 1/2 Inch Floppy Drive
C:\ -> Local Fixed Disk | 123,56 Go (45,36 Go free) | NTFS
D:\ -> Removable Disk
E:\ -> Removable Disk
F:\ -> Removable Disk
G:\ -> Removable Disk
H:\ -> Local Fixed Disk | 4,42 Go (3,15 Go free) [HP_RECOVERY] | FAT32
I:\ -> CD-ROM Disc
J:\ -> CD-ROM Disc | 73,57 Mo (0 Mo free) [DIR-615] | CDFS
K:\ -> Removable Disk
L:\ -> Removable Disk
M:\ -> Removable Disk
N:\ -> Removable Disk
O:\ -> CD-ROM Disc | 4,2 Mo (0 Mo free) [Read Me] | CDFS
P:\ -> Removable Disk | 2,81 Go (2,81 Go free) [Public] | FAT32
  
Fichiers analysés : 
================= 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat"  
"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat"  
"C:\WINDOWS\system32\404Fix.exe"  
"C:\WINDOWS\system32\dumphive.exe"  
"C:\WINDOWS\system32\IEDFix.exe"  
"C:\WINDOWS\system32\Process.exe"  
"C:\WINDOWS\system32\SrchSTS.exe"  
"C:\WINDOWS\system32	mp.reg"  
"C:\WINDOWS\system32\VACFix.exe"  
"C:\WINDOWS\system32\VCCLSID.exe"  
"C:\WINDOWS\system32\WS2Fix.exe"  
C:\Documents and Settings\David Despres\LOCAL Settings\Temp\SSUPDATE.EXE  
C:\Documents and Settings\David Despres\LOCAL Settings\Temp\wlsetup-cvr.exe  
 
 
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers : 
  
Quarantaine : 

404Fix.exe.Kill'em
dumphive.exe.Kill'em
IEDFix.exe.Kill'em
Process.exe.Kill'em
qmgr0.dat.Kill'em
qmgr1.dat.Kill'em
SrchSTS.exe.Kill'em
SSUPDATE.EXE.Kill'em
tmp.reg.Kill'em
VACFix.exe.Kill'em
VCCLSID.exe.Kill'em
wlsetup-cvr.exe.Kill'em
WS2Fix.exe.Kill'em

¤¤¤¤¤¤¤¤¤¤ Verification :

pimprenelle27 · Answer

Je préfère en effet ce rapport ci, tu peux donc me faire un dernier RSIT.

moimoi · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by David Despres at 2009-10-30 12:09:32
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 46 GB (37%) free of 127 GB
Total RAM: 511 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:48, on 2009-10-30
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\David Despres\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\David Despres.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [ActivateWindows] regedit.exe /s c:\windows\activate.regs
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IXRUBUKFHLC - Unknown owner - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\IXRUBUKFHLC.exe (file missing)
O23 - Service: XD - Unknown owner - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\XD.exe (file missing)

pimprenelle27 · Answer

Tu connais SpyHunter Security Suite?

ensuite il y a ces 2 lignes qui me paraisse bizarre : 

O23 - Service: IXRUBUKFHLC - Unknown owner - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\IXRUBUKFHLC.exe (file missing)
O23 - Service: XD - Unknown owner - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\XD.exe (file missing)


Pourrais tu donc me faire ceci : 

&#x25B6; Téléchargez Dr.Web CureIt! sur ton Bureau :



&#x25B6; Double-cliquez sur drweb-cureit.exe et cliquez sur Commencer le scan.
 
&#x25B6; Ce scan rapide permet l'analyse des processus chargés en mémoire; s'il trouve des processus infectés, cliquez sur le bouton Oui pour Tout à l'invite.

&#x25B6; Lorsque le scan rapide est terminé, cliquez sur Options > Changer la configuration.

&#x25B6; Choisissez l'onglet Scanner, et décochez Analyse heuristique.

&#x25B6; De retour à la fenêtre principale : choisissez Analyse complète.

&#x25B6; Cliquez la flèche verte sur la droite et le scan débutera. Une publicité apparaît quelquefois, fermez-la.

&#x25B6; Cliquez Oui pour Tout si un fichier est détecté.

&#x25B6; A la fin du scan, si des infections sont trouvées, cliquez sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, cliquez sur Quarantaine.

&#x25B6; Au menu principal de l'outil, en haut à gauche, cliquez sur le menu Fichier et choisissez Enregistrer le rapport.

&#x25B6; Sauvegardez le rapport sur votre Bureau. Ce dernier se nommera DrWeb.csv.

&#x25B6; Fermez Dr.Web CureIt!

&#x25B6; Redémarrez votre ordinateur (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.


&#x25B6; Postez (Copiez/Collez) le contenu du rapport de l'outil Dr.Web dans un bloc note

 Ensuite : 

&#x25B6;  Rendez-vous à cette adresse d'hébergement gratuit : http://www.cijoint.fr/

&#x25B6; Cliquez sur parcourir, chercher rapport DrWeb.txt  puis sur  cliquez ici pour déposer le fichier

&#x25B6; Une fois le lien crée, faite un clique droit dessus et copier l'adresse du lien pour venir le coller dans votre réponse

moimoi · Answer

http://www.cijoint.fr/cjlink.php?file=cj200911/cijekd4T0O.txt 

voilà :)

pimprenelle27 · Answer

Parfais tu eux aller vider la quarantaine de DR web dans le dossier DR Web.


Tu n'as pas répond à mes questions?

Tu connais SpyHunter Security Suite?

ensuite il y a ces 2 lignes qui me paraisse bizarre :

O23 - Service: IXRUBUKFHLC - Unknown owner - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\IXRUBUKFHLC.exe (file missing)
O23 - Service: XD - Unknown owner - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\XD.exe (file missing)

pimprenelle27 · Answer

Tu es trop fort Noni, c'est du n'importe quoi, merci.

moimoi · Answer

Elle est où la quarantaine je ne trouve pas :( 

Et puis ca me dit de quoi le programme SpyHunter Security Suite mais je ne l'utlise pas, je ne connais pas

pimprenelle27 · Answer

supprime le programme spyhunter dans ajout et suppression de programme pour la quarantaine dr web, regarde dans le dossier créé dr web.

moimoi · Answer

Voilà c'est fait pour la quarantaine et pour spyhunter

Pour les 2 lignes que tu trouves bizarres je fais quoi ?

moimoi · Answer

Euh finalement pour spyhuntyer non ce n'est pas fait ! Il n'est pas là ?!?!??! je ne le trouve pas ! J'ai même fait une recherche et il ne l'a jamais trouvé !

moimoi · Answer

J'ai vu plus haut que il était là : [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite] 
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe [2008-09-10 864256] 

ce pourrait-il que DR web l'avait mis en quarantaine ? car impossible de le trouver !

pimprenelle27 · Answer

tu vois bien que là il n'y a pas de spyhunter : https://forums.commentcamarche.net/forum/affich-14753661-infecte-par-un-spyware?page=6#106

moimoi · Answer

euh je ne suis pas certaine de comprendre lol 

Tu disais par la suite... 

Supprime le programme spyhunter dans ajout et suppression de programme pour la quarantaine dr web, regarde dans le dossier créé dr web. 

Mais il n'est plus là ! J'essaie de le trouver dans mon pc et impossible j'en déduis donc que tout est ok il n'y est plus. 

ensuite mon pc est ok où il y a encore qque chose à faire ?

pimprenelle27 · Answer

Refais moi un RSIt et on a finir.

moimoi · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by David Despres at 2009-11-20 18:52:22
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 45 GB (35%) free of 127 GB
Total RAM: 511 MB (23% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:52:36, on 2009-11-20
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\David Despres\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\David Despres.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [ActivateWindows] regedit.exe /s c:\windows\activate.regs
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-21-1606980848-1303643608-725345543-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Cindy')
O4 - HKUS\S-1-5-21-1606980848-1303643608-725345543-1006\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Cindy')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IXRUBUKFHLC - Unknown owner - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\IXRUBUKFHLC.exe (file missing)
O23 - Service: XD - Unknown owner - C:\DOCUME~1\DAVIDD~1\LOCALS~1\Temp\XD.exe (file missing)

pimprenelle27 · Answer

y encore des choses à supprimer : 

    *  Télécharge UsbFix et enregistre-le sur ton bureau
    * tutoriel recherche
    * Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d'avoir été infectés sans les ouvrir
    * Double clic sur le raccourci UsbFix sur ton bureau, l'installation se fera automatiquement
    * Choisi l'option 1 (recherche)
    * Laisse travailler l'outil
    * Ensuite post le rapport UsbFix.txt qui apparaîtra
    * Note : le rapport UsbFix.txt est sauvegardé a la racine du disque

* Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus

pimprenelle27 · Answer

une fois usb fix fait, tu fera ceci : 

&#x25B6; Télécharge OTM (de Old_Timer) sur ton Bureau
 
&#x25B6; Double-clique sur OTM.exe pour le lancer.

&#x25B6; Assure toi que la case Unregister Dll's and Ocx's soit bien cochée.

&#x25B6; Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTM sous "Paste instructions for item to be moved".

-----------------------------------------------------------------------------

:Reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\drivers\svchost.exe"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\drivers\svchost.exe"=-

:files
C:\Program Files\Enigma Software Group\SpyHunter

:Services
IXRUBUKFHLC
XD

:commands
[emptytemp]
[reboot]

-----------------------------------------------------------------------------

&#x25B6; clique sur MoveIt! pour lancer la suppression.

&#x25B6; Le résultat apparaitra dans le cadre "Results".

&#x25B6; Clique sur Exit pour fermer.

&#x25B6; Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

&#x25B6; Il te sera peut-être demandé de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

Infecté par un spyware

115 réponses

Newsletters