nettoyage pc avec pub intempestives

Question

Bonjour,

quand je suis sur mon pc, j'ai des fenêtres de publicité intempestives qui s'ouvrent.
Surtout "cid"

Merci de m'aider à nettoyer.

toptitbal · Answer

Bonsoir

• Télécharge Random's System Information Tool (RSIT) de Random / Random et sauvegarde-le sur ton Bureau, 

-> http://images.malwareremoval.com/random/RSIT.exe

• Double-clique sur RSIT.exe pour lancer le programme, 
• Clique sur continuer sur l'écran Disclaimer, 
• Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence. 
• Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
Ferme info.txt (<<qui sera réduit dans la Barre des Tâches), il ne te sera demandé qu’en cas de besoin. 

Tuto si besoin : https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm

australe13 · Answer

bonsoir top

Merci de me répondre.
C'est pas mon pc, c'est celui d'un ami.
Je te poste ça de suite

australe13 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jean-Claude at 2009-10-16 22:02:34
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 90 GB (60%) free of 149 GB
Total RAM: 767 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:02:57, on 16/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\DialMessenger\dialmessenger.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\NavNTtvscan.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Labtec\Desktop\6.0\KbdAp32A.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Labtec\Desktop\6.0\MOffice.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Labtec\Desktop\6.0\Mouse32V.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Microsoft Money\Systememinder.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jean-Claude\Bureau\RSIT.exe
C:\Program Files	rend micro\Jean-Claude.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program filesealealplayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe"  -osboot
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [WATCHPNP_Xerox] watchPnp.exe Xerox
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Itch ford four knob] C:\Documents and Settings\All Users\Application Data	hird lies itch ford\Send Clock.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DialMessenger] "C:\Program Files\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [smgqawmq] c:\documents and settings\jean-claude\local settings\application data\smgqawmq.exe smgqawmq
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\Systememinder.exe
O4 - HKCU\..\Run: [morewin] C:\DOCUME~1\JEAN-C~1\APPLIC~1\GRAMVI~1\mpeg heck.exe
O4 - HKCU\..\Run: [LWBKEYBOARD] "C:\Program Files\Labtec\Desktop\6.0\KbdAp32A.exe"
O4 - HKCU\..\Run: [LWBMOUSE] "C:\Program Files\Labtec\Desktop\6.0\MOffice.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Numérisation PC.lnk = C:\WINDOWS\ScanToPc.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?0b14af403a51488092593bd3e9b1656a
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?0b14af403a51488092593bd3e9b1656a
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: rdihost - {9BE78AF5-2754-4112-B77C-3C5B59C056D2} - (no file)
O21 - SSODL: system32 - {A50E5B30-EFBE-405F-9D49-8CA5AFC51026} - sysprinters.dll (file missing)
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9b99de29aef2) (gupdate1c9b99de29aef2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNTtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

toptitbal · Answer

Y'a du boulot !

On commence : 

Télécharge Lop S&D.exe sur ton Bureau.

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 

* Double-clique dessus pour lancer l'installation 
* Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau 
* Séléctionne la langue souhaitée, puis choisis l'option 1 (Recherche) 
* Patiente jusqu'à la fin du scan 
* Poste le rapport généré (C:\lopR.txt) 


Tutorial (aide) : http://bibou0007.com/outils-specifiques-f78/tuto-lop-sd-t956.htm

australe13 · Answer

voilà :


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ )
   BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
   USER : Jean-Claude ( Administrator )
   BOOT : Normal boot
   Antivirus : Symantec AntiVirus Corporate Edition 10.0.1.1000 (Activated)
   C:\ (Local Disk) - NTFS - Total:145 Go (Free:88 Go)
   D:\ (Local Disk) - FAT32 - Total:146 Go (Free:146 Go)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 16/10/2009|22:15 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [30/09/2006|10:18] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [30/09/2006|10:18] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
   [30/09/2006|10:18] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [07/06/2008|09:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Acronis
   [29/04/2009|08:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [04/08/2007|15:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [23/11/2006|20:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [23/02/2009|12:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [04/09/2009|18:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [21/01/2009|09:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
   [17/12/2006|19:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [01/12/2006|22:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [21/03/2009|10:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [19/05/2008|19:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [04/04/2007|19:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NtiDvdCopy
   [10/09/2009|12:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\POLL MAPI STYLE MODE
   [14/10/2009|09:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
   [04/12/2006|19:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
   [01/06/2007|17:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [10/09/2009|12:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1	hird lies itch ford
   [06/12/2006|18:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [02/12/2006|00:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
   [16/03/2008|09:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [01/12/2006|11:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

   [30/09/2006|10:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [30/09/2006|10:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
   [30/09/2006|10:18] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [12/04/2008|08:52] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Adobe
   [25/05/2008|07:04] C:\DOCUME~1\JEAN-C~1\APPLIC~1\AdobeUM
   [05/06/2009|10:10] C:\DOCUME~1\JEAN-C~1\APPLIC~1\AdSigner
   [05/09/2007|23:42] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Ahead
   [05/09/2007|23:33] C:\DOCUME~1\JEAN-C~1\APPLIC~1\CyberLink
   [19/09/2007|03:48] C:\DOCUME~1\JEAN-C~1\APPLIC~1\DialMessenger
   [13/03/2007|19:33] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Google
   [10/09/2009|12:54] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4
   [04/04/2007|18:56] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Help
   [30/09/2006|10:18] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Identities
   [03/09/2007|15:04] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Leadertech
   [04/09/2007|09:58] C:\DOCUME~1\JEAN-C~1\APPLIC~1\LimeWire
   [25/04/2008|22:06] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Macromedia
   [01/12/2006|13:37] C:\DOCUME~1\JEAN-C~1\APPLIC~1\MAGIX
   [01/07/2009|19:49] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Microsoft
   [04/12/2006|19:23] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Microsoft Web Folders
   [05/02/2007|20:28] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Mozilla
   [19/05/2008|19:09] C:\DOCUME~1\JEAN-C~1\APPLIC~1\MSN6
   [01/12/2006|19:07] C:\DOCUME~1\JEAN-C~1\APPLIC~1\MSNInstaller
   [14/10/2009|09:51] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Real
   [07/01/2007|18:25] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Sun
   [13/03/2007|20:53] C:\DOCUME~1\JEAN-C~1\APPLIC~1\Talkback
   [27/05/2008|09:55] C:\DOCUME~1\JEAN-C~1\APPLIC~1\TaoUSign
   [26/04/2008|15:54] C:\DOCUME~1\JEAN-C~1\APPLIC~1\vlc
   [06/03/2008|20:36] C:\DOCUME~1\JEAN-C~1\APPLIC~1\WinRAR

   [19/05/2008|20:24] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
   [10/08/2009|10:04] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
   [21/01/2009|10:01] C:\DOCUME~1\LOCALS~1\APPLIC~1\Gram View 4
   [27/01/2008|21:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [10/08/2009|10:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [17/03/2007|20:37] C:\DOCUME~1\MGANE~1\APPLIC~1\Adobe
   [03/01/2007|17:49] C:\DOCUME~1\MGANE~1\APPLIC~1\AdobeUM
   [05/10/2007|22:19] C:\DOCUME~1\MGANE~1\APPLIC~1\Google
   [21/06/2009|11:18] C:\DOCUME~1\MGANE~1\APPLIC~1\Gram View 4
   [30/09/2006|10:18] C:\DOCUME~1\MGANE~1\APPLIC~1\Identities
   [22/04/2007|15:41] C:\DOCUME~1\MGANE~1\APPLIC~1\Leadertech
   [21/06/2009|10:58] C:\DOCUME~1\MGANE~1\APPLIC~1\LimeWire
   [30/09/2006|10:18] C:\DOCUME~1\MGANE~1\APPLIC~1\Macromedia
   [25/11/2006|15:08] C:\DOCUME~1\MGANE~1\APPLIC~1\MAGIX
   [21/08/2009|19:15] C:\DOCUME~1\MGANE~1\APPLIC~1\Microsoft
   [14/02/2007|18:39] C:\DOCUME~1\MGANE~1\APPLIC~1\Mozilla
   [01/12/2006|18:58] C:\DOCUME~1\MGANE~1\APPLIC~1\MSNInstaller
   [16/02/2007|23:13] C:\DOCUME~1\MGANE~1\APPLIC~1\Real
   [08/04/2007|09:46] C:\DOCUME~1\MGANE~1\APPLIC~1\Screenshot Sender
   [02/02/2007|23:31] C:\DOCUME~1\MGANE~1\APPLIC~1\Sun
   [18/03/2007|14:33] C:\DOCUME~1\MGANE~1\APPLIC~1\Talkback

   [30/09/2006|10:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [16/10/2009 21:32][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineUA.job
   [16/10/2009 20:32][--a------] C:\WINDOWS	asks\GoogleUpdateTaskMachineCore.job
   [16/10/2009 16:22][--ah-----] C:\WINDOWS	asks\User_Feed_Synchronization-{AF4D67A6-BBDE-454F-9A05-57DDBBC7F51E}.job
   [15/10/2009 19:11][--ah-----] C:\WINDOWS	asks\SA.DAT
   [10/08/2004 22:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  MsgPlus SPONSOR INSTALLED !

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MsgPlus! Plugin]
   "DisplayName"="Messenger Plus! 3 & Sponsor"


   --------------------\  Listing des dossiers dans C:\Program Files

   [30/09/2006|10:19] C:\Program Files\Acer WLAN 11g USB Dongle
   [07/06/2008|09:06] C:\Program Files\Acronis
   [29/04/2009|08:31] C:\Program Files\Adobe
   [04/08/2007|16:00] C:\Program Files\Ahead
   [30/09/2006|10:19] C:\Program Files\commercial
   [11/08/2006|19:27] C:\Program Files\ComPlus Applications
   [30/09/2006|10:19] C:\Program Files\CyberLink
   [19/09/2007|03:48] C:\Program Files\DialMessenger
   [30/09/2006|10:19] C:\Program Files\DIFX
   [08/05/2007|18:04] C:\Program Files\Electronic Arts
   [13/10/2007|23:13] C:\Program Files\eMule
   [22/04/2007|15:37] C:\Program Files\Examaids
   [14/10/2009|09:49] C:\Program Files\Fichiers communs
   [30/09/2006|10:19] C:\Program Files\FrenchOtto
   [30/09/2006|10:19] C:\Program Files\GemMasterFrench
   [31/05/2009|11:16] C:\Program Files\Google
   [10/09/2009|12:53] C:\Program Files\Gram View 4
   [26/08/2007|20:19] C:\Program Files\Incomplete
   [13/03/2007|19:33] C:\Program Files\InstallShield Installation Information
   [14/10/2009|09:30] C:\Program Files\Internet Explorer
   [07/08/2009|10:37] C:\Program Files\Java
   [19/06/2009|16:09] C:\Program Files\Labtec
   [13/03/2007|19:31] C:\Program Files\Lavasoft
   [22/09/2007|14:10] C:\Program Files\LimeWire
   [21/01/2009|09:28] C:\Program Files\Logitech
   [09/09/2008|08:07] C:\Program Files\Messenger
   [27/07/2009|13:52] C:\Program Files\Messenger Plus! Live
   [01/12/2006|22:17] C:\Program Files\MessengerPlus! 3
   [07/02/2007|19:17] C:\Program Files\Micro Application
   [28/06/2009|15:39] C:\Program Files\Microsoft
   [11/05/2007|17:31] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [04/12/2006|19:29] C:\Program Files\microsoft frontpage
   [09/07/2008|09:48] C:\Program Files\Microsoft Money
   [04/12/2006|19:31] C:\Program Files\Microsoft Office
   [11/09/2009|10:33] C:\Program Files\Microsoft Silverlight
   [28/06/2009|15:40] C:\Program Files\Microsoft SQL Server Compact Edition
   [28/06/2009|15:41] C:\Program Files\Microsoft Sync Framework
   [04/12/2006|19:26] C:\Program Files\Microsoft Visual Studio
   [09/09/2008|08:04] C:\Program Files\Movie Maker
   [16/10/2009|22:00] C:\Program Files\Mozilla Firefox
   [09/08/2009|11:08] C:\Program Files\MSBuild
   [04/11/2008|20:17] C:\Program Files\MSECACHE
   [25/11/2006|12:48] C:\Program Files\MSN
   [30/09/2006|10:19] C:\Program Files\MSN Gaming Zone
   [01/12/2006|11:58] C:\Program Files\MSXML 4.0
   [07/03/2007|17:50] C:\Program Files\NavNT
   [09/09/2008|08:01] C:\Program Files\NetMeeting
   [30/11/2006|21:41] C:\Program Files\Neuf
   [30/09/2006|10:19] C:\Program Files\NewTech Infosystems
   [30/09/2006|10:19] C:\Program Files\Oca History Tool
   [30/09/2006|10:19] C:\Program Files\Online Services
   [14/08/2009|10:13] C:\Program Files\Outlook Express
   [15/03/2007|22:32] C:\Program Files\Picasa2
   [05/02/2007|20:22] C:\Program Files\Real
   [30/09/2006|10:19] C:\Program Files\Realtek
   [09/08/2009|11:08] C:\Program Files\Reference Assemblies
   [30/09/2006|10:20] C:\Program Files\Services en ligne
   [04/12/2006|19:30] C:\Program Files\Snapshot Viewer
   [08/03/2007|10:11] C:\Program Files\Softwin
   [20/08/2009|12:56] C:\Program Files\Steam
   [01/06/2007|17:18] C:\Program Files\Symantec
   [15/10/2009|19:17] C:\Program Files\Symantec AntiVirus
   [16/10/2009|22:02] C:\Program Files	rend micro
   [11/08/2006|19:40] C:\Program Files\Uninstall Information
   [26/04/2008|15:54] C:\Program Files\VideoLAN
   [08/05/2009|19:59] C:\Program Files\VirtualDJ
   [15/10/2009|19:08] C:\Program Files\Windows Live
   [28/06/2009|15:38] C:\Program Files\Windows Live SkyDrive
   [28/06/2009|15:41] C:\Program Files\Windows Live Toolbar
   [24/12/2006|10:07] C:\Program Files\Windows Media Connect 2
   [24/12/2006|10:07] C:\Program Files\Windows Media Player
   [09/09/2008|08:01] C:\Program Files\Windows NT
   [30/09/2006|10:20] C:\Program Files\Windows Plus
   [11/08/2006|19:28] C:\Program Files\WindowsUpdate
   [06/03/2008|20:36] C:\Program Files\WinRAR
   [11/05/2007|17:37] C:\Program Files\xerox
   [04/07/2009|11:45] C:\Program Files\Xerox WorkCentre Pro 412
   [23/11/2006|20:27] C:\Program Files\Yahoo!
   [09/04/2008|20:20] C:\Program Files\YesMessenger

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [07/06/2008|09:06] C:\Program Files\Fichiers communs\Acronis
   [29/04/2009|08:31] C:\Program Files\Fichiers communs\Adobe
   [04/08/2007|15:59] C:\Program Files\Fichiers communs\Ahead
   [04/12/2006|19:26] C:\Program Files\Fichiers communs\Designer
   [07/02/2007|19:19] C:\Program Files\Fichiers communs\GIS
   [30/09/2006|10:19] C:\Program Files\Fichiers communs\InstallShield
   [23/11/2006|20:20] C:\Program Files\Fichiers communs\Java
   [30/09/2006|10:19] C:\Program Files\Fichiers communs\LightScribe
   [21/01/2009|09:31] C:\Program Files\Fichiers communs\LogiShrd
   [02/11/2007|09:17] C:\Program Files\Fichiers communs\Logitech
   [07/02/2007|19:19] C:\Program Files\Fichiers communs\mapserv
   [05/03/2009|08:41] C:\Program Files\Fichiers communs\Microsoft Shared
   [30/09/2006|10:19] C:\Program Files\Fichiers communs\MSSoap
   [30/09/2006|10:19] C:\Program Files\Fichiers communs\muvee Technologies
   [04/08/2007|16:00] C:\Program Files\Fichiers communs\Nero
   [30/09/2006|10:19] C:\Program Files\Fichiers communs\NewTech Infosystems
   [30/09/2006|10:19] C:\Program Files\Fichiers communs\ODBC
   [14/10/2009|09:50] C:\Program Files\Fichiers communs\Real
   [30/09/2006|10:19] C:\Program Files\Fichiers communs\Services
   [13/03/2007|18:30] C:\Program Files\Fichiers communs\Softwin
   [30/09/2006|10:19] C:\Program Files\Fichiers communs\SpeechEngines
   [01/06/2007|17:17] C:\Program Files\Fichiers communs\Symantec Shared
   [09/09/2008|08:01] C:\Program Files\Fichiers communs\System
   [28/06/2009|15:28] C:\Program Files\Fichiers communs\Windows Live
   [16/03/2008|09:44] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [14/10/2009|09:49] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 77 Processes )

   IEXPLORE.EXE ~ [PID:2052]
   IEXPLORE.EXE ~ [PID:2840]
   IEXPLORE.EXE ~ [PID:5808]
   IEXPLORE.EXE ~ [PID:5192]

   --------------------\  Recherche avec S_Lop

   C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp\bis4B.exe
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4
   C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4\csmflhyw.exe
   C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4\kfpepgcf.exe
   C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4\kmadqxep.exe
   C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4\ktwjygog.exe
   C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4\meetonegrim.exe
   C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4\mpeg heck.exe
   C:\DOCUME~1\JEAN-C~1\APPLIC~1\Gram View 4\uploadsettingsfacehole.exe
   C:\DOCUME~1\LOCALS~1\APPLIC~1\Gram View 4
   C:\DOCUME~1\MGANE~1\APPLIC~1\Gram View 4
   C:\DOCUME~1\MGANE~1\APPLIC~1\Gram View 4\mpeg heck.exe
   C:\DOCUME~1\MGANE~1\APPLIC~1\Gram View 4\oobpcxhj.exe
   C:\Program Files\Gram View 4
   C:\DOCUME~1\ALLUSE~1\APPLIC~1	hird lies itch ford
   C:\DOCUME~1\ALLUSE~1\APPLIC~1	hird lies itch ford\Send Clock.dat
   C:\DOCUME~1\ALLUSE~1\APPLIC~1	hird lies itch ford\Send Clock.exe
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp\sta105.exe
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp\sta16C.exe
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp\sta5D7.exe
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp\sta8D4.exe
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@advertstream[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@www.adserver5[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@advertising[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@adin.bigpoint[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@bigpoint[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@fr.deepolis.bigpoint[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@fr1.seafight.bigpoint[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@banner.casinoking[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@casinoking[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@banner.cotedazurpalace[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@cotedazurpalace[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@www.cotedazurpalace[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@adopt.euroclick[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@sr2.livemediasrv[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@sr2.livemediasrv[3].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@pacificpoker[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@pacificpoker[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@partygaming.122.2o7[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@partypoker[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@partypoker[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@fr1.seafight.bigpoint[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@32vegas[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@banner.32vegas[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@www.lop[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@2xmoinscher[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@www.2xmoinscher[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@888[1].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@888[2].txt
   C:\DOCUME~1\JEAN-C~1\Cookies\jean-claude@888[4].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "Itch ford four knob"="C:\Documents and Settings\All Users\Application Data\third lies itch ford\Send Clock.exe"

   --------------------\  Verification du fichier Hosts

   Fichier Hosts MODIFIE

   127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD

   -> 72 [ 1 ## added by CiD ]

   /!\ 70 Not 127.0.0.1  !!

   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-10-16 22:16:31
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 67
 
   --------------------\  Recherche d'autres infections

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "smgqawmq"="c:\documents and settings\jean-claude\local settings\application data\smgqawmq.exe smgqawmq"

   C:\DOCUME~1\JEAN-C~1\Bureau\SudoPlanet.lnk
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp\Pack.epk
 
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\APPLIC~1\smgqawmq.dat
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\APPLIC~1\smgqawmq_nav.dat
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\APPLIC~1\smgqawmq_navps.dat
   C:\DOCUME~1\JEAN-C~1\LOCALS~1\APPLIC~1\zhnhriz_navfx.dat
   [b]==> EGDACCESS <==/b

   --------------------\  Suspect ..

   C:\Photoshop_album_SE_3_0_FR.zip
   C:\Photoshop_album_SE_3_0_FR.zip



   [F:2318][D:363]-> C:\DOCUME~1\JEAN-C~1\LOCALS~1\Temp
   [F:470][D:0]-> C:\DOCUME~1\JEAN-C~1\Cookies
   [F:4548][D:63]-> C:\DOCUME~1\JEAN-C~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 16/10/2009|22:18 - Option : [1]

   --------------------\  Fin du rapport a 22:18:53

toptitbal · Answer

Relance Lop S&D 


* Choisis cette fois ci l'Option 2 (Suppression) 

* Ne ferme pas la fenêtre lors de la suppression ! 

* Poste le rapport généré (C:\lopR.txt)

toptitbal · Answer

OK, on continue :

Télécharge Navilog1 (par IL-MAFIOSO) sur ton bureau 

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

 
Double Clique sur le raccourci Navilog1 présent sur le bureau.

Laisse-toi guider. Appuie sur une touche quand on te le demande. 
Au menu principal, choisis 1 et valide. 

< Ne fais pas le choix 2  >

Patiente le temps du scan. Il te sera peut-être demandé de redémarrer ton PC.
Laisse l'outil le faire automatiquement, sinon redémarre ton PC normalement s'il te le demande.

Patiente jusqu'au message "Scan terminé le......"
Appuie sur une touche comme demandé ; le bloc-notes va s'ouvrir. 
Copie-colle l'intégralité dans ta réponse. Referme le bloc-notes. 

PS : le rapport est, aussi, sauvegardé à la racine du disque dur C:\cleannavi.txt

australe13 · Answer

voilà le rapport navilog
Fix Navipromo version 4.0.3 commencé le 16/10/2009 22:42:53.95

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 13.10.2009 à 19h00 par IL-MAFIOSO

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : Jean-Claude ( Administrator )
BOOT : Normal boot

Antivirus : Symantec AntiVirus Corporate Edition 10.0.1.1000 (Activated)


C:\ (Local Disk) - NTFS - Total:145 Go (Free:88 Go)
D:\ (Local Disk) - FAT32 - Total:146 Go (Free:146 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)


Recherche executée en mode normal 

Nettoyage exécuté au redémarrage de l'ordinateur


c:\docume~1\jean-c~1\menudm~1\progra~1\SudoPlanet supprimé !
c:\docume~1\jean-c~1\bureau\SudoPlanet.lnk supprimé !
C:\Documents and Settings\Jean-Claude\locals~1\Temp\pack.epk supprimé !
c:\docume~1\jean-c~1\locals~1\applic~1\smgqawmq.dat supprimé !
c:\docume~1\jean-c~1\locals~1\applic~1\smgqawmq_nav.dat supprimé !
c:\docume~1\jean-c~1\locals~1\applic~1\smgqawmq_navps.dat supprimé !
c:\docume~1\jean-c~1\locals~1\applic~1\zhnhriz_navfx.dat supprimé !


Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Jean-Claude\locals~1\Temp effectué !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat OOO-Favorit supprimé !



*** Scan terminé 16/10/2009 23:04:34.82 ***

Merci à demain pour la suite.
Bonne soirée

toptitbal · Answer

Parfait pour l'infection navipromo.

Ce dossier : C:\Documents and Settings\All Users\Application Data\POLL MAPI STYLE MODE 
fait partie de l'infection Lop et n'a pas été supprimé, supprime-le manuellement.

Ensuite, fais un nouveau RSIT stp.

australe13 · Answer

Voilà le nouveau rapport RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jean-Claude at 2009-10-17 20:34:12
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 91 GB (61%) free of 149 GB
Total RAM: 767 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:34:20, on 17/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\NavNTtvscan.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DialMessenger\dialmessenger.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Labtec\Desktop\6.0\KbdAp32A.exe
C:\Program Files\Labtec\Desktop\6.0\MOffice.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Labtec\Desktop\6.0\Mouse32V.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Microsoft Money\Systememinder.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jean-Claude\Bureau\RSIT.exe
C:\Program Files	rend micro\Jean-Claude.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.broadcom.com/support/security-center
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program filesealealplayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe"  -osboot
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [WATCHPNP_Xerox] watchPnp.exe Xerox
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DialMessenger] "C:\Program Files\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\Systememinder.exe
O4 - HKCU\..\Run: [morewin] C:\DOCUME~1\JEAN-C~1\APPLIC~1\GRAMVI~1\mpeg heck.exe
O4 - HKCU\..\Run: [LWBKEYBOARD] "C:\Program Files\Labtec\Desktop\6.0\KbdAp32A.exe"
O4 - HKCU\..\Run: [LWBMOUSE] "C:\Program Files\Labtec\Desktop\6.0\MOffice.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Numérisation PC.lnk = C:\WINDOWS\ScanToPc.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?0b14af403a51488092593bd3e9b1656a
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?0b14af403a51488092593bd3e9b1656a
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: rdihost - {9BE78AF5-2754-4112-B77C-3C5B59C056D2} - (no file)
O21 - SSODL: system32 - {A50E5B30-EFBE-405F-9D49-8CA5AFC51026} - sysprinters.dll (file missing)
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9b99de29aef2) (gupdate1c9b99de29aef2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNTtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

toptitbal · Answer

C'est déjà un peu plus propre.

On va traiter une autre infection et on vérifiera autrement ensuite pour ce dossier.

Télécharge UsbFix  de chiquitine29 sur ton bureau

http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe 


--> Lance l installation avec les paramètres par défaut 

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir 

--> Double clic sur le raccourci UsbFix sur ton bureau 

--> Au menu principal choisis l'option " F " pour français et tape sur [entrée]

--> Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

--> Laisse travailler l’outil 

-->Poste le rapport UsbFix.txt 

Note : le rapport UsbFix.txt est sauvegardé a la racine du disque 

Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valide.

australe13 · Answer

bonjour top

voici le rapport 


############################## | UsbFix V6.044 |

User : Jean-Claude (Administrateurs) # ALBARETJC
Update on 22/10/2009 by Chiquitine29, C_XX & Chimay8
Start at: 18:56:51 | 22/10/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Athlon(tm) 64 X2 Dual Core Processor 4200+
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Symantec AntiVirus Corporate Edition 10.0.1.1000 [ Enabled | Updated ]

C:\ -> Disque fixe local # 145.88 Go (88.53 Go free) [ACER] # NTFS
D:\ -> Disque fixe local # 146.32 Go (146.31 Go free) [ACERDATA] # FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\NavNTtvscan.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DialMessenger\dialmessenger.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Labtec\Desktop\6.0\KbdAp32A.exe
C:\Program Files\Labtec\Desktop\6.0\MOffice.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Labtec\Desktop\6.0\Mouse32V.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Microsoft Money\Systememinder.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

C:\WINDOWS\system32\autorun.ini 

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{0d81e430-46ba-11dc-93de-001921581aa7}
Shell\AutoRun\command =ie.exe 
Shell\explore\Command =ie.exe 
Shell\open\Command =ie.exe 

HKCU\..\..\Explorer\MountPoints2\{38ee9d2d-54ae-11dd-9572-001921581aa7}
Shell\AutoRun\command =K:\setupSNK.exe 

HKCU\..\..\Explorer\MountPoints2\{c7b09ffa-d7e8-11dd-95a1-001921581aa7}
Shell\AutoRun\command =C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

HKCU\..\..\Explorer\MountPoints2\{d11d47c9-25c5-11dd-952e-001921581aa7}
Shell\AutoRun\command =K:\setupSNK.exe 

################## | Suspect | https://www.virustotal.com/gui/ |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # UsbFix V6.044 ! |

toptitbal · Answer

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d’avoir été infectés sans les ouvrir

# Double clique sur le raccourci UsbFix présent sur ton bureau

# Au menu principal choisis l'option " F " pour français et tape sur [entrée]

# choisi l’option 2 ( Suppression )

# Ton bureau disparaîtra et le pc redémarrera .

# Au redémarrage, UsbFix scannera ton pc, laisse travailler l’outil.

# Ensuite poste le rapport UsbFix.txt qui apparaîtra avec le bureau .

# Note : Le rapport UsbFix.txt est sauvegardé à la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

australe13 · Answer

voilà


############################## | UsbFix V6.044 |

User : Jean-Claude (Administrateurs) # ALBARETJC
Update on 22/10/2009 by Chiquitine29, C_XX & Chimay8
Start at: 19:26:34 | 22/10/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Athlon(tm) 64 X2 Dual Core Processor 4200+
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Symantec AntiVirus Corporate Edition 10.0.1.1000 [ Enabled | Updated ]

C:\ -> Disque fixe local # 145.88 Go (88.58 Go free) [ACER] # NTFS
D:\ -> Disque fixe local # 146.32 Go (146.31 Go free) [ACERDATA] # FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\NavNTtvscan.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\Userinit.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\WINDOWS\system32\autorun.ini 

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{0d81e430-46ba-11dc-93de-001921581aa7}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{38ee9d2d-54ae-11dd-9572-001921581aa7}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{c7b09ffa-d7e8-11dd-95a1-001921581aa7}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{d11d47c9-25c5-11dd-952e-001921581aa7}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[11/08/2006 19:52|--a------|50] C:\AUTOEXEC.BAT 
[23/11/2006 20:18|--ahs----|221] C:\boot.ini 
[10/08/2004 22:00|-rahs----|4952] C:\Bootfont.bin 
[16/10/2009 23:04|--a------|1831] C:\cleannavi.txt 
[11/08/2006 19:29|--a------|0] C:\CONFIG.SYS 
[?|?|?] C:\hiberfil.sys 
[11/08/2006 19:29|-rahs----|0] C:\IO.SYS 
[16/10/2009 22:30|--a------|17399] C:\lopR.txt 
[03/01/2007 09:48|--a------|4976] C:\lvcoinst.log 
[11/08/2006 19:29|-rahs----|0] C:\MSDOS.SYS 
[01/12/2006 22:15|--a------|4752968] C:\MsgPlus-363.exe 
[02/12/2006 16:37|--a------|4859480] C:\MsgPlusLive-411.exe 
[02/01/2007 17:02|--ah-----|16] C:\mxfilerelatedcache.mxc2 
[10/08/2004 22:00|-rahs----|47564] C:\NTDETECT.COM 
[09/09/2008 07:59|-rahs----|252240] C:
tldr 
[?|?|?] C:\pagefile.sys 
[26/04/2007 18:22|--a------|1882020] C:\Photoshop_album_SE_3_0_FR.zip 
[11/08/2006 21:18|--a------|79] C:\preload.aaa 
[11/08/2006 19:41|--a------|499] C:\RHDSetup.log 
[13/02/2009 21:38|--ah-----|268] C:\sqmdata00.sqm 
[15/05/2009 08:08|--ah-----|268] C:\sqmdata01.sqm 
[15/05/2009 08:36|--ah-----|268] C:\sqmdata02.sqm 
[15/05/2009 19:23|--ah-----|268] C:\sqmdata03.sqm 
[15/05/2009 19:41|--ah-----|268] C:\sqmdata04.sqm 
[21/06/2009 11:31|--ah-----|268] C:\sqmdata05.sqm 
[02/02/2008 18:39|--ah-----|268] C:\sqmdata06.sqm 
[02/02/2008 19:14|--ah-----|268] C:\sqmdata07.sqm 
[02/02/2008 20:36|--ah-----|232] C:\sqmdata08.sqm 
[05/02/2008 23:39|--ah-----|268] C:\sqmdata09.sqm 
[18/02/2008 16:42|--ah-----|268] C:\sqmdata10.sqm 
[06/03/2008 09:45|--ah-----|268] C:\sqmdata11.sqm 
[07/03/2008 00:18|--ah-----|268] C:\sqmdata12.sqm 
[09/03/2008 04:55|--ah-----|268] C:\sqmdata13.sqm 
[22/03/2008 02:01|--ah-----|268] C:\sqmdata14.sqm 
[01/07/2008 08:57|--ah-----|268] C:\sqmdata15.sqm 
[31/07/2008 20:41|--ah-----|268] C:\sqmdata16.sqm 
[03/11/2008 09:55|--ah-----|268] C:\sqmdata17.sqm 
[05/01/2009 18:33|--ah-----|280] C:\sqmdata18.sqm 
[12/02/2009 08:13|--ah-----|268] C:\sqmdata19.sqm 
[12/02/2009 08:13|--ah-----|244] C:\sqmnoopt00.sqm 
[13/02/2009 21:38|--ah-----|244] C:\sqmnoopt01.sqm 
[15/05/2009 08:08|--ah-----|244] C:\sqmnoopt02.sqm 
[15/05/2009 08:36|--ah-----|244] C:\sqmnoopt03.sqm 
[15/05/2009 19:23|--ah-----|244] C:\sqmnoopt04.sqm 
[15/05/2009 19:41|--ah-----|244] C:\sqmnoopt05.sqm 
[21/06/2009 11:31|--ah-----|244] C:\sqmnoopt06.sqm 
[02/02/2008 18:39|--ah-----|172] C:\sqmnoopt07.sqm 
[02/02/2008 20:36|--ah-----|172] C:\sqmnoopt08.sqm 
[02/02/2008 19:14|--ah-----|244] C:\sqmnoopt09.sqm 
[05/02/2008 23:39|--ah-----|244] C:\sqmnoopt10.sqm 
[18/02/2008 16:42|--ah-----|244] C:\sqmnoopt11.sqm 
[06/03/2008 09:45|--ah-----|244] C:\sqmnoopt12.sqm 
[07/03/2008 00:18|--ah-----|244] C:\sqmnoopt13.sqm 
[09/03/2008 04:55|--ah-----|244] C:\sqmnoopt14.sqm 
[22/03/2008 02:01|--ah-----|244] C:\sqmnoopt15.sqm 
[01/07/2008 08:57|--ah-----|244] C:\sqmnoopt16.sqm 
[31/07/2008 20:41|--ah-----|244] C:\sqmnoopt17.sqm 
[03/11/2008 09:55|--ah-----|244] C:\sqmnoopt18.sqm 
[05/01/2009 18:33|--ah-----|172] C:\sqmnoopt19.sqm 
[31/10/2005 17:56|--a------|700416] C:\StubInstaller.exe 
[22/10/2009 19:30|--a------|6256] C:\UsbFix.txt 
[13/03/2007 21:10|--ah-----|34867] C:\_NavCClt.Log 
[02/01/2007 16:01|--ah-----|16] D:\mxfilerelatedcache.mxc2 

################## | Vaccination |

# C:\autorun.inf -> Folder created by UsbFix.  
# D:\autorun.inf -> Folder created by UsbFix.  

################## | Suspect | https://www.virustotal.com/gui/ |


################## | Cracks / Keygens / Serials |


################## | Upload | 

Veuillez envoyer le fichier : C:\DOCUME~1\JEAN-C~1\Bureau\UsbFix_Upload_Me_ALBARETJC.zip : https://www.androidworld.fr/ 
Merci pour votre contribution .  

################## | ! Fin du rapport # UsbFix V6.044 ! |

toptitbal · Answer

Bon.
Où en es-tu ?
Comment se comporte le OPC ?

australe13 · Answer

Ya plus de pub et il ne rame plus.

ça va aller comme ça alors,
ya plus rien de méchant ?

toptitbal · Answer

Refais un RSIT, que je regarde s'il y a un peu d'optimisation à faire.

australe13 · Answer

Voilà
Logfile of random's system information tool 1.06 (written by random/random)
Run by Jean-Claude at 2009-10-22 20:16:28
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 91 GB (61%) free of 149 GB
Total RAM: 767 MB (31% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:16:38, on 22/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\NavNTtvscan.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jean-Claude\Bureau\RSIT.exe
C:\Program Files	rend micro\Jean-Claude.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program filesealealplayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe"  -osboot
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [WATCHPNP_Xerox] watchPnp.exe Xerox
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DialMessenger] "C:\Program Files\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\Systememinder.exe
O4 - HKCU\..\Run: [morewin] C:\DOCUME~1\JEAN-C~1\APPLIC~1\GRAMVI~1\mpeg heck.exe
O4 - HKCU\..\Run: [LWBKEYBOARD] "C:\Program Files\Labtec\Desktop\6.0\KbdAp32A.exe"
O4 - HKCU\..\Run: [LWBMOUSE] "C:\Program Files\Labtec\Desktop\6.0\MOffice.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Numérisation PC.lnk = C:\WINDOWS\ScanToPc.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?0b14af403a51488092593bd3e9b1656a
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?0b14af403a51488092593bd3e9b1656a
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: rdihost - {9BE78AF5-2754-4112-B77C-3C5B59C056D2} - (no file)
O21 - SSODL: system32 - {A50E5B30-EFBE-405F-9D49-8CA5AFC51026} - sysprinters.dll (file missing)
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9b99de29aef2) (gupdate1c9b99de29aef2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNTtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

toptitbal · Answer

Y'a un truc bizarre....
On retrouve des infections qu'on a déjà supprimées !
Je vais regarder ça dans le détail, je te donne la suite demain.

australe13 · Answer

ok.
bonne soirée

toptitbal · Answer

---> Télécharge OTM (OldTimer) sur ton Bureau :
  http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/


---> Double-clique sur OTM.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 



:processes 
explorer.exe 

:files 
c:\program files\gramvi~1\mpeg heck.exe

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"morewin"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"rdihost"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"system32"=-


:commands 
[emptytemp] 
[start explorer] 

---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTM

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

toptitbal · Answer

Bien, fais un nouveau RSIT, on devrait en voir le bout.

australe13 · Answer

Bonjour top

Voilà le nouveau rapport

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jean-Claude at 2009-10-31 16:04:44
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 91 GB (61%) free of 149 GB
Total RAM: 767 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:04:51, on 31/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNTtvscan.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\DialMessenger\dialmessenger.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Labtec\Desktop\6.0\KbdAp32A.exe
C:\Program Files\Labtec\Desktop\6.0\MOffice.exe
C:\Program Files\Labtec\Desktop\6.0\Mouse32V.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Microsoft Money\Systememinder.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Documents and Settings\Jean-Claude\Bureau\RSIT.exe
C:\Program Files	rend micro\Jean-Claude.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program filesealealplayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe"  -osboot
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Fichiers communs\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [WATCHPNP_Xerox] watchPnp.exe Xerox
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DialMessenger] "C:\Program Files\DialMessenger\dialmessenger.exe" -background
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\Systememinder.exe
O4 - HKCU\..\Run: [LWBKEYBOARD] "C:\Program Files\Labtec\Desktop\6.0\KbdAp32A.exe"
O4 - HKCU\..\Run: [LWBMOUSE] "C:\Program Files\Labtec\Desktop\6.0\MOffice.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Numérisation PC.lnk = C:\WINDOWS\ScanToPc.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?0b14af403a51488092593bd3e9b1656a
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?0b14af403a51488092593bd3e9b1656a
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9b99de29aef2) (gupdate1c9b99de29aef2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNTtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

toptitbal · Answer

Bien, ça a l'air d'être propre.

Tu as beaucoup de choses inutiles ou de programmes inutilement lancés au démarrage, on va nettoyer un peu, je te prépare ça.

toptitbal · Answer

Relance HijackThis. 

Pour cela double clique sur C:\Program Files	rend micro\Jean-Claude.exe  (c'est Hijackthis renommé par RSIT)

 Clique sur Do a System Scan Only et coche les lignes suivantes : 

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install 
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE 
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE 
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC 
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC 
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName 
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe 
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe 
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot 
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background 
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\Systememinder.exe 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
O4 - Global Startup: Acer Empowering Technology.lnk = ? 

Ferme toutes les autres fenêtres, tous les autres programmes. Pas de connection Internet. 

Clique sur Fix checked puis clique sur OK 
Puis ferme HijackThis.

Tuto : https://forum.pcastuces.com/hijackthis__fixer_les_elements_indesirables-f31s16.htm

Nettoyage pc avec pub intempestives

25 réponses

Votre réponse

Newsletters