pbl message KIS avp.exe pas application32 Fermé

Question

Bonjour,
j'ai un message indiquant que kis 2009 n'est pas une application win32 !!
j'ai essaye d'installer d'autres antivirus mais la aussi meme probleme !!
je n'arive pas à fare un scanne antivirus sur internet, ça se bloque à la mise à jour des virus  !
Cela depuis que j'ai essayé d'installer un petit programme alors que kis n'etait pas en fonctionnement
Pourriez vous m'aider svp
D'avance merci

PS : la souris ne fonctionne plus, ainsi que les prises usb ne sont pas reconnues

totobetourne · Answer

bonjour

1) Télécharges FindyKill de Chiquitine29 

Fais un clique droit sur le lien et choisis "enregistrer la cible sous ...." , destination le bureau .

https://www.commentcamarche.net/telecharger/securite/2759-adwcleaner/

Note importante : si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .

--> Entre dans le dossier " FindyKill "

Double clic sur " FindyKill.bat " (et pas sur autre chose!) pour lancer l'outil .

->choisis l'option 1 . Puis laisses travailler ...

Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt ) 



Réouvre FindyKill , choisi cette fois ci l option 2 (Suppression)

/!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "nettoyage terminé"

-------> ensuite post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque 



2)Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Déconnecte toi et ferme toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer .

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

* Devant l'option "List files/folders created ..." , tu choisis : 2 months

* clique ensuite sur " Continue " pour lancer l'analyse ...


-> laisse faire le scan et ne touche pas au PC ...


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note).

Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

Important : poste un rapport, puis l'autre dans la réponse suivante
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum


( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

murmur1 · Answer

merci pour votre réponse je fais cela et vous envoi les informations obtenues
Merci encore

murmur1 · Answer

voici le rapport option 1 de findykill

Merci


############################## | FindyKill V5.017 |

# User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
# Update on 01/11/2009 by Chiquitine29
# Start at: 17:08:28 | 01/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
# Internet Explorer 8.0.6001.18828
# Windows Firewall Status : Enabled
# AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]
# AV : Microsoft Security Essentials 2.0.6212.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 221,29 Go (129,89 Go free) # NTFS
# D:\ # Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
# E:\ # Disque CD-ROM # 201,21 Mo (0 Mo free) [KasperskyIS2009] # CDFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Users\ghesquiere\AppData\Roaming\drivers\winupgro.exe
C:\Windows\system32\igfxsrvc.exe
C:\Users\ghesquiere\AppData\Roaming\hidires\flec003.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Registry Mechanicegmech.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wintems.exe
C:\Users\ghesquiere\AppData\Roaming\m\flec006.exe
C:\PROGRA~1\FREEDO~1\FDM.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\MsiExec.exe
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
 
############################## | Processus infectieux stoppés  | 

"C:\Users\ghesquiere\AppData\Roaming\drivers\winupgro.exe"  (2588)
"C:\Users\ghesquiere\AppData\Roaming\hidires\flec003.exe"  (2644)
"C:\Windows\system32\wintems.exe"  (2876)
"C:\Users\ghesquiere\AppData\Roaming\m\flec006.exe"  (5768)

################## | C: |

Présent ! E:\autorun.inf  

################## | C:\Windows |


################## | C:\Windows\system32 |

Présent ! C:\Windows\system32\ban_list.txt  
Présent ! C:\Windows\system32\mdelk.exe  
Présent ! C:\Windows\system32\srosa2.sys  
Présent ! C:\Windows\system32\wfsintwq.sys  
Présent ! C:\Windows\system32\wintems.exe  

################## | C:\Windows\system32\drivers |


################## | C:\Users\ghesquiere\AppData\Roaming |

Présent ! C:\Users\ghesquiere\AppData\Roaming\drivers  
Présent ! C:\Users\ghesquiere\AppData\Roaming\drivers\downld  
Présent ! C:\Users\ghesquiere\AppData\Roaming\drivers\winupgro.exe  
Présent ! C:\Users\ghesquiere\AppData\Roaming\hidires  
Présent ! C:\Users\ghesquiere\AppData\Roaming\hidires\flec003.exe  
Présent ! C:\Users\ghesquiere\AppData\Roaming\hidires\lang  
Présent ! C:\Users\ghesquiere\AppData\Roaming\hidires
ames.txt  
Présent ! C:\Users\ghesquiere\AppData\Roaming\hidires\WDIR  
Présent ! C:\Users\ghesquiere\AppData\Roaming\hidires\webserver  
Présent ! C:\Users\ghesquiere\AppData\Roaming\m  
Présent ! C:\Users\ghesquiere\AppData\Roaming\m\data.oct  
Présent ! C:\Users\ghesquiere\AppData\Roaming\m\flec006.exe  
Présent ! C:\Users\ghesquiere\AppData\Roaming\m\list.oct  
Présent ! C:\Users\ghesquiere\AppData\Roaming\m\srvlist.oct  
Présent ! C:\Users\ghesquiere\AppData\Roaming\m\shared  

################## | Références de comparaison Bagle MD5 : |

File : C:\Users\ghesquiere\AppData\Roaming\drivers\winupgro.exe 
-> Crc32 : b09e3663 | Md5 : 2990cb91a8bc077fa1646ab393c0ce99  
 
################## | Autres detections ... |

################## | Temporary Internet Files |

Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\04A5RIFK\b64[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\04A5RIFK\b64_4[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\04A5RIFK\file[1].txt  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\04A5RIFK\mxd2[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\04A5RIFK\mxd2[2].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\04A5RIFK\mxd2[3].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\04A5RIFK\mxd2[4].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\04A5RIFK\mxd2[5].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\53CLE4GM\b64_4[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\53CLE4GM\mxd2[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\53CLE4GM\mxd2[2].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\53CLE4GM\mxd2[3].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\53CLE4GM\mxd2[4].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\53CLE4GM\mxd2[5].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\53CLE4GM\mxd[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\KZPK1DF2\b64_3[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\KZPK1DF2\b64_5[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\KZPK1DF2\mxd2[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\KZPK1DF2\mxd2[2].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\KZPK1DF2\mxd2[3].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\KZPK1DF2\mxd2[4].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\KZPK1DF2\mxd2[5].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\KZPK1DF2\mxd2[6].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\b64_1[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\b64_4[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\mxd2[1].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\mxd2[2].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\mxd2[3].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\mxd2[4].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\mxd2[5].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\mxd2[6].jpg  
Présent ! C:\Users\ghesquiere\Local Settings\Temporary Internet Files\Content.IE5\WP99TGIG\mxd2[7].jpg  

################## | Registre / Clés infectieuses |

Présent ! [HKLM\SYSTEM\CurrentControlSet\Services\sK9Ou0s]  
Présent ! [HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s]  
Présent ! [HKLM\SYSTEM\CurrentControlSet\Services\srosa]  
Présent ! [HKLM\SYSTEM\ControlSet001\Services\srosa]  
Présent ! [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S]  
Présent ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S]  
Présent ! [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]  
Présent ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]  
Présent ! [HKCU\Software\bisoft]  
Présent ! [HKCU\Software\DateTime4]  
Présent ! [HKCU\Software\MuleAppData]  
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"  
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"  
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"  
Présent ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "flec003.exe"  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\Microsoft\Windows\CurrentVersion\Run] "flec003.exe"  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\bisoft]  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\DateTime4]  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\MuleAppData]  
Présent ! [HKCU\Software\Local AppWizard-Generated Applications\patch]  
Présent ! [HKCU\Software\Local AppWizard-Generated Applications\winupgro]  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\Local AppWizard-Generated Applications\patch]  
Présent ! [HKU\S-1-5-21-3608402604-2720629466-915556288-1000\Software\Local AppWizard-Generated Applications\winupgro]  
Présent ! [HKLM\software\microsoft\security center] "UacDisableNotify"  
Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"  
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"  

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# (!) Uac = 0x0 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# (!) SharedAccess -> Start = 4 ( Good = 2 | Bad = 4 )  
# (!) windefend -> Start = 4 ( Good = 2 | Bad = 4 )  
# (!) wuauserv -> Start = 4 ( Good = 2 | Bad = 4 )  
# (!) wscsvc -> Start = 4 ( Good = 2 | Bad = 4 )  


################## | Cracks / Keygens / Serials |

"C:\Program Files\BoontyGames\Supermarket Mania\keygen.exe"  
04/07/2009 03:39 |Size 165888 |Crc32 bbbfaf15 |Md5 67aabe94b82b15a885d41d5188a7330b  
 
"C:\Program Files\Siber Systems\AI RoboForm\crack.exe"  
14/09/2004 07:55 |Size 23040 |Crc32 969dfe5e |Md5 cf49556d64a2e974829f8ebab96e1de6  
 
"C:\Program Files\web creator\Crack\WebCreatorPro4.exe"  
27/12/2007 17:30 |Size 3506176 |Crc32 8358ba44 |Md5 234bec69956c97d1d17e2dbb17f3bf6c  
 
"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008MAINTENANCE_FR_9_0_0_1681\Crack\BatimentMaintenance.exe"  
13/01/2008 14:58 |Size 16286720 |Crc32 4a3e2a54 |Md5 f08817e4a48a299e2abef9cb1e1ad2b5  
 
"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008PRO_FR_9_0_0_1681\Crack\BatimentPro.exe"  
13/01/2008 03:13 |Size 16436736 |Crc32 338f755f |Md5 5bbb0febabfa6e1baadd49af39e7bfd0  
 

################## | ! Fin du rapport # FindyKill V5.017 ! |

murmur1 · Answer

le rapport de rsit :
 
Logfile of random's system information tool 1.06 (written by random/random)
Run by ghesquiere at 2009-11-01 19:06:44
Microsoft® Windows Vista™ Édition Familiale Premium  
System drive C: has 133 GB (59%) free of 227 GB
Total RAM: 3061 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07:05, on 01/11/2009
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Micro Application\LauncherMA.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\MsiExec.exe
C:\Windows\system32\wuauclt.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\ghesquiere\Desktop\RSIT.exe
C:\Program Files	rend micro\ghesquiere.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Smart-Shopper - {4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Lanceur.lnk = C:\Program Files\Micro Application\LauncherMA.exe
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - F:\App\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - F:\App\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A34DCA64-67D3-4D22-ADB7-8FF4DBAEFE8A}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SolidConverterPDFReadSpool (SCPDFReadSpool) - Solid Documents, LLC - C:\Windows\Installer\MSIDFCC.tmp
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

murmur1 · Answer

je ne trouve pas le rapport info.txt dans la barre des tâches !
aidez moi
Merci

totobetourne · Answer

1) as tu regarder la comme indique?

( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit ) 


2)as tu effectue le rapport findykill en option 2 pour supprimer l infection bagle.


Réouvre FindyKill , choisi cette fois ci l option 2 (Suppression)

/!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "nettoyage terminé"

-------> ensuite post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque




3) as tu recu une cle usb de quelqu un , ou qu as tu telecharger d internet car les cracks c est souvent infecte.

murmur1 · Answer

oui j'ai eu une cle avec un programme craké

mais comme ca passé pas , ma fille a enlevé la protection kis pour pouvoir instzller !!

murmur1 · Answer

on a tout effacer sur la cle usb

totobetourne · Answer

met la cle de cote.il faut faire attention avec les cracks.

murmur1 · Answer

je fais quoi maintenant ?

totobetourne · Answer

il faudrait que tu fasses bien attention aux messages que je t envoie.

as tu lu ce que je t ai envoye dans les premier message et que j ai repete au 6 ieme a savoir findykill option 2 .
on verra pour la suite.

murmur1 · Answer

excuse, j'ai sauté un message !!
donc voici le rapport info.txt trouvé dans dossier rsit :

 info.txt logfile of random's system information tool 1.06 2009-11-01 13:38:40

======Uninstall list======

-->"C:\Program Files\HP Games\Bejeweled 2 Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Blasterball 2 Revolution\Uninstall.exe"
-->"C:\Program Files\HP Games\Blasterball 3\Uninstall.exe"
-->"C:\Program Files\HP Games\Bricks of Egypt\Uninstall.exe"
-->"C:\Program Files\HP Games\Chicken Invaders 3 - Revenge of the Yolk\Uninstall.exe"
-->"C:\Program Files\HP Games\Chuzzle Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Crystal Maze\Uninstall.exe"
-->"C:\Program Files\HP Games\Diner Dash 2 Restaurant Rescue\Uninstall.exe"
-->"C:\Program Files\HP Games\Diner Dash\Uninstall.exe"
-->"C:\Program Files\HP Games\FATE\Uninstall.exe"
-->"C:\Program Files\HP Games\Fish Tycoon\Uninstall.exe"
-->"C:\Program Files\HP Games\Gem Shop\Uninstall.exe"
-->"C:\Program Files\HP Games\Insaniquarium Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Jewel Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\Magic Academy\Uninstall.exe"
-->"C:\Program Files\HP Games\Mah Jong Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\My HP Game Console\Uninstall.exe"
-->"C:\Program Files\HP Games\Ocean Express\Uninstall.exe"
-->"C:\Program Files\HP Games\Peggle\Uninstall.exe"
-->"C:\Program Files\HP Games\Penguins!\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Bowler\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Golfer Pineapple Cup\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Golfer\Uninstall.exe"
-->"C:\Program Files\HP Games\Puzzle Express\Uninstall.exe"
-->"C:\Program Files\HP Games\Shooting Stars Pool\Uninstall.exe"
-->"C:\Program Files\HP Games\Slingo Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Sudoku Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\Super Granny\Uninstall.exe"
-->"C:\Program Files\HP Games\Tradewinds\Uninstall.exe"
-->"C:\Program Files\HP Games\Virtual Villagers - A New Home\Uninstall.exe"
-->"C:\Program Files\HP Games\Zuma Deluxe\Uninstall.exe"
-->C:\Program Files\Conexant\SmartAudio\SETUP.EXE -U -ISmartAudio -SM=SMAUDIO.EXE,1801
-->MsiExec.exe /I{48A669A9-76FA-4CA8-BFD5-00C125AC4166}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.3 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
Adobe Shockwave Player-->MsiExec.exe /X{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}
AI RoboForm (All Users)-->"C:\Program Files\Siber Systems\AI RoboForm\rfwipeout.exe"
AIM 6-->C:\Program Files\AIM6\uninst.exe
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
Atheros Driver Installation Program-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.exe" -l0x40c  -removeonly
Bâtiprix CD-->C:\Windows\IsUn040c.exe -f"C:\Program Files\Bâtiprix CD\Uninst.isu"
Bâtiprix Devis-->C:\Windows\IsUn040c.exe -f"C:\Program Files\BATIPRIX\Bâtiprix Devis\Uninst.isu"
BlackBerry Desktop Software 4.6-->MsiExec.exe /I{14AD69CE-B59F-4EC2-BC3A-DB56105F3D62}
BlackBerry Desktop Software 4.6-->MsiExec.exe /i{14AD69CE-B59F-4EC2-BC3A-DB56105F3D62}
ClickImpôts first step 2007 2007.2.512-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{62F9748F-70D6-4AC3-85E0-04607F26B989}\Setup.exe" -l0x40c 
ClickImpôts plus 2008 2008.2.042-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{968223B7-9A5A-41AB-ADB6-663EA32A5716}\Setup.exe" -l0x40c 
ClickImpôts plus Premier 2009 2009.2.029-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8F1DEBB2-76E3-4991-8857-DE5DE8FABBC9}\Setup.exe" -l0x40c 
ClickImpôts plus Premier 2009 2009.3.036-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E0763A70-70E1-4BC6-8041-1D3C1E6A8C08}\Setup.exe" -l0x40c 
Conexant HD Audio-->C:\Program Files\CONEXANT\CNXT_AUDIO_HDA\UIU32a.exe -U -ILEOHERza.INF
Cortona® VRML Client-->"C:\Program Files\ParallelGraphics\Cortona VRML Client\UNWISE32.EXE" "C:\Program Files\ParallelGraphics\Cortona VRML Client\Install.log"
CyberLink YouCam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
DVD Suite-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe"  -uninstall
EA Link-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{F5577101-33CC-4711-8235-3A95BCD49DB0} /l1036 
e-bat-->C:\Windows\unvise32.exe C:\Program Files\uninstal.log
EBP Btrieve 8.6-->"C:\ProgramData\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\EBP_Btrieve8.6_SETUP.exe" REMOVE=TRUE MODIFY=FALSE
EBP Btrieve 8.6-->C:\ProgramData\{B33CBE2B-A739-401D-A5E0-041195C4A17B}\EBP_Btrieve8.6_SETUP.exe
EBP Comptabilité 12.1-->"C:\ProgramData\{55C5BCC7-3C5A-4840-9272-BDCF25FE4FD0}\EBP_Comptabilite.exe" REMOVE=TRUE MODIFY=FALSE
EBP Comptabilité 12.1-->C:\ProgramData\{55C5BCC7-3C5A-4840-9272-BDCF25FE4FD0}\EBP_Comptabilite.exe
EBP Comptabilité-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5827A3F0-23B3-414F-BFD8-95F96A3D199D}\setup.exe" -l0x40c  /uninst
ESU for Microsoft Vista-->MsiExec.exe /I{AD3FDC40-BCF4-476D-A2D6-C4B154DD9DF5}
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_HERMOSA_HSF\UIU32m.exe -U -IHPQHERzm.inf
Hewlett-Packard Active Check-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent for Health Check-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BD0E2B92-3814-46F0-893B-4612EA010C7E}\setup.exe" -l0x9  -removeonly
HP Doc Viewer-->MsiExec.exe /I{082702D5-5DD8-4600-BCE5-48B15174687F}
HP DVD Play 3.6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe"  -uninstall
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}\setup.exe" -l0x9  -removeonly
HP Help and Support-->MsiExec.exe /I{28EDCE9C-3304-4331-8AB3-F3EBE94C35B4}
HP Quick Launch Buttons 6.30 E2-->C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe -runfromtemp -l0x040c uninst
HP Total Care Advisor-->MsiExec.exe /X{b02df929-29a7-4fd2-9a70-81a644b635f7}
HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
HP User Guides 0092-->MsiExec.exe /I{85833A03-476B-43B3-B61C-5EB946DBF6E4}
HP Wireless Assistant-->MsiExec.exe /I{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}
INFORAD MANAGER 3.6-->"C:\Program Files\INFORAD\unins000.exe"
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
Intel(R) Matrix Storage Manager-->C:\Windows\System32\Imsmudlg.exe
Intel(R) TV Wizard-->C:\Windows\system32\TVWizudlg.exe -uninstall
IZArc 4.0 beta 1-->"C:\Program Files\IZArc\unins000.exe"
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
K-Lite Codec Pack 4.7.5 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
LabelPrint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\setup.exe"  -uninstall
LauncherMA-->MsiExec.exe /X{C06EFB22-B5DB-46C5-9215-BCB5C19C0858}
Les Sims™ Histoires de vie-->MsiExec.exe /I{2284D904-C138-4B58-93EC-5C362AB5130A}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Access Developer Extensions (French) 2007-->MsiExec.exe /X{90120000-00D0-040C-0000-0000000FF1CE}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office OneNote MUI (French) 2007-->MsiExec.exe /X{90120000-00A1-040C-0000-0000000FF1CE}
Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0122-040C-0000-0000000FF1CE}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (French)-->MsiExec.exe /X{95120000-00AF-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft Photo Pro Suite 10-->"C:\Program Files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe" ADDREMOVE=1 SKU=SUITE
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Works-->MsiExec.exe /I{3B160861-7250-451E-B5EE-8B92BF30A710}
Mise à jour Microsoft Office Excel 2007 Help  (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Excel 2007 Help  (KB963678)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {B761869A-B85C-40E2-994C-A1CE78AC8F2C}
Mise à jour Microsoft Office Outlook 2007 Help  (KB963677)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {51EFB347-1F3D-4BAC-8B79-F056B904FE21}
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Powerpoint 2007 Help  (KB963669)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {C3DCA38E-005E-41BA-A52A-7C3429F351C3}
Mise à jour Microsoft Office Word 2007 Help  (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Mise à jour Microsoft Office Word 2007 Help  (KB963665)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {81536A04-DBFB-4DB3-978F-0F284590C223}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (2.0.0.16)-->F:\App\fr\PortableFirefox\firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.22)-->F:\mozilla thunderbird\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.23)-->F:\App\fr\PortableThunderbird\Thunderbird\uninstall\helper.exe
MSCU for Microsoft Vista-->MsiExec.exe /I{E87F5651-CE15-493F-AE99-3B670E25A54E}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
muvee autoProducer 6.1-->C:\Program Files\InstallShield Installation Information\{250E9609-E830-43EB-B379-DAB7546A2422}\muveesetup.exe -removeonly -runfromtemp
My HP Games-->"C:\Program Files\HP Games\Uninstall.exe"
Nero 9-->C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe  REMOVESERIALNUMBER="9M03-01A1-PCX7-K31A-8A94-98PT-KT2E-522A"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x040c -removeonly
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Pervasive System Analyzer-->C:\Windows\IsUninst.exe -f"C:\Program Files\Common Files\Pervasive Software Shared\PSA\psa.isu"
Power2Go-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.exe"  -uninstall
PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe" /z-uninstall
QuickPlay SlingPlayer 0.4.4-->"C:\Program Files\HP\QuickPlay\unins000.exe"
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista-->C:\Program Files\InstallShield Installation Information\{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}\setup.exe -runfromtemp -l0x040c -removeonly
Realtek USB 2.0 Card Reader-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DC24971E-1946-445D-8A82-CE685433FA7D}\setup.exe" -l0x9  -removeonly
Registry Mechanic 8.0-->"C:\Program Files\Registry Mechanic\unins000.exe" /Log
Room Arranger-->"F:\App\Room arranger\uninstall.exe"
Roxio Media Manager-->MsiExec.exe /X{F6377647-81AF-41C0-BC7E-06CF37E204AB}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC

murmur1 · Answer

je refais un findykill option 2 et je poste le resultat
(je l'avais deja posté apres l'option 1)
Merci

murmur1 · Answer

voici le rapport option 2 refait ce jour
a la remise en route de l'ordinateur, un programme que j'ai essayé d'installer pendant l'infection m'a dit que l'ordi est protégé mais je n'arrive tjs pas a remettre en service KIS

le rapport :

############################## | FindyKill V5.017 |

# User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
# Update on 01/11/2009 by Chiquitine29
# Start at: 07:31:21 | 02/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
# Internet Explorer 8.0.6001.18828
# Windows Firewall Status : Enabled
# AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]
# AV : Microsoft Security Essentials 2.0.6212.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 221,29 Go (133,31 Go free) # NTFS
# D:\ # Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
# E:\ # Disque CD-ROM # 201,21 Mo (0 Mo free) [KasperskyIS2009] # CDFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32unonce.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\PresentationSettings.exe

################## | C: |

Supprimé ! E:\"autorun.inf" 

################## | C:\Windows |

Supprimé ! C:\Windows\Prefetch\WINUPGRO.EXE-CCC1740C.pf  

################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\ghesquiere\AppData\Roaming |

################## | Autres suppressions ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses | 


################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Uac : OK 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | PEH ... |

Corrompu : C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
[Offset = 000000FC - Valeur = 0x0001]

Corrompu : C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[Offset = 00000104 - Valeur = 0x0001]


################## | Cracks / Keygens / Serials |

"C:\Program Files\BoontyGames\Supermarket Mania\keygen.exe"  
04/07/2009 03:39 |Size 165888 |Crc32 bbbfaf15 |Md5 67aabe94b82b15a885d41d5188a7330b  
 
"C:\Program Files\web creator\Crack\WebCreatorPro4.exe"  
27/12/2007 17:30 |Size 3506176 |Crc32 8358ba44 |Md5 234bec69956c97d1d17e2dbb17f3bf6c  
 
"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008MAINTENANCE_FR_9_0_0_1681\Crack\BatimentMaintenance.exe"  
13/01/2008 14:58 |Size 16286720 |Crc32 4a3e2a54 |Md5 f08817e4a48a299e2abef9cb1e1ad2b5  
 
"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008PRO_FR_9_0_0_1681\Crack\BatimentPro.exe"  
13/01/2008 03:13 |Size 16436736 |Crc32 338f755f |Md5 5bbb0febabfa6e1baadd49af39e7bfd0  
 

################## | ! Fin du rapport # FindyKill V5.017 ! |

murmur1 · Answer

ma souris et mes prises usb ne fonctionnent tjs pas
j'ai refait un rsit
voici le rapport:

Logfile of random's system information tool 1.06 (written by random/random)
Run by ghesquiere at 2009-11-02 08:01:53
Microsoft® Windows Vista™ Édition Familiale Premium  
System drive C: has 137 GB (60%) free of 227 GB
Total RAM: 3061 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:02:01, on 02/11/2009
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Micro Application\LauncherMA.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\ghesquiere\Desktop\RSIT.exe
C:\Program Files	rend micro\ghesquiere.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=compaq-notebook.msn.com&ocid=HPDHP&pc=CPNTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Smart-Shopper - {4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboFormoboform.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: Lanceur.lnk = C:\Program Files\Micro Application\LauncherMA.exe
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - F:\App\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - F:\App\WinHTTrack\WinHTTrackIEBar.dll (file missing)
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A34DCA64-67D3-4D22-ADB7-8FF4DBAEFE8A}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SolidConverterPDFReadSpool (SCPDFReadSpool) - Solid Documents, LLC - C:\Windows\Installer\MSIDFCC.tmp
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

totobetourne · Answer

etrange le rapport option 2(tu l avais peut etre effectue mais je ne l ai pas vu ce rapport de suppression)  , refais findykill en option 1.

je te conseille de desinstaller kaspersky , spybot et del es reinstaller.

supprime les cracks car si tu les relances tu peux a nouveau etre infecte.

merci.

murmur1 · Answer

bonsoir
merci de votre aide
J'ai désinstallé KIS et spybot de mon ordi
Les prises usb ne fonctionnent tjrs pas
j'ai refait findykill option 1 le rapport est ci_dessous
Je peux reinstaller KIS ou Microsoft securité essencial est suffisant ?
merci encore

Rapport :

############################## | FindyKill V5.017 |

# User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
# Update on 01/11/2009 by Chiquitine29
# Start at: 18:11:21 | 02/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
# Internet Explorer 8.0.6001.18828
# Windows Firewall Status : Enabled
# AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]
# AV : Microsoft Security Essentials 2.0.6212.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 221,29 Go (134,71 Go free) # NTFS
# D:\ # Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
# E:\ # Disque CD-ROM # 201,21 Mo (0 Mo free) [KasperskyIS2009] # CDFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\ghesquiere\AppData\Roaming |

################## | Autres detections ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"  
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"  

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# Uac : OK 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks / Keygens / Serials |

"C:\Program Files\BoontyGames\Supermarket Mania\keygen.exe"  
04/07/2009 03:39 |Size 165888 |Crc32 bbbfaf15 |Md5 67aabe94b82b15a885d41d5188a7330b  
 
"C:\Program Files\web creator\Crack\WebCreatorPro4.exe"  
27/12/2007 17:30 |Size 3506176 |Crc32 8358ba44 |Md5 234bec69956c97d1d17e2dbb17f3bf6c  
 
"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008MAINTENANCE_FR_9_0_0_1681\Crack\BatimentMaintenance.exe"  
13/01/2008 14:58 |Size 16286720 |Crc32 4a3e2a54 |Md5 f08817e4a48a299e2abef9cb1e1ad2b5  
 
"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008PRO_FR_9_0_0_1681\Crack\BatimentPro.exe"  
13/01/2008 03:13 |Size 16436736 |Crc32 338f755f |Md5 5bbb0febabfa6e1baadd49af39e7bfd0  
 

################## | ! Fin du rapport # FindyKill V5.017 ! |

totobetourne · Answer

1)repasse findykill en option 2 et colle le rapport. merci 


2)enleve cela car en relancant ces programmes tu pourrais de nouveau etre infecte.
################## | Cracks / Keygens / Serials |

"C:\Program Files\BoontyGames\Supermarket Mania\keygen.exe"
04/07/2009 03:39 |Size 165888 |Crc32 bbbfaf15 |Md5 67aabe94b82b15a885d41d5188a7330b

"C:\Program Files\web creator\Crack\WebCreatorPro4.exe"
27/12/2007 17:30 |Size 3506176 |Crc32 8358ba44 |Md5 234bec69956c97d1d17e2dbb17f3bf6c

"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008MAINTENANCE_FR_9_0_0_1681\Crack\BatimentMaintenance.exe"
13/01/2008 14:58 |Size 16286720 |Crc32 4a3e2a54 |Md5 f08817e4a48a299e2abef9cb1e1ad2b5

"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008PRO_FR_9_0_0_1681\Crack\BatimentPro.exe"
13/01/2008 03:13 |Size 16436736 |Crc32 338f755f |Md5 5bbb0febabfa6e1baadd49af39e7bfd0


################## | ! Fin du rapport # FindyKill V5.017 ! |



3)il ne faut qu un seul antivirus sur un pc ,desinstalle celui qui te reste et je dirai de reinstaller kaspersky,(spybot plus la peine tu en mieux en gratuit on verra apres).

murmur1 · Answer

1_ j'ai refait findykill option 2, le rapport est ci dessous

2_ j'ai supprimé les cracks

3_ j'ai desinstallé tous les antivirus sur ordi, j'attends votre feu vert pour reinstaller

le rapport :

############################## | FindyKill V5.017 |

# User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
# Update on 01/11/2009 by Chiquitine29
# Start at: 23:51:02 | 02/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
# Internet Explorer 8.0.6001.18828
# Windows Firewall Status : Enabled
# AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]
# AV : Microsoft Security Essentials 2.0.6212.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 221,29 Go (132,5 Go free) # NTFS
# D:\ # Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\WerCon.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32unonce.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\PresentationSettings.exe

################## | C: |


################## | C:\Windows |

Supprimé ! C:\Windows\Prefetch\WINUPGRO.EXE-CCC1740C.pf  

################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\ghesquiere\AppData\Roaming |

################## | Autres suppressions ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses | 


################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Uac : OK 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | PEH ... |

Corrompu : C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
[Offset = 000000FC - Valeur = 0x0001]


################## | Cracks / Keygens / Serials |

"C:\Program Files\BoontyGames\Supermarket Mania\keygen.exe"  
04/07/2009 03:39 |Size 165888 |Crc32 bbbfaf15 |Md5 67aabe94b82b15a885d41d5188a7330b  
 
"C:\Program Files\web creator\Crack\WebCreatorPro4.exe"  
27/12/2007 17:30 |Size 3506176 |Crc32 8358ba44 |Md5 234bec69956c97d1d17e2dbb17f3bf6c  
 
"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008MAINTENANCE_FR_9_0_0_1681\Crack\BatimentMaintenance.exe"  
13/01/2008 14:58 |Size 16286720 |Crc32 4a3e2a54 |Md5 f08817e4a48a299e2abef9cb1e1ad2b5  
 
"C:\Users\ghesquiere\Downloads\eMule\Incoming\batiprix divers\EBP_BATIMENT_2008PRO_FR_9_0_0_1681\Crack\BatimentPro.exe"  
13/01/2008 03:13 |Size 16436736 |Crc32 338f755f |Md5 5bbb0febabfa6e1baadd49af39e7bfd0  
 

################## | ! Fin du rapport # FindyKill V5.017 ! |

murmur1 · Answer

j'ai oublié :
les prises usb ne fonctionnent tjs pas

Merci de votre aide

totobetourne · Answer

1)reinstalle kaspersky .

les cracks sont toujours present source de reinfection surtout si les programmes redemarrent automatiquement.



2)--> Télécharge UsbFix (de Chiquitine29) sur ton Bureau.
http://pagesperso-orange.fr/NosTools/usbfix.html


--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Clique droit sur le raccourci UsbFix situé sur ton Bureau et choisis Exécuter en tant qu'administrateur.

--> Choisis l'option 1 (recherche).

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)


refais pareil mais en option 2 apres colle le rapport que tu obtiens.

murmur1 · Answer

bonsoir
J'ai réinstallé kaspersky et tjs le même message, pas application win32, impossible de le lancer

j'ai remis ma clé usb et ma souris dans les prises usb, aucune réaction, la souris fonctionne pas, clé non reconnu
j'ai fais le test avec usbfix option1, il y a pas eu de redemarage

le rapport :

############################## | UsbFix V6.047 |

User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
Update on 02/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 20:01:57 | 03/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
Internet Explorer 8.0.6001.18828
Windows Firewall Status : Disabled
AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local # 221,29 Go (130,45 Go free) # NTFS
D:\ -> Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
E:\ -> Disque CD-ROM # 201,21 Mo (0 Mo free) [KasperskyIS2009] # CDFS

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Micro Application\LauncherMA.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Windows\System32\alg.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

E:\autorun.inf  

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\I
shell\AutoRun\command =I:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\J
shell\AutoRun\command =J:\LaunchU3.exe 

HKCU\..\..\Explorer\MountPoints2\{55588069-5424-11dd-bebb-806e6f6e6963}
shell\AutoRun\command =E:\setup.exe 

HKCU\..\..\Explorer\MountPoints2\{749690e5-09f3-11de-9473-001eec30ce9e}
shell\AutoRun\command =I:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{b935229e-5db5-11dd-ab76-001eec30ce9e}
shell\AutoRun\command =G:\LaunchU3.exe 

################## | Suspect | https://www.virustotal.com/gui/ |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # UsbFix V6.047 ! |

murmur1 · Answer

ma souris c'est remise en fonction
ma clé usb est accessible

le programme usbfix demande l'envoi d'un fichier , ok ?
le programme kaspersky ne fonctionne tjs pas

le rapport 2 :

############################## | UsbFix V6.047 |

User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
Update on 02/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 20:17:38 | 03/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
Internet Explorer 8.0.6001.18828
Windows Firewall Status : Disabled
AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]

C:\ -> Disque fixe local # 221,29 Go (130,24 Go free) # NTFS
D:\ -> Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
E:\ -> Disque CD-ROM # 201,21 Mo (0 Mo free) [KasperskyIS2009] # CDFS
J:\ -> Disque amovible # 1,92 Go (1,9 Go free) [GWEN CLE] # FAT

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32unonce.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\PresentationSettings.exe

################## | Fichiers # Dossiers infectieux |

Non supprimé ! E:\autorun.inf 

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\I\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\J\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{55588069-5424-11dd-bebb-806e6f6e6963}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{749690e5-09f3-11de-9473-001eec30ce9e}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{b935229e-5db5-11dd-ab76-001eec30ce9e}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[03/07/2009 10:07|--a------|19079] C:\1082877284[1].jpg 
[17/07/2009 14:57|--a------|140882] C:\1_9_25_fond-usa-las_vegas-180[1].jpg 
[08/07/2009 12:01|--a------|195368] C:\6036[1].png 
[21/11/2007 07:34|--a------|74] C:\autoexec.bat 
[02/11/2006 10:53|-rahs----|438840] C:\bootmgr 
[18/09/2006 22:43|--a------|10] C:\config.sys 
[23/10/2009 17:43|--a------|1273] C:\DCB_INS.LOG 
[07/11/2007 07:00|--a------|17734] C:\eula.1028.txt 
[07/11/2007 07:00|--a------|17734] C:\eula.1031.txt 
[07/11/2007 07:00|--a------|10134] C:\eula.1033.txt 
[07/11/2007 07:00|--a------|17734] C:\eula.1036.txt 
[07/11/2007 07:00|--a------|17734] C:\eula.1040.txt 
[07/11/2007 07:00|--a------|118] C:\eula.1041.txt 
[07/11/2007 07:00|--a------|17734] C:\eula.1042.txt 
[07/11/2007 07:00|--a------|17734] C:\eula.2052.txt 
[07/11/2007 07:00|--a------|17734] C:\eula.3082.txt 
[03/11/2009 00:19|--a------|4484] C:\FindyKill.txt 
[07/11/2007 07:00|--a------|1110] C:\globdata.ini 
[18/08/2008 08:24|-rahs----|171136] C:\grldr 
[?|?|?] C:\hiberfil.sys 
[07/11/2007 07:03|--a------|562688] C:\install.exe 
[07/11/2007 07:00|--a------|843] C:\install.ini 
[07/11/2007 07:03|--a------|76304] C:\install.res.1028.dll 
[07/11/2007 07:03|--a------|96272] C:\install.res.1031.dll 
[07/11/2007 07:03|--a------|91152] C:\install.res.1033.dll 
[07/11/2007 07:03|--a------|97296] C:\install.res.1036.dll 
[07/11/2007 07:03|--a------|95248] C:\install.res.1040.dll 
[07/11/2007 07:03|--a------|81424] C:\install.res.1041.dll 
[07/11/2007 07:03|--a------|79888] C:\install.res.1042.dll 
[07/11/2007 07:03|--a------|75792] C:\install.res.2052.dll 
[07/11/2007 07:03|--a------|96272] C:\install.res.3082.dll 
[11/10/2008 22:09|-rahs----|0] C:\IO.SYS 
[21/11/2007 07:11|--ah-----|360] C:\IPH.PH 
[11/10/2008 22:09|-rahs----|0] C:\MSDOS.SYS 
[?|?|?] C:\pagefile.sys 
[03/05/2009 17:36|--a------|594] C:\updatedatfix.log 
[03/11/2009 20:19|--a------|5148] C:\UsbFix.txt 
[07/11/2007 07:00|--a------|5686] C:\vcredist.bmp 
[07/11/2007 07:09|--a------|1442522] C:\VC_RED.cab 
[07/11/2007 07:12|--a------|232960] C:\VC_RED.MSI 
[09/07/2009 15:51|--a------|270038] C:\xvi08lwr[1].gif 
[11/09/2005 16:18|---hs----|340] D:\AUTOMODE 
[17/07/2008 19:16|---hs----|13] D:\BLOCK.RIN 
[04/10/2006 00:02|---hs----|438328] D:\bootmgr 
[06/09/2008 12:19|---hs----|891] D:\Desktop.ini 
[10/09/2002 17:14|---hs----|8134] D:\Folder.htt 
[18/08/2008 08:24|-rahs----|171136] D:\grldr 
[17/07/2008 19:51|--ahs----|828] D:\MASTER.LOG 
[29/01/2007 18:59|---hs----|109342] D:\protect.chinese hong kong 
[29/01/2007 18:59|---hs----|109360] D:\protect.chinese simplified 
[29/01/2007 18:59|---hs----|109342] D:\protect.chinese traditional 
[14/02/2007 19:30|---hs----|111653] D:\protect.czech 
[29/01/2007 18:55|---hs----|109124] D:\protect.danish 
[29/01/2007 18:57|---hs----|109049] D:\protect.dutch 
[29/01/2007 18:55|---hs----|109092] D:\protect.ed 
[29/01/2007 18:55|---hs----|109092] D:\protect.english 
[29/01/2007 18:56|---hs----|109092] D:\protect.finnish 
[29/01/2007 18:56|---hs----|109060] D:\protect.french 
[29/01/2007 18:55|---hs----|109094] D:\protect.german 
[14/02/2007 19:38|---hs----|112541] D:\protect.greek 
[14/02/2007 19:40|---hs----|112375] D:\protect.hebrew 
[28/08/2007 15:57|---hs----|111475] D:\protect.hungarian 
[29/01/2007 18:56|---hs----|108979] D:\protect.italian 
[29/01/2007 18:57|---hs----|109795] D:\protect.japanese 
[29/01/2007 18:57|---hs----|109487] D:\protect.korean 
[14/02/2007 19:44|---hs----|111402] D:\protect.norwegian 
[14/02/2007 19:45|---hs----|111585] D:\protect.polish 
[14/02/2007 19:46|---hs----|111448] D:\protect.portuguese 
[14/02/2007 19:46|---hs----|111697] D:\protect.portuguese brazilian 
[29/01/2007 18:58|---hs----|163804] D:\protect.russian 
[29/01/2007 18:55|---hs----|109016] D:\protect.spanish 
[14/02/2007 19:48|---hs----|111445] D:\protect.swedish 
[14/02/2007 19:49|---hs----|111598] D:\protect.turkish 
[14/05/2008 06:58|---hs----|0] D:\USER 
[22/12/2006 12:21|-r-------|38] E:\autorun.inf 
[04/05/2008 09:30|-r-------|34443264] E:\kis.fr.msi 
[09/04/2001 11:10|-r-------|7398] E:\kl.ico 
[05/05/2008 09:18|-r-------|59166] E:elease_notes_kis8.0_fr.htm 
[04/05/2008 09:31|-r-------|75088] E:\setup.exe 
[15/05/2008 14:40|-r-------|300] E:\setup.reg 
[01/10/2009 13:02|--a------|38912] J:\cv.doc 
[01/10/2009 09:51|--a------|408064] J:\381px-Montgolfi%C3%A8re[1].jpg.doc 

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix.  
# D:\autorun.inf -> Dossier créé par UsbFix.  
# J:\autorun.inf -> Dossier créé par UsbFix.  

################## | Suspect | https://www.virustotal.com/gui/ |


################## | Cracks / Keygens / Serials |

"J:\xooloo\patch\crack.exe"  
28/09/2009 07:00 |Size 144384 |Crc32 3f591fad |Md5 873e0e88a209fa0dcca5ade7167c76b3  
 
"J:\parental filtrer\keygen\keygen.exe"  
28/09/2009 07:00 |Size 180224 |Crc32 fd0f2ddb |Md5 b9d3d760a6bc64a7f844cd97db6ac0cc

murmur1 · Answer

j'ai supprimé xooloo et parentale sur la clé

totobetourne · Answer

envoie le fichier demande par usb fix , c est pour celui qui met a jour findykill suivant les nouvelles versions de l infection.

siwindows te dit que kaspersky n est pas une application win 32 valide c est que tu as toujours bagle.
desinstalle tout les programmes ou tu avais un crack , desinstalle kaspersky.

repasse findykill en option 1.

murmur1 · Answer

bonsoir
J'ai envoyé le fichier !!
J'ai supprimé tous les programmes à crack
j'ai supprimé kaspersky
j'ai fais le prog findykill option 1 

Le rapport :


############################## | FindyKill V5.017 |

# User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
# Update on 01/11/2009 by Chiquitine29
# Start at: 18:53:29 | 04/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
# Internet Explorer 8.0.6001.18828
# Windows Firewall Status : Enabled
# AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]
# AV : avast! antivirus 4.8.1356 [VPS 091103-1] 4.8.1356 [ Enabled | Updated ]

# C:\ # Disque fixe local # 221,29 Go (137,66 Go free) # NTFS
# D:\ # Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Micro Application\LauncherMA.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\msiexec.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\System32\alg.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Windows\system32\MsiExec.exe
C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe
C:\Users\GHESQU~1\AppData\Local\Temp\{e9513610-f218-4dda-b954-2c7e6ba7cabb}\IDriver.NonElevated.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\ghesquiere\AppData\Roaming |

################## | Autres detections ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"  
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"  

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# Uac : OK 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.017 ! |

Merci de votre aide
je fais une option 2 de findykill !!

murmur1 · Answer

voici le rapport pour findykill option 2


############################## | FindyKill V5.017 |

# User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
# Update on 01/11/2009 by Chiquitine29
# Start at: 20:39:20 | 04/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
# Internet Explorer 8.0.6001.18828
# Windows Firewall Status : Enabled
# AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]
# AV : avast! antivirus 4.8.1356 [VPS 091103-1] 4.8.1356 [ Enabled | Updated ]

# C:\ # Disque fixe local # 221,29 Go (137,53 Go free) # NTFS
# D:\ # Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32unonce.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\PresentationSettings.exe
C:\Windows\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\Windows |

Supprimé ! C:\Windows\Prefetch\WINUPGRO.EXE-CCC1740C.pf  

################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\ghesquiere\AppData\Roaming |

################## | Autres suppressions ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses | 


################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Uac : OK 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | PEH ... |

Corrompu : C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
[Offset = 000000FC - Valeur = 0x0001]


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.017 ! |


Pourriez vous me dire ce que je fais à présent ?
et pour kaspersky ?
un grand merci

murmur1 · Answer

voir post 26 et 27 avant, puis j'ai refait option1 et à voir il n'y a plus de virus ?

Je reessai l'installation de kespersky ?
merci

rapport 1

############################## | FindyKill V5.017 |

# User : ghesquiere (Administrateurs) # PC-DE-GHESQUIER
# Update on 01/11/2009 by Chiquitine29
# Start at: 22:11:00 | 04/11/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) Dual  CPU  T2370  @ 1.73GHz
# Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6000 32-bit) # 
# Internet Explorer 8.0.6001.18828
# Windows Firewall Status : Enabled
# AV : Kaspersky Internet Security 8.0.0.357 [ (!) Disabled | Updated ]
# AV : avast! antivirus 4.8.1356 [VPS 091103-1] 4.8.1356 [ Enabled | Updated ]

# C:\ # Disque fixe local # 221,29 Go (137,55 Go free) # NTFS
# D:\ # Disque fixe local # 11,6 Go (2,13 Go free) [PRESARIO_RP] # NTFS
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\PVSW\Bin\WGE_SRV.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\PVSW\BIN\W3dbsmgr.EXE
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\Installer\MSIDFCC.tmp
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\conime.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\System32\wpcumi.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Micro Application\LauncherMA.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Hp\HP Software Update\HPWUCli.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\msiexec.exe

################## | C: |


################## | C:\Windows |


################## | C:\Windows\system32 |


################## | C:\Windows\system32\drivers |


################## | C:\Users\ghesquiere\AppData\Roaming |

################## | Autres detections ... |

################## | Temporary Internet Files |


################## | Registre / Clés infectieuses |

Présent ! [HKLM\software\microsoft\security center\Svc] "AntiVirusOverride"  
Présent ! [HKLM\software\microsoft\security center\Svc] "FirewallOverride"  

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# Uac : OK 
 
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Wlansvc -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# windefend -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V5.017 ! |

totobetourne · Answer

comment se comporte ton pc?

murmur1 · Answer

a part kaspersky que je ne sais réinstaller, donc j'ai mis avast pour ne pas rester sans rien
avast a fait un scan et trouvé dans appdata/local/temp/bis de2e.exe un trojan win32:swizbased-gen et aussi dans fleshinstaller.ese un win32:adware-gen - j'ai demandé la mise en quarantaine
J'ai aussi un programme qui se mettais en marche au demarrage et qui ne sais plus du genre advistor, un programme qui recherche sur internet des mises à jour commerciales ou autres de chez hp

je crois que le reste fonctionne correctement, je n'ai pas encore tous testé !
vous en pensez quoi ?
Merci

totobetourne · Answer

cela parait donc pas mal.

garde cet antimalware.
passe cet antimalware, fait comme indique
Telecharges malwaresbytes antimalwares(MBAM) : egalement tres util sur pb de pub mais pas tous malheureusement

Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Tutoriel Malwarebytes Anti-Malware: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm 
fais comme indique,mise a jour , scan complet en mode sans echec et les rapports.
COLLE LE RAPPORT APRES SUPPRESSION MERCI.

garde le et lance un scan tout les mois comme indique.

si tu as ad aware tu peux desinstalle car il ne reconnait plus grand chose.

murmur1 · Answer

j'ai effectué un scan, un nettoyage, un rapport qui est ci-dessous 

mon ordi a l'air stabilisé mais il ne lance plus la barre hpadvisor (ou quelque chose du genre), mais c'est pas vital
il y a quelque temps je pensais faire une sauvegarde de mes fichiers les transferer sur  un autre ordi et réinitialiser celui ci. est ce possible maintenant pour les fichiers ? il n'y a pas de probleme d'infester l'autre appareil ? existe il un forum ou autre pour une aide pour executer ces manip sans proleme ?

je risque beaucoup avec avast ?

le rapport final :
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3106
Windows 6.0.6000

05/11/2009 23:19:41
mbam-log-2009-11-05 (23-19-41).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|)
Eléments examinés: 327154
Temps écoulé: 1 hour(s), 18 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 31
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\smart-shopper.hbax (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.hbax.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.hbinfoband (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.hbinfoband.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebutton (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebutton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebuttona (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebuttona.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebuttonb (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.iebuttonb.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{90f62ef7-58d1-4e8e-bb3e-cfb10ba9e47b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b2b92bc9-e149-4ee8-a93e-0b8cfb329808} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79b1445-dfea-4bef-a786-e0c0f33c863b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4cf088bd-be95-40a5-be9b-677f8683edea} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6fac4823-815e-4361-836e-46d65ed2550b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{911f251e-34fd-465e-b6ce-df00ff49a6be} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{fe4f1649-8909-49c0-87ba-24d65120db46} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{022c671f-6cba-4a03-a8f9-3b3a361b235a} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{305c6cb1-9d31-4489-881d-5a8e2dc3fe14} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{8ad815fc-607b-419f-8b70-d345a507a54e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\ghesquiere\AppData\Local\Temp\vista\Vista.exe (Trojan.Agent) -> Quarantined and deleted successfully.

totobetourne · Answer

comment se comporte ton pc?

refais un nouveau rsit et colle le merci.
je pense que cela doit aller bien mieux.

totobetourne · Answer

oui j oubliai

on va enlever boonty games aussi pas tres recommande.
telecharge cela et fait le fonctionner en option A.colle le rapport.

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe




 Déconnectes toi et fermes toutes applications en cours !

 Relances "Ad-remover" : au menu principal choisi l'option "B" .
? Ensuite coche: (le numero devant et entree)

Boonty/Boonty Games
eorezo
.......
 Puis "S"

 le programme va travailler ...

 Postes le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

/!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\

Pbl message KIS avp.exe pas application32

34 réponses

Discussions similaires