Isass.exe et Update.exe, désespéré :( Résolu

Question

Bonjour,

Voilà ça fait 3 - 4 jour que je suis infecté par un virus / trojan qui s'execute à chaque demarage de mon pc (et ce même en mode sans echec) et qui prend la forme du processus update.exe et Isass.exe, je ne sais pas lequel des deux est un virus (les deux ?) tout ce que je peux dire, c'est que lorsque je ferme "isass.exe" mon ordi redémarre après avoir été alerté par une boite de dialogue qui m'invite à enregistrer tout mon travail.
En ce qui concerne update.exe, ce processus n'est tout bonnement pas fermable et il occupe constamment mon processeur.

Le problème étant qu'en plus d'être ralentis (pourtant difficile vu ma configuration assez musclée), mon pc et windows sont sujet à d'autres bugs qui m'empêchent d'utiliser certains jeux / logiciels correctement.

Je précise que ni Kaspersky ni spybot n'ont pu faire quelque chose ! Kapersky a bien detecté les 2 problèmes et les a mit en quarantaine, sauf que ça a duré 2 heures puis il se sont libérés (lol quelle image ^^)

Je vous colle ici le rapport Hijack This, ainsi que son interpretation (ils ne font pas mention d'update.exe comme d'une menace, pourtant ça m'en a tout l'air) : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:24:52, on 09/11/2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\Logitech\Logitech Vid\Vid.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Razer\Salmosaazerhid.exe
C:\Program Files (x86)\Razer\Reclusaazerhid.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Windows\framework.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files (x86)\Razer\Reclusaazertra.exe
C:\Program Files (x86)\Razer\Salmosaazerofa.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\SysWOW64\update.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (file missing)
O4 - HKLM\..\Run: [Window Proxy Service] C:\Windows\System32\update.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Salmosa] C:\Program Files (x86)\Razer\Salmosaazerhid.exe
O4 - HKLM\..\Run: [Reclusa] C:\Program Files (x86)\Razer\Reclusaazerhid.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [framework] framework.exe
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [Lsass Service] C:\Users\Arnaud\AppData\Roaming\Microsoft\Windows\lsass.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe" -bootmode
O4 - HKCU\..\Run: [Google Update] "C:\Users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Defence] "C:\ProgramData\Defence\smss.exe" -SystemDefence
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O4 - Startup: Logitech . Enregistrement du produit.lnk = C:\Program Files\Logitech\Logitech WebCam Software\eReg.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASKService - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\ASKUpgrade.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)


Le site http://www.hijackthis.de/fr interprète comme une menace les choses suivantes : 

O4 - HKCU\..\Run: [Lsass Service] C:\Users\Arnaud\AppData\Roaming\Microsoft\Windows\lsass.exe

Très dangereux, Effacer à tout prix ! Added by the RATSOU.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a DebugUserMode subfolder of the Winnt or Windows folder

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

Méchant, cette tâche devrait se trouver dans le répertoire System32. Ce service (lsass.exe) semble être méchant.
Tâche ne se trouve pas dans le répertoire System32 !

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

Idem

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

Idem 



Voilà je remercie énormément celui ou celle qui m'aidera, j'en ai vraiment besoin :(

moment de grace · Accepted Answer

ok

on va essayé de t'aider

mais deux handicaps

- le 64 bits de ton pc incompatible avec la plupart des outils 
- le ton de ton dernier post incompatible avec les règles de politesse 

ceci etant dit

pour en savoir un peu plus sur ton soucis

• Télécharge Random's System Information Tool (RSIT) de Random/Random. 

http://images.malwareremoval.com/random/RSIT.exe 

• Enregistre le sur ton Bureau. 

• Double clique sur RSIT.exe pour lancer l'outil. 

• Clique sur "Continue" à l'écran Disclaimer. 

• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) 

et tu devras accepter la licence. 

• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

Les rapports se trouvent à cet endroit: 
C:\rsit\info.txt 
C:\rsit\log.txt

moment de grace · Answer

...

Gpowaaa · Answer

Hyper constructif, merci !

moment de grace · Answer

erreur de manipulation et de sujet

(désolé)

gen-hackman · Answer

salut momeent de grace pour repondre a ton mp , il y a plus urgent que mon tool a passer sur cet ordi :

USBFix

Gpowaaa · Answer

Merci de bien vouloir discuter de vos histoires ailleurs que sur mon sujet, j'ai besoin d'aide, merde -_-

Gpowaaa · Answer

Désolé pour le "ton" de mon précédent message, mais c'est légitime pour quelqu'un qui réclame de l'aide et qui voit son sujet pollué ... arf.

J'ai un souci avec RSIT, une erreure
 "line-1
Error: Variable used without being declared"

Surement due au 64 bits ?

moment de grace · Answer

ok

gen a dit de passer usbfix

alors faisons le si tu veux bien


Téléchargez USBFIX de Chiquitine29, C_xx 
https://www.androidworld.fr/
ou
https://www.ionos.fr/?affiliate_id=77097


/!\ Utilisateur de vista et windows 7 : ne pas oublier de désactiver Le contrôle des comptes utilisateurs 
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac 

/!\ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir 

• Double clic sur le raccourci UsbFix présent sur le bureau . 

• Choisir l'option 1 (Recherche) 
(d’autres options disponibles, voir le tutoriel). 
• Laissez travailler l'outil. 

• Ensuite postez le rapport UsbFix.txt qui apparaîtra. 

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt ) 

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html

Gpowaaa · Answer

Merci beaucoup : 


############################## | UsbFix V6.050 |

User : Arnaud (Administrateurs) # ARNAUD-PC
Update on 09/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 16:54:06 | 09/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Quad CPU    Q9400  @ 2.66GHz
Microsoft Windows 7 Professionnel  (6.1.7600 64-bit) # 
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 465,56 Go (415,91 Go free) # NTFS
D:\ -> Disque fixe local # 200 Mo (182,24 Mo free) # NTFS
E:\ -> Disque CD-ROM

############################## | Processus actifs |

C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe 1564
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe 1964
C:\Program Files (x86)\Logitech\Logitech Vid\Vid.exe 2668
C:\Program Files (x86)\Java\jre6\bin\jusched.exe 2856
C:\Program Files (x86)\Razer\Salmosa\razerhid.exe 3108
C:\Program Files (x86)\Razer\Reclusa\razerhid.exe 3128
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe 3140
C:\Windows\framework.exe 3232
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe 3276
C:\Program Files (x86)\Razer\Reclusa\razertra.exe 3384
C:\Program Files (x86)\Razer\Salmosa\razerofa.exe 3424
C:\Windows\SysWOW64\NOTEPAD.EXE 3680
C:\Program Files (x86)\Steam\Steam.exe 2932
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 1756
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 2036
C:\Program Files (x86)\Vuze\Azureus.exe 4404
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 1248

################## | Fichiers # Dossiers infectieux |

C:\Windows\SysWOW64\update.exe 

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |


################## | Suspect | https://www.virustotal.com/gui/ |


################## | Cracks / Keygens / Serials |

"C:\Users\Arnaud\Documents\Azureus Downloads\Adobe Illustrator CS4 (Multilingual) [RH]\AI_CS4_[RH]\Adobe Illustrator CS4\Keygen\adobe-master-cs4-keygen.exe"  
25/10/2008 03:04 |Size 94208 |Crc32 86ac7237 |Md5 4a0924ec5a96895ef65666a0cc97b48c  
 
"C:\Users\Arnaud\Documents\Azureus Downloads\Adobe Illustrator CS4 (Multilingual) [RH]\AI_CS4_[RH]\Adobe Illustrator CS4\Keygen\CS4MCLG.EXE"  
25/10/2008 03:04 |Size 469268 |Crc32 bde1a9a0 |Md5 366480d909b7c917f73b27336ce86432  
 

################## | ! Fin du rapport # UsbFix V6.050 ! |

moment de grace · Answer

Désactiver le TeaTimer de Spybot (Merci à Nico et nathandre): 
Pour désactiver le TeaTimer : 
=> Ouvrir Spybot S&D 
=> Dans le menu "Mode", séléctionner le mode avancé. 
=> Une fenêtre demande confirmation cliquer sur "oui". 
=> Une fois le mode avancé actif, ouvrir l'onglet "Outils". 
=> Cliquer sur Résident. 
=> La partie Résident comporte deux lignes qui sont normalement cochées : 
*Résident "SDHelper" (bloqueur de téléchargements nuisibles pour Internet Explorer) actif. 
* Résident "TeaTimer" (Protection des réglages système fondamentaux) actif 
=> Décocher la ligne TeaTimer. 
=> Redémarrer Spybot (le fermer et le réouvrir) 
=> Retourner dans le menu Résident et vérifier qu'il soit bien désactivé 

Spybot va géner les outils
......................................................
&#9679; Relance UsbFix 

&#9679; Dans le menu principale cette fois choisit l'option2 

 Le menu démarrer et les icônes vont à nouveau disparaître.. c'est normal. 

Si un message te demande de redémarrer l'ordinateur fais le ... 

&#9679; Au redémarrage, le fix se relance... laisses l'opération s'effectuer. 

&#9679; Le bloc note s'ouvre avec un rapport, envoies le dans la prochaine réponse

Gpowaaa · Answer

############################## | UsbFix V6.050 |

User : Arnaud (Administrateurs) # ARNAUD-PC
Update on 09/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 17:02:57 | 09/11/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Quad CPU    Q9400  @ 2.66GHz
Microsoft Windows 7 Professionnel  (6.1.7600 64-bit) # 
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local # 465,56 Go (415,91 Go free) # NTFS
D:\ -> Disque fixe local # 200 Mo (182,24 Mo free) # NTFS
E:\ -> Disque CD-ROM

############################## | Processus actifs |

C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe 1564
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe 1964
C:\Program Files (x86)\Java\jre6\bin\jusched.exe 2856
C:\Program Files (x86)\Razer\Salmosa\razerhid.exe 3108
C:\Program Files (x86)\Razer\Reclusa\razerhid.exe 3128
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe 3140
C:\Windows\framework.exe 3232
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe 3276
C:\Program Files (x86)\Razer\Reclusa\razertra.exe 3384
C:\Program Files (x86)\Razer\Salmosa\razerofa.exe 3424
C:\Program Files (x86)\Steam\Steam.exe 2932
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 1756
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 2036
C:\Program Files (x86)\Vuze\Azureus.exe 4404
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 1248
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE 3392
C:\Windows\SysWOW64\update.exe 1832

################## | Fichiers # Dossiers infectieux |

C:\Windows\SysWOW64\update.exe 

################## | Registre # Clés Run infectieuses |


################## | Registre # Mountpoints2 |


################## | Suspect | https://www.virustotal.com/gui/ |


################## | Cracks / Keygens / Serials |

"C:\Users\Arnaud\Documents\Azureus Downloads\Adobe Illustrator CS4 (Multilingual) [RH]\AI_CS4_[RH]\Adobe Illustrator CS4\Keygen\adobe-master-cs4-keygen.exe"  
25/10/2008 03:04 |Size 94208 |Crc32 86ac7237 |Md5 4a0924ec5a96895ef65666a0cc97b48c  
 
"C:\Users\Arnaud\Documents\Azureus Downloads\Adobe Illustrator CS4 (Multilingual) [RH]\AI_CS4_[RH]\Adobe Illustrator CS4\Keygen\CS4MCLG.EXE"  
25/10/2008 03:04 |Size 469268 |Crc32 bde1a9a0 |Md5 366480d909b7c917f73b27336ce86432  
 

################## | ! Fin du rapport # UsbFix V6.050 ! |

moment de grace · Answer

Recherche

  Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent 

&#9654; Télécharge List&Kill'em et enregistre le sur ton bureau 
http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem.exe

Il ne nécessite pas d'installation 

&#9654;double clic (clic droit "exécuter en tant qu'administrateur" pour Vista) pour lancer le scan 

choisis la langue puis choisis l'option 1 = Mode Recherche 

&#9654;laisse travailler l'outil 

le rapport va s'afficher , une fois le scan fini 

&#9654;colle le contenu sur un forum spécialisé

Gpowaaa · Answer

Moment de grace, une fois le scan terminé, le rapport ne s'affiche... pas ! 
C'est gen qui a développé cette application ? Quel talent ^^

moment de grace · Answer

et on peut lui faire confiance

ici

C:\Kill'em.txt

Gpowaaa · Answer

List'em by g3n-h@ckm@n 1.0.5.2 

Thx to Chiquitine29..... 

User : Arnaud (Administrateurs) # ARNAUD-PC
Update on 07/11/2009 by g3n-h@ckm@n ::::: 20.00 
Start at: 17:12:51 | 09/11/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 Quad CPU    Q9400  @ 2.66GHz
Microsoft Windows 7 Professionnel  (6.1.7600 64-bit) # 
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 465,56 Go (415,9 Go free) | NTFS
D:\ -> Disque fixe local | 200 Mo (182,24 Mo free) | NTFS
E:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus en cours 

C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe 1564
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe 1964
C:\Program Files (x86)\Java\jre6\bin\jusched.exe 2856
C:\Program Files (x86)\Razer\Salmosaazerhid.exe 3108
C:\Program Files (x86)\Razer\Reclusaazerhid.exe 3128
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe 3140
C:\Windows\framework.exe 3232
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe 3276
C:\Program Files (x86)\Razer\Reclusaazertra.exe 3384
C:\Program Files (x86)\Razer\Salmosaazerofa.exe 3424
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 1756
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 2036
C:\Program Files (x86)\Vuze\Azureus.exe 4404
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 1248
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE 3392
C:\Users\Arnaud\Documents\Downloads\List_Killem.exe 3240
C:\Windows\SysWOW64\cmd.exe 1068
C:\Windows\SysWOW64\update.exe 4364
C:\Users\Arnaud\AppData\Local\Temp\60AB.tmp\pv.exe 4476

======================
Cles de demarrage "Run" 
======================
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lsass Service"="C:\Users\Arnaud\AppData\Roaming\Microsoft\Windows\lsass.exe"
"Steam"="\"C:\Program Files (x86)\Steam\Steam.exe\" -silent"
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun"
"msnmsgr"="\"C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe\" /background"
"Logitech Vid"="\"C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe\" -bootmode"
"Google Update"="\"C:\Users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe\" /c"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater]
@=""

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Window Proxy Service"="C:\Windows\System32\update.exe"
"SunJavaUpdateSched"="\"C:\Program Files (x86)\Java\jre6\bin\jusched.exe\""
"StartCCC"="\"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe\" MSRun"
"Salmosa"="C:\Program Files (x86)\Razer\Salmosa\razerhid.exe"
"Reclusa"="C:\Program Files (x86)\Razer\Reclusa\razerhid.exe"
"LogitechQuickCamRibbon"="\"C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe\" /hide"
"GrooveMonitor"="\"C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe\""
"framework"="framework.exe"
"avast!"="\"C:\Program Files\Alwil Software\Avast4\ashDisp.exe\""
"ATICustomerCare"="\"C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe\""
"AdobeCS4ServiceManager"="\"C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe\" -launchedbylogin"

=====================
cles additionnelles
=====================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000000
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000000
"EnableSecureUIAPaths"=dword:00000001
"EnableUIADesktopToggle"=dword:00000000
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000000
"ValidateAdminCodeSignatures"=dword:00000000
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=dword:00000001
"CF_BITMAP"=dword:00000002
"CF_OEMTEXT"=dword:00000007
"CF_DIB"=dword:00000008
"CF_PALETTE"=dword:00000009
"CF_UNICODETEXT"=dword:0000000d
"CF_DIBV5"=dword:00000011

=============== 
=============== 
=============== 
=============== 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"

======
BHO :
====== 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
@="AskBar BHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
"NoExplorer"=dword:00000001

==========================
 
=========================
Environnement variables :
=========================

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Arnaud\AppData\Roaming
choix=1
com.adobe.versioncue.client.applocale=fr_FR
com.adobe.versioncue.client.appname=AdobeDrive
com.adobe.versioncue.client.appversion=1.0.0
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=ARNAUD-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Arnaud
LOCALAPPDATA=C:\Users\Arnaud\AppData\Local
LOGONSERVER=\ARNAUD-PC
NUMBER_OF_PROCESSORS=4
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=170a
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Arnaud\AppData\Local\Temp
TMP=C:\Users\Arnaud\AppData\Local\Temp
USERDOMAIN=Arnaud-PC
USERNAME=Arnaud
USERPROFILE=C:\Users\Arnaud
windir=C:\Windows


¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

C:\ProgramData\Application Data\Microsoft\Network\Downloader\qmgr0.dat  
C:\ProgramData\Application Data\Microsoft\Network\Downloader\qmgr1.dat  
C:\Program Files (x86)\AskBarDis  
C:\Windows\System32\EXPLORER.exe  
C:\Windows\system32egedit.exe  
C:\Users\Arnaud\LOCAL Settings\Temp\i4jdel0.exe  
C:\Users\Arnaud\LOCAL Settings\Temp	mpB0D7.tmp  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}"  
HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}  
HKCR\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}  
HKCR\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}  
HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}  
HKCU\Software\AppDataLow\AskBarDis  
HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}  
HKLM\Software\Classes\CLSID\{201F27D4-3704-41D6-89C1-AA35E39143ED}  
HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}  
HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}  
HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}  
HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}  
 
¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch : 

A.EXE-D6DD358C.pf
AgAppLaunch.db
AgCx_S1_S-1-5-21-2169408276-3351055424-2953610032-1001.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgCx_SC3_351C873C957626D6.db
AgCx_SC4.db
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-2169408276-3351055424-2953610032-1001.db
AgGlUAD_S-1-5-21-2169408276-3351055424-2953610032-1001.db
AgRobust.db
ARNAUD.EXE-DA49B1B1.pf
AUDIODG.EXE-BDFD3029.pf
AVAST.SETUP-499863F4.pf
AVP.EXE-198019CE.pf
AZUREUS.EXE-997C5496.pf
BYPASS.EXE-DC482312.pf
CCC.EXE-B637C9BF.pf
CHROME.EXE-FF44655B.pf
CMD.EXE-4A81B364.pf
CMD.EXE-AC113AA8.pf
CONHOST.EXE-1F3E9D7E.pf
CSCRIPT.EXE-0FB3F22C.pf
DLLHOST.EXE-0F564EEF.pf
DLLHOST.EXE-40DD444D.pf
DLLHOST.EXE-5E46FA0D.pf
DLLHOST.EXE-766398D2.pf
DLLHOST.EXE-7CE224E3.pf
DLLHOST.EXE-ECB71776.pf
DLLHOST.EXE-F2DCEF0D.pf
DRVINST.EXE-4CB4314A.pf
DWM.EXE-6FFD3DA8.pf
ECHOX.EXE-66E8E49C.pf
EXPLORER.EXE-A80E4F97.pf
FIND.EXE-9AADDA11.pf
FINDSTR.EXE-6C611AA6.pf
FOXIT READER.EXE-B500FA00.pf
FSUM.EXE-70BEB6D0.pf
FXBEAGLE.EXE-90CD92E7.pf
GAMEOVERLAYUI.EXE-86F598D5.pf
GOOGLECRASHHANDLER.EXE-F16C183F.pf
GOOGLEUPDATE.EXE-C9C472C6.pf
HH.EXE-21B3A58C.pf
HIJACKTHIS.EXE-A567F544.pf
HIJACKTHIS_HIJACKTHIS_2.02_AN-FCD881C0.pf
HL2.EXE-E4BD69F4.pf
I4JDEL0.EXE-8BDC0684.pf
JAVA.EXE-873AF69D.pf
JUSCHED.EXE-B1F91DE1.pf
KILL.EXE-F39F8535.pf
KMPLAYER.EXE-924C3C38.pf
Layout.ini
LEFT4DEAD2.EXE-D5B12F91.pf
LIST_KILLEM.EXE-821191C6.pf
LOGITECHUPDATE.EXE-4F06E135.pf
LOGONUI.EXE-09140401.pf
LULNCHR.EXE-37E1482B.pf
LVPRCSRV.EXE-A94CF8D0.pf
MODE.COM-93BF1B26.pf
MPNOTIFY.EXE-83D4091E.pf
MRT.EXE-E6A4B13B.pf
MRTSTUB.EXE-04584485.pf
MSCONFIG.EXE-3A52734E.pf
MSIEXEC.EXE-A2D55CB6.pf
MSIEXEC.EXE-E09A077A.pf
MSNMSGR.EXE-D22CE80C.pf
NOTEPAD.EXE-1605FA5B.pf
NOTEPAD.EXE-D8414F97.pf
NTOSBOOT-B00DFAAD.pf
OPTIONALFEATURES.EXE-27133C71.pf
OSD.EXE-9E9517FA.pf
OUTLOOK.EXE-B38D9BB7.pf
PfSvPerfStats.bin
PREVHOST.EXE-4F1C4E0F.pf
PV.EXE-2A53ADAE.pf
PV.EXE-62C0ED2A.pf
PV.EXE-86ED9CA2.pf
RAREXTLOADER.EXE-8405D981.pf
RAZERCFG.EXE-C4D71BA8.pf
RAZEROFA.EXE-838A3D1B.pf
ReadyBoot
REG.EXE-4978446A.pf
REGSVR32.EXE-8461DBEE.pf
REGSVR32.EXE-D5170E12.pf
RSIT.EXE-7EBFDF5B.pf
RSTRUI.EXE-2D50C58D.pf
RUNDLL32.EXE-230FC512.pf
RUNDLL32.EXE-40B5D617.pf
RUNDLL32.EXE-7FCEEBC4.pf
RUNDLL32.EXE-A4C73158.pf
RUNDLL32.EXE-E3169C85.pf
SC.EXE-945D79AE.pf
SDCLT.EXE-E10B972A.pf
SEARCHFILTERHOST.EXE-77482212.pf
SEARCHINDEXER.EXE-4A6353B9.pf
SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf
SETPATH.EXE-3631AA0E.pf
SETUP_WIN32.EXE-3EE03BEE.pf
SIDEBAR.EXE-FA75EA61.pf
SPLWOW64.EXE-297C4568.pf
SPPSVC.EXE-B0F8131B.pf
SPYBOTSD.EXE-A906589D.pf
STEAM.EXE-D0A3496D.pf
SVCHOST.EXE-05F624AB.pf
SVCHOST.EXE-7CFEDEA3.pf
SVCHOST.EXE-80F4A784.pf
SVCHOST.EXE-C871F054.pf
SVCHOST.EXE-E2C2633A.pf
SWREG.EXE-BE5D1A81.pf
TASKENG.EXE-48D4E289.pf
TASKHOST.EXE-7238F31D.pf
TASKMGR.EXE-5F5F473D.pf
TEATIMER.EXE-BFF02B54.pf
TRUSTEDINSTALLER.EXE-3CC531E5.pf
UPDATE.EXE-991B0C73.pf
USBFIX.EXE-65807BBE.pf
USERACCOUNTCONTROLSETTINGS.EX-1B2F66BE.pf
USERINIT.EXE-2257A3E7.pf
VDS.EXE-6E7946F9.pf
VDSLDR.EXE-6B089E8B.pf
VLC.EXE-CC6F4A79.pf
VSSVC.EXE-B8AFC319.pf
WBENGINE.EXE-28FD7E8B.pf
WERMGR.EXE-0F2AC88C.pf
WINDOWS-KB890830-V3.0.EXE-BD29B88A.pf
WINRAR.EXE-D8B532BF.pf
WINWORD.EXE-CEA9B574.pf
WLCOMM.EXE-324C9362.pf
WLRMDR.EXE-C2B47318.pf
WMI64.EXE-519A127C.pf
WMIADAP.EXE-F8DFDFA2.pf
WMIPRVSE.EXE-1628051C.pf
WMPNETWK.EXE-D9F2A96F.pf
WMPNSCFG.EXE-FC0D39BF.pf
WOW_HELPER.EXE-E0AE8DD9.pf
WUAUCLT.EXE-70318591.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

moment de grace · Answer

Suppression


REDEMARRE EN MODE SANS ECHEC 

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

&#9654; Relance List&Kill'em  (clic droit pour vista), 

mais cette fois-ci : 

&#9654; choisis l'option 2 = Mode Destruction 

laisse travailler l'outil 

apres les verifications , un rapport va s'ouvrir. 

&#9654; ferme-le. 

un deuxieme rapport va s'ouvrir , 

&#9654; colle son contenu dans ta reponse apres avoir redemarré en mode normal

Gpowaaa · Answer

Il n'ya a que le 1er rapport qui s'est ouvert, j'imagine donc que celui que je suis allé chercher dans C: est celui là ?



Kill'em by g3n-h@ckm@n 1.0.5.2 
 
User : Arnaud () # ARNAUD-PC
Update on 07/11/2009 by g3n-h@ckm@n ::::: 20.00 
Start at: 17:32:29 | 09/11/2009
Contact : g3n-h@ckm@n sur CCM



Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled


 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus en cours
 

C:\Users\Arnaud\Documents\Downloads\List_Killem.exe 924
C:\Windows\SysWOW64\cmd.exe 368
C:\Windows\SysWOW64\update.exe 988
C:\Users\Arnaud\AppData\Local\Temp\4401.tmp\pv.exe 616
 
Fichiers analysés : 
================= 
 

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents : 

"C:\ProgramData\Application Data\Microsoft\Network\Downloader\qmgr0.dat"  
"C:\ProgramData\Application Data\Microsoft\Network\Downloader\qmgr1.dat"  
"C:\Program Files (x86)\AskBarDis"  
"C:\Windows\System32\EXPLORER.exe"  
"C:\Windows\system32egedit.exe"  
C:\Users\Arnaud\LOCAL Settings\Temp\i4jdel0.exe  
C:\Users\Arnaud\LOCAL Settings\Temp	mpB0D7.tmp  
 
 
¤¤¤¤¤¤¤¤¤¤ Action sur les fichiers : 
  
Quarantaine : 

AskBarDis.Kill'em
i4jdel0.exe.Kill'em
qmgr0.dat.Kill'em
qmgr1.dat.Kill'em
tmpB0D7.tmp.Kill'em

 
===================================
tentative de correction du registre
===================================
¤¤¤¤¤¤¤¤¤¤ Verification : 
 

List'em by g3n-h@ckm@n 1.0.5.2 

Thx to Chiquitine29..... 

User : Arnaud (Administrateurs) # ARNAUD-PC
Update on 07/11/2009 by g3n-h@ckm@n ::::: 20.00 
Start at: 17:12:51 | 09/11/2009
Contact : g3n-h@ckm@n sur CCM

Intel(R) Core(TM)2 Quad CPU    Q9400  @ 2.66GHz
Microsoft Windows 7 Professionnel  (6.1.7600 64-bit) # 
Internet Explorer 8.0.7600.16385
Windows Firewall Status : Enabled

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 465,56 Go (415,9 Go free) | NTFS
D:\ -> Disque fixe local | 200 Mo (182,24 Mo free) | NTFS
E:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus en cours 

C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe 1564
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe 1964
C:\Program Files (x86)\Java\jre6\bin\jusched.exe 2856
C:\Program Files (x86)\Razer\Salmosaazerhid.exe 3108
C:\Program Files (x86)\Razer\Reclusaazerhid.exe 3128
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe 3140
C:\Windows\framework.exe 3232
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe 3276
C:\Program Files (x86)\Razer\Reclusaazertra.exe 3384
C:\Program Files (x86)\Razer\Salmosaazerofa.exe 3424
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 1756
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 2036
C:\Program Files (x86)\Vuze\Azureus.exe 4404
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe 1248
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE 3392
C:\Users\Arnaud\Documents\Downloads\List_Killem.exe 3240
C:\Windows\SysWOW64\cmd.exe 1068
C:\Windows\SysWOW64\update.exe 4364
C:\Users\Arnaud\AppData\Local\Temp\60AB.tmp\pv.exe 4476

======================
Cles de demarrage "Run" 
======================
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lsass Service"="C:\Users\Arnaud\AppData\Roaming\Microsoft\Windows\lsass.exe"
"Steam"="\"C:\Program Files (x86)\Steam\Steam.exe\" -silent"
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe /autoRun"
"msnmsgr"="\"C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe\" /background"
"Logitech Vid"="\"C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe\" -bootmode"
"Google Update"="\"C:\Users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe\" /c"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater]
@=""

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Window Proxy Service"="C:\Windows\System32\update.exe"
"SunJavaUpdateSched"="\"C:\Program Files (x86)\Java\jre6\bin\jusched.exe\""
"StartCCC"="\"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe\" MSRun"
"Salmosa"="C:\Program Files (x86)\Razer\Salmosa\razerhid.exe"
"Reclusa"="C:\Program Files (x86)\Razer\Reclusa\razerhid.exe"
"LogitechQuickCamRibbon"="\"C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe\" /hide"
"GrooveMonitor"="\"C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe\""
"framework"="framework.exe"
"avast!"="\"C:\Program Files\Alwil Software\Avast4\ashDisp.exe\""
"ATICustomerCare"="\"C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe\""
"AdobeCS4ServiceManager"="\"C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe\" -launchedbylogin"

=====================
cles additionnelles
=====================
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000000
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000000
"EnableSecureUIAPaths"=dword:00000001
"EnableUIADesktopToggle"=dword:00000000
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000000
"ValidateAdminCodeSignatures"=dword:00000000
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=dword:00000001
"CF_BITMAP"=dword:00000002
"CF_OEMTEXT"=dword:00000007
"CF_DIB"=dword:00000008
"CF_PALETTE"=dword:00000009
"CF_UNICODETEXT"=dword:0000000d
"CF_DIBV5"=dword:00000011

=============== 
=============== 
=============== 
=============== 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"

======
BHO :
====== 
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
@="AskBar BHO"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
"NoExplorer"=dword:00000001

==========================
 
=========================
Environnement variables :
=========================

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Arnaud\AppData\Roaming
choix=1
com.adobe.versioncue.client.applocale=fr_FR
com.adobe.versioncue.client.appname=AdobeDrive
com.adobe.versioncue.client.appversion=1.0.0
CommonProgramFiles=C:\Program Files (x86)\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=ARNAUD-PC
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Arnaud
LOCALAPPDATA=C:\Users\Arnaud\AppData\Local
LOGONSERVER=\ARNAUD-PC
NUMBER_OF_PROCESSORS=4
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=170a
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files (x86)
ProgramFiles(x86)=C:\Program Files (x86)
ProgramW6432=C:\Program Files
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Arnaud\AppData\Local\Temp
TMP=C:\Users\Arnaud\AppData\Local\Temp
USERDOMAIN=Arnaud-PC
USERNAME=Arnaud
USERPROFILE=C:\Users\Arnaud
windir=C:\Windows


¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

C:\ProgramData\Application Data\Microsoft\Network\Downloader\qmgr0.dat  
C:\ProgramData\Application Data\Microsoft\Network\Downloader\qmgr1.dat  
C:\Program Files (x86)\AskBarDis  
C:\Windows\System32\EXPLORER.exe  
C:\Windows\system32egedit.exe  
C:\Users\Arnaud\LOCAL Settings\Temp\i4jdel0.exe  
C:\Users\Arnaud\LOCAL Settings\Temp	mpB0D7.tmp  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}"  
HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}  
HKCR\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}  
HKCR\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}  
HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}  
HKCU\Software\AppDataLow\AskBarDis  
HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}  
HKLM\Software\Classes\CLSID\{201F27D4-3704-41D6-89C1-AA35E39143ED}  
HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}  
HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}  
HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}  
HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}  
 
¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch : 

A.EXE-D6DD358C.pf
AgAppLaunch.db
AgCx_S1_S-1-5-21-2169408276-3351055424-2953610032-1001.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgCx_SC3_351C873C957626D6.db
AgCx_SC4.db
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-2169408276-3351055424-2953610032-1001.db
AgGlUAD_S-1-5-21-2169408276-3351055424-2953610032-1001.db
AgRobust.db
ARNAUD.EXE-DA49B1B1.pf
AUDIODG.EXE-BDFD3029.pf
AVAST.SETUP-499863F4.pf
AVP.EXE-198019CE.pf
AZUREUS.EXE-997C5496.pf
BYPASS.EXE-DC482312.pf
CCC.EXE-B637C9BF.pf
CHROME.EXE-FF44655B.pf
CMD.EXE-4A81B364.pf
CMD.EXE-AC113AA8.pf
CONHOST.EXE-1F3E9D7E.pf
CSCRIPT.EXE-0FB3F22C.pf
DLLHOST.EXE-0F564EEF.pf
DLLHOST.EXE-40DD444D.pf
DLLHOST.EXE-5E46FA0D.pf
DLLHOST.EXE-766398D2.pf
DLLHOST.EXE-7CE224E3.pf
DLLHOST.EXE-ECB71776.pf
DLLHOST.EXE-F2DCEF0D.pf
DRVINST.EXE-4CB4314A.pf
DWM.EXE-6FFD3DA8.pf
ECHOX.EXE-66E8E49C.pf
EXPLORER.EXE-A80E4F97.pf
FIND.EXE-9AADDA11.pf
FINDSTR.EXE-6C611AA6.pf
FOXIT READER.EXE-B500FA00.pf
FSUM.EXE-70BEB6D0.pf
FXBEAGLE.EXE-90CD92E7.pf
GAMEOVERLAYUI.EXE-86F598D5.pf
GOOGLECRASHHANDLER.EXE-F16C183F.pf
GOOGLEUPDATE.EXE-C9C472C6.pf
HH.EXE-21B3A58C.pf
HIJACKTHIS.EXE-A567F544.pf
HIJACKTHIS_HIJACKTHIS_2.02_AN-FCD881C0.pf
HL2.EXE-E4BD69F4.pf
I4JDEL0.EXE-8BDC0684.pf
JAVA.EXE-873AF69D.pf
JUSCHED.EXE-B1F91DE1.pf
KILL.EXE-F39F8535.pf
KMPLAYER.EXE-924C3C38.pf
Layout.ini
LEFT4DEAD2.EXE-D5B12F91.pf
LIST_KILLEM.EXE-821191C6.pf
LOGITECHUPDATE.EXE-4F06E135.pf
LOGONUI.EXE-09140401.pf
LULNCHR.EXE-37E1482B.pf
LVPRCSRV.EXE-A94CF8D0.pf
MODE.COM-93BF1B26.pf
MPNOTIFY.EXE-83D4091E.pf
MRT.EXE-E6A4B13B.pf
MRTSTUB.EXE-04584485.pf
MSCONFIG.EXE-3A52734E.pf
MSIEXEC.EXE-A2D55CB6.pf
MSIEXEC.EXE-E09A077A.pf
MSNMSGR.EXE-D22CE80C.pf
NOTEPAD.EXE-1605FA5B.pf
NOTEPAD.EXE-D8414F97.pf
NTOSBOOT-B00DFAAD.pf
OPTIONALFEATURES.EXE-27133C71.pf
OSD.EXE-9E9517FA.pf
OUTLOOK.EXE-B38D9BB7.pf
PfSvPerfStats.bin
PREVHOST.EXE-4F1C4E0F.pf
PV.EXE-2A53ADAE.pf
PV.EXE-62C0ED2A.pf
PV.EXE-86ED9CA2.pf
RAREXTLOADER.EXE-8405D981.pf
RAZERCFG.EXE-C4D71BA8.pf
RAZEROFA.EXE-838A3D1B.pf
ReadyBoot
REG.EXE-4978446A.pf
REGSVR32.EXE-8461DBEE.pf
REGSVR32.EXE-D5170E12.pf
RSIT.EXE-7EBFDF5B.pf
RSTRUI.EXE-2D50C58D.pf
RUNDLL32.EXE-230FC512.pf
RUNDLL32.EXE-40B5D617.pf
RUNDLL32.EXE-7FCEEBC4.pf
RUNDLL32.EXE-A4C73158.pf
RUNDLL32.EXE-E3169C85.pf
SC.EXE-945D79AE.pf
SDCLT.EXE-E10B972A.pf
SEARCHFILTERHOST.EXE-77482212.pf
SEARCHINDEXER.EXE-4A6353B9.pf
SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf
SETPATH.EXE-3631AA0E.pf
SETUP_WIN32.EXE-3EE03BEE.pf
SIDEBAR.EXE-FA75EA61.pf
SPLWOW64.EXE-297C4568.pf
SPPSVC.EXE-B0F8131B.pf
SPYBOTSD.EXE-A906589D.pf
STEAM.EXE-D0A3496D.pf
SVCHOST.EXE-05F624AB.pf
SVCHOST.EXE-7CFEDEA3.pf
SVCHOST.EXE-80F4A784.pf
SVCHOST.EXE-C871F054.pf
SVCHOST.EXE-E2C2633A.pf
SWREG.EXE-BE5D1A81.pf
TASKENG.EXE-48D4E289.pf
TASKHOST.EXE-7238F31D.pf
TASKMGR.EXE-5F5F473D.pf
TEATIMER.EXE-BFF02B54.pf
TRUSTEDINSTALLER.EXE-3CC531E5.pf
UPDATE.EXE-991B0C73.pf
USBFIX.EXE-65807BBE.pf
USERACCOUNTCONTROLSETTINGS.EX-1B2F66BE.pf
USERINIT.EXE-2257A3E7.pf
VDS.EXE-6E7946F9.pf
VDSLDR.EXE-6B089E8B.pf
VLC.EXE-CC6F4A79.pf
VSSVC.EXE-B8AFC319.pf
WBENGINE.EXE-28FD7E8B.pf
WERMGR.EXE-0F2AC88C.pf
WINDOWS-KB890830-V3.0.EXE-BD29B88A.pf
WINRAR.EXE-D8B532BF.pf
WINWORD.EXE-CEA9B574.pf
WLCOMM.EXE-324C9362.pf
WLRMDR.EXE-C2B47318.pf
WMI64.EXE-519A127C.pf
WMIADAP.EXE-F8DFDFA2.pf
WMIPRVSE.EXE-1628051C.pf
WMPNETWK.EXE-D9F2A96F.pf
WMPNSCFG.EXE-FC0D39BF.pf
WOW_HELPER.EXE-E0AE8DD9.pf
WUAUCLT.EXE-70318591.pf
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ Fichiers et dossiers presents :

C:\Windows\System32\EXPLORER.exe  
C:\Windows\system32egedit.exe  
 
¤¤¤¤¤¤¤¤¤¤ Clés de registre Presentes : 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"  
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}"  
HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}  
HKCR\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}  
HKCR\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}  
HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}  
HKCU\Software\AppDataLow\AskBarDis  
HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}  
HKLM\Software\Classes\CLSID\{201F27D4-3704-41D6-89C1-AA35E39143ED}  
HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}  
HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf}  
HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}  
HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}  
HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150}  
 
¤¤¤¤¤¤¤¤¤¤ C:\Windows\Prefetch : 

AgAppLaunch.db
AgCx_S1_S-1-5-21-2169408276-3351055424-2953610032-1001.snp.db
AgCx_SC1.db
AgCx_SC1.db.trx
AgCx_SC3_351C873C957626D6.db
AgCx_SC4.db
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgGlUAD_P_S-1-5-21-2169408276-3351055424-2953610032-1001.db
AgGlUAD_S-1-5-21-2169408276-3351055424-2953610032-1001.db
AgRobust.db
Layout.ini
NTOSBOOT-B00DFAAD.pf
PfSvPerfStats.bin
ReadyBoot
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

moment de grace · Answer

ok

 Téléchargez MalwareByte's Anti-Malware
  https://www.majorgeeks.com/files/details/malwarebytes_anti_malware.html

  . sur la page cliques sur Télécharger Malwarebyte's Anti-Malware 
. enregistres le sur le bureau 
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation. 
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour 
. si le pare-feu demande l'autorisation de se connecter pour malwarebytes, acceptes 
. Une fois la mise à jour terminé 
. rend-toi dans l'onglet, Recherche 
. Sélectionnes Exécuter un examen complet 
. Cliques sur Rechercher 
. Le scan démarre. 
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés. 
. Cliques sur Ok pour poursuivre.
 . Si des malwares ont été détectés, cliques sur  Afficher les résultats 
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine. 
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse. 
. rends toi dans l'onglet rapport/log 
. tu cliques dessus pour l'afficher une fois affiché 
. tu cliques sur edition en haut du boc notes,et puis sur sélectionner tous 
. tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse 
. tu cliques droit dans le cadre de la reponse et coller

Gpowaaa · Answer

Ok chef =)

Gpowaaa · Answer

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 3133
Windows 6.1.7600

09/11/2009 18:08:39
mbam-log-2009-11-09 (18-08-39).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 228138
Temps écoulé: 19 minute(s), 57 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
C:\Windows\framework.exe (Spyware.Passwords) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Windows\framework.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\Users\Arnaud\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MGBEYQ16\ScopeFUDplague[1].exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\Users\Arnaud\Documents\Azureus Downloads\Adobe Illustrator CS4 (Multilingual) [RH]\AI_CS4_[RH]\Adobe Illustrator CS4\Keygen\adobe-master-cs4-keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Gpowaaa · Answer

A noter que le processus Update.exe tourne toujours et me cause toujours autant de tord :(

moment de grace · Answer

ok

tu peux vider la quarantaine

et puis essayer à nouveau un RSIT comme au post 6

à defaut un nouveau Hijackthis

Gpowaaa · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:19:16, on 09/11/2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Razer\Salmosaazerhid.exe
C:\Program Files (x86)\Razer\Reclusaazerhid.exe
C:\Program Files (x86)\Razer\Reclusaazertra.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files (x86)\Razer\Salmosaazerofa.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\SysWOW64\update.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll (file missing)
O4 - HKLM\..\Run: [Window Proxy Service] C:\Windows\System32\update.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Salmosa] C:\Program Files (x86)\Razer\Salmosaazerhid.exe
O4 - HKLM\..\Run: [Reclusa] C:\Program Files (x86)\Razer\Reclusaazerhid.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [framework] framework.exe
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Users\Arnaud\Desktop\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Lsass Service] C:\Users\Arnaud\AppData\Roaming\Microsoft\Windows\lsass.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Logitech Vid] "C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe" -bootmode
O4 - HKCU\..\Run: [Google Update] "C:\Users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Defence] "C:\ProgramData\Defence\smss.exe" -SystemDefence
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O4 - Startup: Logitech . Enregistrement du produit.lnk = C:\Program Files\Logitech\Logitech WebCam Software\eReg.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASKService - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\ASKUpgrade.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

moment de grace · Answer

desinstalles tout ce qui est : 

Ask.com 
AskBar 

et

C:\Windows\SysWOW64\update.exe

Gpowaaa · Answer

Evidemment update.exe n'est pas deletable, quelle surprise :p

moment de grace · Answer

en fait jusque là c'était facile

c'est maintenant que les problèmes commencent

essayons ca sans conviction

&#9654; Télécharge OTM (OldTimer) sur ton Bureau : 
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/ 
&#9654; Double-clique sur OTM.exe afin de le lancer. 
&#9654; Copie (Ctrl+C) le texte en gras suivant ci-dessous : 

:processes 
explorer.exe 
iexplore.exe 
firefox.exe 
msnmsgr.exe 
Teatimer.exe 
web mess.exe 


:files 
c:\windows\system32\update.exe
c:\program files\askbardis\bar\bin\askbar.dll
c:\program files\askbardis\bar\bin\askupgrade.exe

:commands 
[emptytemp] 
[start explorer] 
[reboot] 


&#9654; Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 
&#9654; Clique maintenant sur le bouton MoveIt! puis ferme OTM 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

&#9654; Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 

*Le nom du rapport correspond au moment de sa création : date_heure.log

Gpowaaa · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
No active process named web mess.exe was found!
========== FILES ==========
c:\windows\system32\update.exe moved successfully.
File/Folder c:\program files\askbardis\bar\bin\askbar.dll not found.
File/Folder c:\program files\askbardis\bar\bin\askupgrade.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Arnaud
File delete failed. C:\Users\Arnaud\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be deleted on reboot.
->Temp folder emptied: 9319676 bytes
File delete failed. C:\Users\Arnaud\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 95003182 bytes
->Java cache emptied: 14118970 bytes
->Google Chrome cache emptied: 81327459 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 5 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
File delete failed. C:\Windows	emp\logishrd\LVPrcInj04.dll scheduled to be deleted on reboot.
Windows Temp folder emptied: 481376 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 191,01 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 11092009_185411

Files moved on Reboot...
C:\Users\Arnaud\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File C:\Windows	emp\logishrd\LVPrcInj04.dll not found!

Registry entries deleted on Reboot...

moment de grace · Answer

hijackthis stp

et rsit il ne fonctionne toujours pas ?

Gpowaaa · Answer

J'allais poster un rapport hijack this mais me suis résigné :p 

Rsit toujours pas non ! 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:08:17, on 09/11/2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Razer\Salmosaazerhid.exe
C:\Program Files (x86)\Razer\Reclusaazerhid.exe
C:\Program Files (x86)\Razer\Reclusaazertra.exe
C:\Program Files (x86)\Razer\Salmosaazerofa.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Salmosa] C:\Program Files (x86)\Razer\Salmosaazerhid.exe
O4 - HKLM\..\Run: [Reclusa] C:\Program Files (x86)\Razer\Reclusaazerhid.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [framework] framework.exe
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASKService - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\AskService.exe (file missing)
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\ASKUpgrade.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

moment de grace · Answer

cool ca a marche

on va s'en tenter un nouveau...toujours sans conviction

&#9654; Double-clique sur OTM.exe afin de le lancer. 
&#9654; Copie (Ctrl+C) le texte en gras et modifié suivant ci-dessous :

:processes 
explorer.exe 
iexplore.exe 
firefox.exe 
msnmsgr.exe 
Teatimer.exe 
web mess.exe 

:Reg 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_CLASSES_ROOT\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Window Proxy Service"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASKService]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASKUpgrade]

:commands 
[emptytemp] 
[start explorer] 
[reboot] 

&#9654; Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 
&#9654; Clique maintenant sur le bouton MoveIt! puis ferme OTM 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

&#9654; Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 

*Le nom du rapport correspond au moment de sa création : date_heure.log


ensuite tu peux faire un nouveau RSIT stp

Gpowaaa · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
No active process named web mess.exe was found!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ not found.
Registry key HKEY_CLASSES_ROOT\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{3041d03e-fd4b-44e0-b742-2d9b88305f98} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Window Proxy Service not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASKService\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASKUpgrade\ deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Arnaud
File delete failed. C:\Users\Arnaud\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be deleted on reboot.
->Temp folder emptied: 448753 bytes
File delete failed. C:\Users\Arnaud\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 4389998 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 65927502 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
File delete failed. C:\Windows	emp\logishrd\LVPrcInj02.dll scheduled to be deleted on reboot.
Windows Temp folder emptied: 241296 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 67,72 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 11092009_195932

Files moved on Reboot...
C:\Users\Arnaud\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
LoadLibrary failed for C:\Windows	emp\logishrd\LVPrcInj02.dll
C:\Windows	emp\logishrd\LVPrcInj02.dll NOT unregistered.
File move failed. C:\Windows	emp\logishrd\LVPrcInj02.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Rien à faire pour RSIT, c'est un bug 64bits à mon avis

Rapport HijackThis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:06:26, on 09/11/2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Razer\Salmosaazerhid.exe
C:\Program Files (x86)\Razer\Reclusaazerhid.exe
C:\Program Files (x86)\Razer\Reclusaazertra.exe
C:\Program Files (x86)\Razer\Salmosaazerofa.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Salmosa] C:\Program Files (x86)\Razer\Salmosaazerhid.exe
O4 - HKLM\..\Run: [Reclusa] C:\Program Files (x86)\Razer\Reclusaazerhid.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [framework] framework.exe
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

moment de grace · Answer

ca marche trop bien pour être honnête tout ca ?

comment va le pc ?

as tu dans tes programmes : FrameWork 2.5 

si oui essaies de le désinstaller

pour RSIT ce n'est pas normal (même 64 bits)
supprimes le et retélécharges le..et essaies

Gpowaaa · Answer

Mon pc tourne niquel pour l'instant Moment de Grace, RSIT j'l'ai dl 200 millions de fois, rien n'y fait !
Framework ainsi que tous les processus ont disparus de mon gestionnaire des taches =)

Merci énormément d'avoir prit le temps de m'aiguiller !

moment de grace · Answer

tu as quoi comme anti virus ?

moment de grace · Answer

si le pc tourne bien alors tant mieux, je reste dubitatif pour RSIT

antivir est compatible 64 bits
http://www.commentcamarche.net/telecharger/telecharger-55-antivir

j'ai vu passé ceci
"C:\Users\Arnaud\Documents\Azureus Downloads\Adobe Illustrator CS4 (Multilingual) [RH]\AI_CS4_[RH]\Adobe Illustrator CS4\Keygen\adobe-master-cs4-keygen.exe" 
25/10/2008 03:04 |Size 94208 |Crc32 86ac7237 |Md5 4a0924ec5a96895ef65666a0cc97b48c 

"C:\Users\Arnaud\Documents\Azureus Downloads\Adobe Illustrator CS4 (Multilingual) [RH]\AI_CS4_[RH]\Adobe Illustrator CS4\Keygen\CS4MCLG.EXE" 
25/10/2008 03:04 |Size 469268 |Crc32 bde1a9a0 |Md5 366480d909b7c917f73b27336ce86432 

sources d'infection

sinon pour moi c'est ok, je te salue plus amicalement que nous avons démarré...

(sourire)

tu pourras mettre ce sujet comme résolu à défaut de toute autre question

Gpowaaa · Answer

Yep je connais la source de l'infection, elle était évidente, tout autant que je suis un parfait abruti :-)

Pour l'AV, je n'en ai pas, et je n'en ai jamais eu, je suis pas du genre à chopper des virus habituellement, mais j'ai été trop bête !

Encore merci, du fond du coeur, j'espère que si l'on se recroise, ce sera dans d'autres circonstances !

gen-hackman · Answer

toujours infecté :

O4 - HKLM\..\Run: [framework] framework.exe 

voila pourquoi :

Platform: Unknown Windows (WinNT 6.01.3504) 

de plus :

Pas d antivirus
pas d'antispy...

les outils ne connaissent pas les windows.....inconnus ^^

Gpowaaa · Answer

Et donc je fais quoi ? :p

moment de grace · Answer

pas curiosité, refais un hijackthis

Platform: Unknown Windows (WinNT 6.01.3504) 
ou tu as une version windows genre démo ou une version genre craquée...dans les deux cas, une version à risque

Pour l'AV, je n'en ai pas, et je n'en ai jamais eu, je suis pas du genre à chopper des virus habituellement, mais j'ai été trop bête 

comprends pas, vu le prix d'antivir qui de plus est compatible...si c'est pour le P2p, les deux font bon ménage entre eux

Gpowaaa · Answer

Hum, ma version de windows est tout à fait officielle, pour le prix que je l'ai payé j'peux vous le garantir !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:46:15, on 10/11/2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Razer\Salmosaazerhid.exe
C:\Program Files (x86)\Razer\Reclusaazerhid.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files (x86)\Razer\Reclusaazertra.exe
C:\Program Files (x86)\Razer\Salmosaazerofa.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Salmosa] C:\Program Files (x86)\Razer\Salmosaazerhid.exe
O4 - HKLM\..\Run: [Reclusa] C:\Program Files (x86)\Razer\Reclusaazerhid.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [framework] framework.exe
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

gen-hackman · Answer

C:\Program Files (x86)\Razer\Reclusa\razerhid.exe = VT

Gpowaaa · Answer

VT ?

gen-hackman · Answer

virus total ^^

moment de grace · Answer

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : C:\Program Files (x86)\Razer\Reclusa\razerhid.exe  


Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

Gpowaaa · Answer

Antivirus	Version	Dernière mise à jour	Résultat
a-squared	4.5.0.41	2009.11.11	-
AhnLab-V3	5.0.0.2	2009.11.06	-
AntiVir	7.9.1.61	2009.11.10	-
Antiy-AVL	2.0.3.7	2009.11.11	-
Authentium	5.2.0.5	2009.11.11	-
Avast	4.8.1351.0	2009.11.10	-
AVG	8.5.0.423	2009.11.11	-
BitDefender	7.2	2009.11.11	-
CAT-QuickHeal	10.00	2009.11.10	-
ClamAV	0.94.1	2009.11.10	-
Comodo	2913	2009.11.11	-
DrWeb	5.0.0.12182	2009.11.10	-
eSafe	7.0.17.0	2009.11.10	-
eTrust-Vet	35.1.7113	2009.11.10	-
F-Prot	4.5.1.85	2009.11.10	-
F-Secure	9.0.15370.0	2009.11.09	-
Fortinet	3.120.0.0	2009.11.10	-
GData	19	2009.11.11	-
Ikarus	T3.1.1.74.0	2009.11.11	-
Jiangmin	11.0.800	2009.11.11	-
K7AntiVirus	7.10.893	2009.11.10	-
Kaspersky	7.0.0.125	2009.11.11	-
McAfee	5798	2009.11.10	-
McAfee+Artemis	5798	2009.11.10	-
McAfee-GW-Edition	6.8.5	2009.11.11	-
Microsoft	1.5202	2009.11.10	-
NOD32	4594	2009.11.11	-
Norman	6.03.02	2009.11.10	-
nProtect	2009.1.8.0	2009.11.10	-
Panda	10.0.2.2	2009.11.10	-
PCTools	7.0.3.5	2009.11.10	-
Prevx	3.0	2009.11.11	-
Rising	22.21.02.01	2009.11.11	-
Sophos	4.47.0	2009.11.11	-
Sunbelt	3.2.1858.2	2009.11.11	-
Symantec	1.4.4.12	2009.11.11	-
TheHacker	6.5.0.2.065	2009.11.11	-
TrendMicro	9.0.0.1003	2009.11.10	-
VBA32	3.12.10.11	2009.11.10	-
ViRobot	2009.11.11.2030	2009.11.11	-
VirusBuster	4.6.5.0	2009.11.10	-
Information additionnelle
File size: 151552 bytes
MD5...: 2a9feacb2fd643b0810ab0dd41d40adb
SHA1..: 44068109d6ee7b827583a6e6e619df217e864db9
SHA256: d55833e4eced1dff88087b03e9ccfa0818174c16b1a98094702a2ad2e06ad5c1
ssdeep: 3072:DIVK0vknnDXY9SsEcrUpaLae/yq2sPAQiH1oLhv/jOfeI:DIVLZ4xAavqfP
V/j
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x585f
timedatestamp.....: 0x4a82782e (Wed Aug 12 08:07:10 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x124fe 0x13000 6.39 712c94adcaa043689e784706376f733d
.rdata 0x14000 0x5010 0x6000 4.03 78d4f5d68842a7409e2eca3fde6a9d4c
.data 0x1a000 0x51e0 0x2000 3.36 f64c5ec253fb962b6ecf4ece4e66a8b0
.rsrc 0x20000 0x8a28 0x9000 3.61 2b928728d3d0241802bea7e709f37f91

( 10 imports ) 
> PSAPI.DLL: GetModuleBaseNameA, EnumProcesses, EnumProcessModules
> WINMM.dll: mciSendCommandA
> SHFOLDER.dll: SHGetFolderPathA
> KERNEL32.dll: LocalAlloc, TlsAlloc, GlobalHandle, TlsFree, GlobalReAlloc, TlsSetValue, LocalReAlloc, TlsGetValue, GlobalFlags, GetProcessVersion, GetCPInfo, GetOEMCP, SetErrorMode, GetCurrentProcess, WriteFile, SetFilePointer, FlushFileBuffers, RtlUnwind, GetStartupInfoA, ExitProcess, TerminateProcess, HeapFree, HeapAlloc, RaiseException, GetACP, HeapReAlloc, HeapSize, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, HeapDestroy, HeapCreate, VirtualFree, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetVersion, lstrcatA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GetModuleHandleA, GlobalDeleteAtom, lstrcmpA, GetCurrentThread, GetCurrentThreadId, SetLastError, LocalFree, MultiByteToWideChar, WideCharToMultiByte, InterlockedDecrement, InterlockedIncrement, lstrlenA, lstrcpynA, OpenProcess, lstrcmpiA, LoadLibraryA, CreateSemaphoreA, CreateThread, ReleaseSemaphore, FreeLibrary, GetProcAddress, CreateFileA, WaitForSingleObject, DeviceIoControl, GetCurrentDirectoryA, Sleep, lstrcpyA, ExpandEnvironmentStringsA, WinExec, ReleaseMutex, CreateMutexA, GetLastError, CloseHandle, OpenFile, OutputDebugStringA, FindFirstFileA, FindClose, CreateDirectoryA, GetModuleFileNameA, CopyFileA, GetPrivateProfileIntA, GetPrivateProfileStructA, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, WritePrivateProfileStringA, GetPrivateProfileStringA, GetCommandLineA
> USER32.dll: CopyRect, GetClientRect, AdjustWindowRectEx, SetFocus, GetSysColor, MapWindowPoints, LoadIconA, SetWindowTextA, ShowWindow, LoadCursorA, ClientToScreen, GetClassNameA, PtInRect, GetDC, ReleaseDC, TabbedTextOutA, DrawTextA, GrayStringA, GetSysColorBrush, DestroyMenu, GetCapture, WinHelpA, wsprintfA, GetClassInfoA, RegisterClassA, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetDlgItem, GetWindowTextA, GetDlgCtrlID, DefWindowProcA, DestroyWindow, CreateWindowExA, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetWindow, SetWindowPos, RegisterWindowMessageA, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetWindowRect, GetSystemMetrics, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, GetFocus, GetNextDlgTabItem, DispatchMessageA, GetActiveWindow, GetKeyState, CallNextHookEx, ValidateRect, IsWindowVisible, PeekMessageA, GetCursorPos, SetWindowsHookExA, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, MessageBoxA, SetCursor, PostQuitMessage, EnableWindow, SetWindowLongA, MapVirtualKeyA, GetMessageA, KillTimer, SendMessageA, LoadStringA, SetTimer, FindWindowA, GetForegroundWindow, GetWindowThreadProcessId, AttachThreadInput, SetForegroundWindow, PostMessageA, keybd_event, mouse_event, GetMenu, GetTopWindow, TranslateMessage, UnregisterClassA
> GDI32.dll: SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, RestoreDC, GetDeviceCaps, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, SaveDC, DeleteDC, DeleteObject, GetObjectA, SetBkColor, GetStockObject, SetTextColor, GetClipBox, CreateBitmap, SelectObject
> WINSPOOL.DRV: ClosePrinter, DocumentPropertiesA, OpenPrinterA
> ADVAPI32.dll: RegSetValueExA, RegCreateKeyA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, RegCreateKeyExA
> SHELL32.dll: StrStrIA, ShellExecuteA
> COMCTL32.dll: -

( 0 exports ) 
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win64 Executable Generic (54.6%)
Win32 Executable MS Visual C++ (generic) (24.0%)
Windows Screen Saver (8.3%)
Win32 Executable Generic (5.4%)
Win32 Dynamic Link Library (generic) (4.8%)
sigcheck:
publisher....: Razer USA Ltd.
copyright....: Copyright (C) 2004
product......: razerhid Application
description..: razerhid MFC Application
original name: razerhid.EXE
internal name: razerhid
file version.: 1, 0, 0, 1
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Gpowaaa · Answer

Heu, je vois mal comment le driver de mon clavier Razer Reclusa pourrait être un virus à part entière, à moins qu'il ait été contaminé, ce qui n'est sensiblement pas la même chose ?

moment de grace · Answer

il est propre

un reste à enlever

&#9654; Télécharge OTM (OldTimer) sur ton Bureau : 
http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/ 
&#9654; Double-clique sur OTM.exe afin de le lancer. 
&#9654; Copie (Ctrl+C) le texte en gras suivant ci-dessous : 

:processes 
explorer.exe 
iexplore.exe 
firefox.exe 
msnmsgr.exe 
Teatimer.exe 
web mess.exe 

:Reg 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio­n\Run] 
"Framework"=- 

:commands 
[emptytemp] 
[start explorer] 
[reboot] 

&#9654; Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 
&#9654; Clique maintenant sur le bouton MoveIt! puis ferme OTM 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

&#9654; Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 

*Le nom du rapport correspond au moment de sa création : date_heure.log

Gpowaaa · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
No active process named web mess.exe was found!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio n\Run not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Arnaud
File delete failed. C:\Users\Arnaud\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be deleted on reboot.
->Temp folder emptied: 6789763 bytes
File delete failed. C:\Users\Arnaud\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 44406670 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 399565581 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
File delete failed. C:\Windows	emp\logishrd\LVPrcInj02.dll scheduled to be deleted on reboot.
Windows Temp folder emptied: 492478 bytes
RecycleBin emptied: 25749729 bytes
 
Total Files Cleaned = 454,94 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 11122009_215213

Files moved on Reboot...
C:\Users\Arnaud\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
LoadLibrary failed for C:\Windows	emp\logishrd\LVPrcInj02.dll
C:\Windows	emp\logishrd\LVPrcInj02.dll NOT unregistered.
File move failed. C:\Windows	emp\logishrd\LVPrcInj02.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Gpowaaa · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:02:40, on 12/11/2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Razer\Reclusaazerhid.exe
C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
C:\Program Files (x86)\Razer\Reclusaazertra.exe
C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Arnaud\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
c:\program files\logitech\logitech webcam software\lu\lulnchr.exe
C:\program files\logitech\logitech webcam software\lu\LogitechUpdate.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Reclusa] C:\Program Files (x86)\Razer\Reclusaazerhid.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [framework] framework.exe
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [Steam] "c:\program files (x86)\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Arnaud\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

moment de grace · Answer

O4 - HKLM\..\Run: [framework] framework.exe 
est toujours là

O13 - Gopher Prefix

est néfasre également

je soupconne hijackthis d'être quelque peu touché

et toujours pas d'anti virus

alors pour moi 

installer anti vir +scan complet

https://www.commentcamarche.net/faq/16831-tutoriel-configuration-optimale-d-antivir-personal

supprimer hijackthis et  à retélécharger

https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/

moment de grace · Answer

je prends note de ta remarque...je ne veux pas l'oublier, celle ci

merci tout de même d'êtes passé

gen-hackman · Answer

salut faudrait un zhpDiag  ;)

Mars__1 · Answer

Je voudrais bien savoir comment me débarrasser de google update.exe???

gen-hackman · Answer

salut pose ta question sur le forum tu auras plus de chancces d avoir une reponse qu'en fin de topic

Isass.exe et Update.exe, désespéré :( - Page 3

Discussions similaires

Newsletters