demade d'aide pour supression de virus Résolu/Fermé

Question

Bonjour, Je suis entrain de faire du grand nettoyage sur mes deux ordis, et mes disques dures qui sont pas mal infester, je souhaiterais obtenir votre aide afin de ne surtout pasz faire de betises car j'utilise mes pc dans un but proffessionnel et il ne faudrais surtout pas que je perde des dossiers, ou que celui plante et que je sois obliger de tout reinstaller, je vous remerci d'avance 

dsl pour les accents clavier qwerty

tchaning · Answer

Telecharger Hijackthis, scan puis copier coller le rapport ici . Merci 
Lien : http://www.trendsecure.com/portal/fr/_download/HJTInstall.ex­e

tchaning · Answer

Telecharger Hijackthis, scan puis copier coller le rapport ici . Merci 
Lien : http://www.trendsecure.com/portal/fr/_download/HJTInstall.ex­e

free-surf · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Henri at 2009-12-07 20:46:23
Microsoft Windows XP Professional Service Pack 3
System drive C: has 20 GB (33%) free of 60 GB
Total RAM: 3310 MB (80% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:26, on 12/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\XP-24AE0B83.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Documents and Settings\Henri\Desktop\RSIT.exe
C:\Program Files	rend micro\Henri.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\fix.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [XP-24AE0B83] C:\WINDOWS\system32\XP-24AE0B83.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ¡¡¡¡¡¡.lnk = C:\WINDOWS\system32\XP-24AE0B83.EXE
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

free-surf · Answer

Qu'est-ce que ca annonce???
Merci d'avance

moment de grace · Answer

Téléchargez USBFIX de Chiquitine29, C_xx

http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
ou
https://www.ionos.fr/?affiliate_id=77097

/!\ Utilisateur de vista et windows 7 :
 ne pas oublier de désactiver Le contrôle des comptes utilisateurs 
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac 

/!\ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir 

• Double clic sur le raccourci UsbFix présent sur le bureau . 

• Choisir l'option 1 (Recherche) 
(d’autres options disponibles, voir le tutoriel). 
• Laissez travailler l'outil. 

• Ensuite postez le rapport UsbFix.txt qui apparaîtra. 

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt ) 

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html

free-surf · Answer

############################## | UsbFix V6.059 |

User : Henri (Administrators) # STUDIO-CC32889D
Update on 01/12/2009 by Chiquitine29, C_XX & Chimay8
Start at: 9:09:03 PM | 12/7/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Quad CPU    Q6600  @ 2.40GHz
Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : ESET NOD32 Antivirus 3.0 3.0 [ Enabled | Updated ]

C:\ -> Local Fixed Disk # 58.59 Go (19.24 Go free) [System] # NTFS
D:\ -> Local Fixed Disk # 239.49 Go (152.73 Go free) [Programs] # NTFS
E:\ -> Local Fixed Disk # 298.09 Go (150 Go free) [Projects] # NTFS
F:\ -> CD-ROM Disc
G:\ -> CD-ROM Disc
I:\ -> CD-ROM Disc

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 720
C:\WINDOWS\system32\csrss.exe 784
C:\WINDOWS\system32\winlogon.exe 808
C:\WINDOWS\system32\services.exe 856
C:\WINDOWS\system32\lsass.exe 868
C:\WINDOWS\system32\svchost.exe 1036
C:\WINDOWS\system32\svchost.exe 1104
C:\WINDOWS\System32\svchost.exe 1144
C:\WINDOWS\system32\svchost.exe 1208
C:\WINDOWS\system32\svchost.exe 1244
C:\WINDOWS\system32\spoolsv.exe 1292
C:\WINDOWS\system32\svchost.exe 1392
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1448
C:\Program Files\Bonjour\mDNSResponder.exe 1496
C:\Program Files\ICQ6Toolbar\ICQ Service.exe 1560
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1596
C:\WINDOWS\system32\svchost.exe 1644
C:\WINDOWS\system32\wdfmgr.exe 1700
C:\WINDOWS\System32\alg.exe 2032
C:\WINDOWS\Explorer.EXE 1088
C:\Program Files\DAEMON Tools\daemon.exe 1976
C:\Program Files\iTunes\iTunesHelper.exe 2064
C:\WINDOWS\system32\igfxtray.exe 2144
C:\WINDOWS\system32\igfxpers.exe 2164
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe 2204
C:\WINDOWS\system32\igfxsrvc.exe 2212
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe 2264
C:\WINDOWS\system32\XP-24AE0B83.EXE 2296
C:\WINDOWS\system32\ctfmon.exe 2304
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe 2312
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe 2352
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe 2360
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe 2368
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe 2424
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe 2480
C:\Program Files\Skype\Phone\Skype.exe 2488
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 2572
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe 2600
C:\Program Files\iPod\bin\iPodService.exe 2740
C:\Program Files\Windows Live\Contacts\wlcomm.exe 3140
C:\Program Files\Skype\Plugin Manager\skypePM.exe 3292
C:\WINDOWS\system32\wuauclt.exe 3584
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 3724
C:\Program Files\Internet Explorer\iexplore.exe 372
C:\Program Files\Internet Explorer\iexplore.exe 1044
C:\Program Files\Internet Explorer\iexplore.exe 1928
C:\WINDOWS\system32\wbem\wmiprvse.exe 2936

################## | Fichiers # Dossiers infectieux |

C:\autorun.inf  
C:\autorun.inf -> fichier appel&#1497; : "C:\g12g.exe" ( Absent ! )  
D:\autorun.inf  
D:\autorun.inf -> fichier appel&#1497; : "D:\g12g.exe" ( Absent ! )  
E:\autorun.inf  
E:\autorun.inf -> fichier appel&#1497; : "E:\g12g.exe" ( Absent ! )  

################## | Spyware.OnlineGames |

C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP285\A0066453.dll  
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP285\A0069378.dll  

################## | Registre # Cl&#1497;s infectieuses |

[HKLM\SOFTWARE\Classes\CLSID\MADOWN]  
[HKCR\CLSID\MADOWN]  
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"  
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives" 

################## | Registre # Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{0f8b76a0-1f91-11dd-80b7-e2e39fedb569}
Shell\AutoRun\command =H:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{263f190e-1958-11dd-80b3-b9e2376b4cea}
Shell\AutoRun\command =H:\SCVHSOT.exe 
Shell\Open\command =H:\SCVHSOT.exe 

HKCU\..\..\Explorer\MountPoints2\{53651922-c47f-11de-831e-0019d1ad286c}
Shell\AutoRun\command =H:\vlvtdflx.exe 
Shell\open\Command =H:\vlvtdflx.exe 

HKCU\..\..\Explorer\MountPoints2\{599fb33e-6232-11de-823f-0019d1ad286c}
Shell\AutoRun\command =J:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{6b8b0222-c157-11de-8313-0019d1ad286c}
Shell\AutoRun\command =H:\vlvtdflx.exe 
Shell\open\Command =H:\vlvtdflx.exe 

HKCU\..\..\Explorer\MountPoints2\{7a7ca295-39ea-11de-8203-0019d1ad286c}
Shell\AutoRun\command =H:
u.cmd 
Shell\open\Command =H:
u.cmd 

HKCU\..\..\Explorer\MountPoints2\{82324f82-d191-11dd-8163-0019d1ad286c}
Shell\AutoRun\command =H:\hpkq.cmd 
Shell\explore\Command =H:\hpkq.cmd 
Shell\open\Command =H:\hpkq.cmd 

HKCU\..\..\Explorer\MountPoints2\{836e1855-b8b7-11de-82f8-0019d1ad286c}
Shell\AutoRun\command =K:\vlvtdflx.exe 
Shell\open\Command =K:\vlvtdflx.exe 

HKCU\..\..\Explorer\MountPoints2\{83dd2cba-a780-11de-82cf-0019d1ad286c}
Shell\AutoRun\command =H:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{bddd01a9-5858-11de-8232-0019d1ad286c}
Shell\AutoRun\command =H:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{d41b374e-c6f7-11de-8327-0019d1ad286c}
Shell\AutoRun\command =H:\vlvtdflx.exe 
Shell\open\Command =H:\vlvtdflx.exe 

HKCU\..\..\Explorer\MountPoints2\{d41b3760-c6f7-11de-8327-0019d1ad286c}
Shell\AutoRun\command =K:\vlvtdflx.exe 
Shell\open\Command =K:\vlvtdflx.exe 

HKCU\..\..\Explorer\MountPoints2\{df2a3fd2-ae8b-11de-82e7-0019d1ad286c}
Shell\AutoRun\command =H:\LaunchU3.exe -a

HKCU\..\..\Explorer\MountPoints2\{df2a3fd3-ae8b-11de-82e7-0019d1ad286c}
Shell\AutoRun\command =K:\0fkk02x.exe 
Shell\open\Command =K:\0fkk02x.exe 

################## | Cracks / Keygens / Serials |

"D:\Bosendorfer\bosendorfer_keygen.exe"  
12/09/2003 11:27 |Size 315904 |Crc32 0ce04b54 |Md5 fe08abf945c75394e96d04c6652ba68c  
 
"D:\EZDrummer Install\Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX\KeyGen.exe"  
06/07/2006 21:38 |Size 22528 |Crc32 e7e08c9a |Md5 f9dbb37fce70d213c631d3c25f83be67  
 
"D:\EZDrummer Install\Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX\EZdrummer10\Install\PC\program files\Toontrack\EZDrummer\HelpMenu\EZD_QuickTour.exe"  
03/27/2006 23:13 |Size 4849699 |Crc32 a2912c6d |Md5 d3b8b8fb07b1901b9a4d85bc4b3aa57e  
 
"D:\Setups\Apps\Ahead.Nero.v7.8.5.0.Multilingual.Incl.Keymaker-EMBRACE\keygen-EMBRACE.exe"  
04/16/2007 15:20 |Size 118784 |Crc32 52ce3b97 |Md5 a2fcfa38b381163e372a3f195541a848  
 
"D:\Setups\VST Instruments\Gary.Garritan.Jazz.and.Big.Band.VSTi.DXi.RTAS.AU.HYBRiD.DVDR-DYNAMiCS\Keygen\Key Gen\KONTAKT.v2.02.KEYGEN.EXE"  
06/28/2007 17:16 |Size 132256 |Crc32 ef7ffd4f |Md5 d611f3e3931fc156706c144dbdd092bc  
 
"D:\Setups\VST Instruments\Native Instruments\Native Instruments Kontakt 2.2.1 VSTi-DXi-RTAS\Keygen.exe"  
12/03/2007 22:33 |Size 91136 |Crc32 39a2fed3 |Md5 8959423d58d6a07da991ec1178e83721  
 
"D:\Setups\VST Instruments\Rob.Papen.Predator.VSTi.v1.1.Incl.Keygen-AiR\keygen.exe"  
10/12/2007 16:35 |Size 47616 |Crc32 f6338441 |Md5 e57ac3c7a99e79f49aa13d6daac05ddb  
 
"D:\Setups\VST Instruments\Rob.Papen.Predator.VSTi.v1.1.Incl.Keygen-AiR\Setup.exe"  
10/12/2007 17:43 |Size 7155900 |Crc32 510cf6b6 |Md5 de76efcdbf8947cc73da855ec3a98733  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\KeyGen.exe"  
04/20/2007 01:39 |Size 22528 |Crc32 dc5f374b |Md5 ab4a971e254be18c3b0470bf650ff0f5  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\Setup.exe"  
08/11/2000 04:22 |Size 54272 |Crc32 15a22d1a |Md5 d765793f5d803673d1b4b5586e8fd66c  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\CHKDSK.EXE"  
03/30/2001 14:38 |Size 59471 |Crc32 4cabf4c7 |Md5 53545bed66d627e5403c6a34c090c6ed  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\EMM386.EXE"  
03/30/2001 14:38 |Size 179583 |Crc32 19be7158 |Md5 da5fd1ab76171ca857d76df1ccf748db  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\FLOPPY.EXE"  
03/30/2001 14:38 |Size 32768 |Crc32 796d1df6 |Md5 d4a997aca446bd7e58827002888587a5  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\FLOPPY9x.EXE"  
03/30/2001 14:38 |Size 57344 |Crc32 1e7d5e09 |Md5 09edb7b5c7961da474555e763d80529f  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\FLOPPYME.EXE"  
03/30/2001 14:38 |Size 57856 |Crc32 2eb70a00 |Md5 341b379b0508949603af82ea59bd821d  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\NWCDEX.EXE"  
03/30/2001 14:38 |Size 21756 |Crc32 1a99ba16 |Md5 c9c13316344a1c0645f21de0184ec1c7  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\PQBOOT.EXE"  
09/16/2002 01:18 |Size 90418 |Crc32 5ef45c93 |Md5 341398aebec50aa92061e975bb3c5e85  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\PTEDIT32.EXE"  
07/20/2001 15:27 |Size 501760 |Crc32 ccd983ed |Md5 27c4a902e350258d381ca6748a106862  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEMestrmbr.exe"  
03/30/2001 14:39 |Size 41038 |Crc32 c1c40b4c |Md5 6e712a1b4ddb46918d9461a209e46db3  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\WRPROG.EXE"  
09/16/2002 01:19 |Size 66544 |Crc32 a39bc5e6 |Md5 45cef90de0316e86e757f795053dac0d  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Setup\instmsia.exe"  
03/11/2002 09:45 |Size 1708856 |Crc32 3ccaccf9 |Md5 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Setup\instmsiw.exe"  
03/11/2002 10:06 |Size 1822520 |Crc32 be716ace |Md5 61a5fb191ae2ae876db31dcce75e4183  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Setup\setup.exe"  
09/16/2002 03:28 |Size 217088 |Crc32 0dbf293d |Md5 ff6e6e5ff0ba6c8f6444217e33d46538  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\DKeeper\instmsia.exe"  
03/11/2002 09:45 |Size 1708856 |Crc32 3ccaccf9 |Md5 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\DKeeper\instmsiw.exe"  
03/11/2002 10:06 |Size 1822520 |Crc32 be716ace |Md5 61a5fb191ae2ae876db31dcce75e4183  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\DKeeper\setup.exe"  
09/15/2002 23:01 |Size 217088 |Crc32 175c1856 |Md5 4bcbd459621a41ffbcdaa89a6fe881f5  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\Setup.exe"  
08/11/2000 04:22 |Size 54272 |Crc32 15a22d1a |Md5 d765793f5d803673d1b4b5586e8fd66c  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\CHKDSK.EXE"  
03/30/2001 14:38 |Size 59471 |Crc32 4cabf4c7 |Md5 53545bed66d627e5403c6a34c090c6ed  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\EMM386.EXE"  
03/30/2001 14:38 |Size 179583 |Crc32 19be7158 |Md5 da5fd1ab76171ca857d76df1ccf748db  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\FLOPPY.EXE"  
03/30/2001 14:38 |Size 32768 |Crc32 796d1df6 |Md5 d4a997aca446bd7e58827002888587a5  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\FLOPPY9x.EXE"  
03/30/2001 14:38 |Size 57344 |Crc32 1e7d5e09 |Md5 09edb7b5c7961da474555e763d80529f  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\FLOPPYME.EXE"  
03/30/2001 14:38 |Size 57856 |Crc32 2eb70a00 |Md5 341b379b0508949603af82ea59bd821d  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\NWCDEX.EXE"  
03/30/2001 14:38 |Size 21756 |Crc32 1a99ba16 |Md5 c9c13316344a1c0645f21de0184ec1c7  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\PTEDIT32.EXE"  
09/16/2002 02:24 |Size 503808 |Crc32 aa3e7496 |Md5 7f7f39b5b57971f17291dfd10f01207b  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\Setup\instmsia.exe"  
03/11/2002 09:45 |Size 1708856 |Crc32 3ccaccf9 |Md5 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\Setup\instmsiw.exe"  
03/11/2002 10:06 |Size 1822520 |Crc32 be716ace |Md5 61a5fb191ae2ae876db31dcce75e4183  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\Setup\setup.exe"  
09/16/2002 18:40 |Size 217088 |Crc32 10871ada |Md5 a2b0c046755a6c4b050c7b2a48d83914  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\Setup\Setup.exe"  
04/17/2007 02:45 |Size 73728 |Crc32 c17e6cfe |Md5 71e6dd8a9de4a9baf89fca951768059a  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\Setup\_ISDel.exe"  
04/17/2007 02:45 |Size 27648 |Crc32 72a82089 |Md5 51161bf79f25ff278912005078ad93d5  
 
"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\AUTOEXE2.BAT 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\AUTOEXEC.BAT 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\CHKDSK.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\EMM386.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\FLOPPY.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\FLOPPY9x.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\FLOPPYME.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\NWCDEX.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\PQBOOT.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\PTEDIT32.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEMestrmbr.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\WRPROG.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\setup.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Setup\instmsia.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Setup\instmsiw.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Setup\setup.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\AUTOEXE2.BAT 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\AUTOEXEC.BAT 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\CHKDSK.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\EMM386.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\FLOPPY.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\FLOPPY9x.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\FLOPPYME.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\NWCDEX.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\PTEDIT32.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\setup.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\Setup\instmsia.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\Setup\instmsiw.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\Setup\setup.exe 

"D:\Setups\Plugins\Melodyne\melodyne keygen..zip"
-> Contain : Install.exe     653293    DFLT-X    1%     644263  12-05-2002 09:48:12 f43e0899 

"D:\Setups\Plugins\Melodyne\melodyne keygen..zip"
-> Contain : CrcCheck.exe     29332    DFLT-X   10%      26443  12-05-2002 09:48:12 22764eac 

"D:\Setups\VST Instruments\Gary.Garritan.Jazz.and.Big.Band.VSTi.DXi.RTAS.AU.HYBRiD.DVDR-DYNAMiCS\Keygen\Key Gen\KONTAKT.v2.02.KEYGEN.EXE.zip"
-> Contain : Archive File: KONTAKT.v2.02.KEYGEN.EXE.zip  [ZIP] 

"D:\Setups\VST Instruments\Gary.Garritan.Jazz.and.Big.Band.VSTi.DXi.RTAS.AU.HYBRiD.DVDR-DYNAMiCS\Keygen\Key Gen\KONTAKT.v2.02.KEYGEN.EXE.zip"
-> Contain : KONTAKT.v2.02.KEYGEN.EXE 

"C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\drumagog v1.4.7.3 cracked.rar" 
-> contain :  Setup.exe

"C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR.rar" 
-> contain :  WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR\Keygen.exe

"C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR.rar" 
-> contain :  WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR\Setup.exe

"D:\EZDrummer Install\Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX.rar" 
-> contain :  Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX\EZ Drummer - Update 1.02.exe

"D:\EZDrummer Install\Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX.rar" 
-> contain :  Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX\KeyGen.exe

"D:\Setups\Audio Apps\Tascam GigaStudio v3.21.2390 Incl Keygen\a-tg321.rar" 
-> contain :  keygen.exe

"D:\Setups\Audio Apps\Tascam GigaStudio v3.21.2390 Incl Keygen\a-tg321.rar" 
-> contain :  setup.exe

"D:\Setups\VST Instruments\Tone2.Firebird.VSTi.v1.2.1.incl.Keygen-AiR\a-fb121.rar" 
-> contain :  keygen.exe


################## | ! Fin du rapport # UsbFix V6.059 ! |

 voici le log

free-surf · Answer

tu peux me dire, si Cubase SX3 Steinberg ou ces plug sont infectes?
si oui il va va falloire etre tres vigilent, parce que se sont des programmes que je ne dois absolument pas planter ... je t'avouerais que sur cet ordi je ne suis pas trop rassure

free-surf · Answer

personne?

moment de grace · Answer

à priori ceci est infecté en plus de ce que trouve usbfix

O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\fix.exe   

 Cubase SX3 Steinberg...on le le fera vérifier apres

en attendant

1) &#9679; Relance UsbFix 

&#9679; Dans le menu principale cette fois choisit l'option2 

 Le menu démarrer et les icônes vont à nouveau disparaître.. c'est normal. 

Si un message te demande de redémarrer l'ordinateur fais le ... 

&#9679; Au redémarrage, le fix se relance... laisses l'opération s'effectuer. 

&#9679; Le bloc note s'ouvre avec un rapport, envoies le dans la prochaine réponse

2) Téléchargez et enregistrez le fichier d installation sur le bureau
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe


Double cliquez sur le fichier d'installation de AD-Remover, le programme s'installera automatiquement. 
Sous Vista : clic droit sur AD-Remover et sélectionner "Exécuter en tant qu'administrateur"
Au menu principal choisir l'option "s" et tapez sur [entrée] .
Laissez travailler l'outil et ne touchez à rien ... 
Postez le rapport  qui apparait à la fin.

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

free-surf · Answer

.
======= LOGFILE OF AD-REMOVER 1.1.4.6_E | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 07.12.2009 at 21:14
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at: 23:04:33, Mon 12/07/2009 | Normal Boot | Option: SCAN
Executed from: C:\Program Files\Ad-Remover\
Operating system: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Computer Name: STUDIO-CC32889D | Current user: Henri
.
============== FOUND ELEMENT(S) ==============
.

C:\WINDOWS\Prefetch\SOFTWAREUPDATE.EXE-1415D1B8.pf 
.
HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
HKLM\Software\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}
HKLM\Software\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}
.
HKCU\..\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} (Orphan registry key) 
HKCU\..\Toolbar\WebBrowser\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} (Orphan registry key) 
HKCU\..\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} (Orphan registry key) 
HKCU\..\Toolbar\WebBrowser\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} (Orphan registry key) 
.
============== Added scan ==============
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\WINDOWS\system32\blank.htm
Show_ToolBar: yes
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search Page: hxxp://search.live.com
Default_Page_URL: hxxp://www.msn.com
Start Page Redirect Cache: hxxp://www.msn.com/
Start Page Redirect Cache_TIMESTAMP: c691bd2c2068ca01
Start Page Redirect Cache AcceptLangs: en-us
Enable Browser Extensions: yes
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Start Page: hxxp://fr.msn.com/
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: C:\Documents and Settings\All Users\Application Data\ICQ\ICQNewTab
ewTab.html
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\Henri\Desktop\BURREAU\ANYDVD.V6.0.9.0\PATCH\SLYSOFT PRODUCTS UNIVERSAL PATCH V1.38 4IN1.EXE
C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\drumagog v1.4.7.3 cracked.rar
C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR.rar
.
===================================
.
2947 Byte(s) - C:\Ad-Report-SCAN[1].log 
.
5826 File(s) - C:\DOCUME~1\Henri\LOCALS~1\Temp 
3 File(s) - C:\WINDOWS\Temp 
.
1 File(s) - C:\Program Files\Ad-Remover\BACKUP
0 File(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
End at: 23:06:40 | Mon 12/07/2009 - SCAN[1]
.
============== E.O.F ==============
.

free-surf · Answer

le meme probleme que tout a l'heure avec le log  de usb fix va falloire attendre

free-surf · Answer

############################## | UsbFix V6.059 |

User : Henri (Administrators) # STUDIO-CC32889D
Update on 01/12/2009 by Chiquitine29, C_XX & Chimay8
Start at: 10:42:51 PM | 12/7/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Quad CPU    Q6600  @ 2.40GHz
Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : ESET NOD32 Antivirus 3.0 3.0 [ Enabled | Updated ]

C:\ -> Local Fixed Disk # 58.59 Go (19.24 Go free) [System] # NTFS
D:\ -> Local Fixed Disk # 239.49 Go (152.73 Go free) [Programs] # NTFS
E:\ -> Local Fixed Disk # 298.09 Go (150 Go free) [Projects] # NTFS
F:\ -> CD-ROM Disc
G:\ -> CD-ROM Disc
I:\ -> CD-ROM Disc

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe 720
C:\WINDOWS\system32\csrss.exe 948
C:\WINDOWS\system32\winlogon.exe 972
C:\WINDOWS\system32\services.exe 1020
C:\WINDOWS\system32\lsass.exe 1032
C:\WINDOWS\system32\svchost.exe 1200
C:\WINDOWS\system32\svchost.exe 1248
C:\WINDOWS\System32\svchost.exe 1288
C:\WINDOWS\system32\svchost.exe 1360
C:\WINDOWS\system32\svchost.exe 1396
C:\WINDOWS\system32\spoolsv.exe 1440
C:\WINDOWS\system32\svchost.exe 1544
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1576
C:\WINDOWS\system32\logonui.exe 1600
C:\Program Files\Bonjour\mDNSResponder.exe 1616
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 1648
C:\Program Files\ICQ6Toolbar\ICQ Service.exe 1700
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1756
C:\WINDOWS\system32\svchost.exe 1804
C:\WINDOWS\system32\wdfmgr.exe 1880
C:\WINDOWS\system32\wuauclt.exe 2004
C:\WINDOWS\System32\alg.exe 492
C:\WINDOWS\system32\userinit.exe 1584
C:\WINDOWS\Explorer.EXE 1908
C:\WINDOWS\system32\wbem\wmiprvse.exe 680

################## | Fichiers # Dossiers infectieux |

C:\autorun.inf -> fichier appel&#1497; : "C:\g12g.exe" ( Absent ! )  
Supprim&#1497; ! C:\autorun.inf 
D:\autorun.inf -> fichier appel&#1497; : "D:\g12g.exe" ( Absent ! )  
Supprim&#1497; ! D:\autorun.inf 
E:\autorun.inf -> fichier appel&#1497; : "E:\g12g.exe" ( Absent ! )  
Supprim&#1497; ! E:\autorun.inf 

################## | Spyware.OnlineGames |

Supprim&#1497; ! C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP285\A0066453.dll 
Supprim&#1497; ! C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP285\A0069378.dll 

################## | Registre # Cl&#1497;s infectieuses |

Supprim&#1497; ! [HKLM\SOFTWARE\Classes\CLSID\MADOWN]  
Supprim&#1497; ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"  
Supprim&#1497; ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"  

################## | Registre # Mountpoints2 |

Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{0f8b76a0-1f91-11dd-80b7-e2e39fedb569}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{263f190e-1958-11dd-80b3-b9e2376b4cea}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{53651922-c47f-11de-831e-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{599fb33e-6232-11de-823f-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{6b8b0222-c157-11de-8313-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{7a7ca295-39ea-11de-8203-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{82324f82-d191-11dd-8163-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{836e1855-b8b7-11de-82f8-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{83dd2cba-a780-11de-82cf-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{bddd01a9-5858-11de-8232-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{d41b374e-c6f7-11de-8327-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{d41b3760-c6f7-11de-8327-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{df2a3fd2-ae8b-11de-82e7-0019d1ad286c}\Shell\AutoRun\Command  
Supprim&#1497; ! HKCU\...\Explorer\MountPoints2\{df2a3fd3-ae8b-11de-82e7-0019d1ad286c}\Shell\AutoRun\Command  

################## | Listing des fichiers pr&#1497;sent |

[09/20/2009 15:52|--a------|8863] C:\Ask & Record Toolbar Setup Log.txt 
[11/09/2007 15:59|--a------|0] C:\AUTOEXEC.BAT 
[09/16/2001 17:39|--a------|1024] C:\b4 
[12/02/2007 18:32|---hs----|247] C:\boot.ini 
[05/05/2009 17:35|--a------|7189] C:\ComboFix.txt 
[11/09/2007 15:59|--a------|0] C:\CONFIG.SYS 
[11/09/2007 15:59|-rahs----|0] C:\IO.SYS 
[11/09/2007 15:59|-rahs----|0] C:\MSDOS.SYS 
[08/04/2004 14:00|-rahs----|47564] C:\NTDETECT.COM 
[10/10/2009 15:10|-rahs----|250048] C:
tldr 
[?|?|?] C:\pagefile.sys 
[11/09/2007 12:49|--a------|17032] C:\PkgClnup.log 
[05/05/2009 17:36|--a------|1480] C:apport.txt 
[12/07/2009 22:57|--a------|5065] C:\UsbFix.txt 

################## | Vaccination |

# C:\autorun.inf -> Dossier cr&#1497;&#1497; par UsbFix.  
# D:\autorun.inf -> Dossier cr&#1497;&#1497; par UsbFix.  
# E:\autorun.inf -> Dossier cr&#1497;&#1497; par UsbFix.  

################## | Cracks / Keygens / Serials |

"D:\Bosendorfer\bosendorfer_keygen.exe"  
12/09/2003 11:27 |Size 315904 |Crc32 0ce04b54 |Md5 fe08abf945c75394e96d04c6652ba68c  
 
"D:\EZDrummer Install\Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX\KeyGen.exe"  
06/07/2006 21:38 |Size 22528 |Crc32 e7e08c9a |Md5 f9dbb37fce70d213c631d3c25f83be67  
 
"D:\EZDrummer Install\Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX\EZdrummer10\Install\PC\program files\Toontrack\EZDrummer\HelpMenu\EZD_QuickTour.exe"  
03/27/2006 23:13 |Size 4849699 |Crc32 a2912c6d |Md5 d3b8b8fb07b1901b9a4d85bc4b3aa57e  
 
"D:\Setups\Apps\Ahead.Nero.v7.8.5.0.Multilingual.Incl.Keymaker-EMBRACE\keygen-EMBRACE.exe"  
04/16/2007 15:20 |Size 118784 |Crc32 52ce3b97 |Md5 a2fcfa38b381163e372a3f195541a848  
 
"D:\Setups\VST Instruments\Gary.Garritan.Jazz.and.Big.Band.VSTi.DXi.RTAS.AU.HYBRiD.DVDR-DYNAMiCS\Keygen\Key Gen\KONTAKT.v2.02.KEYGEN.EXE"  
06/28/2007 17:16 |Size 132256 |Crc32 ef7ffd4f |Md5 d611f3e3931fc156706c144dbdd092bc  
 
"D:\Setups\VST Instruments\Native Instruments\Native Instruments Kontakt 2.2.1 VSTi-DXi-RTAS\Keygen.exe"  
12/03/2007 22:33 |Size 91136 |Crc32 39a2fed3 |Md5 8959423d58d6a07da991ec1178e83721  
 
"D:\Setups\VST Instruments\Rob.Papen.Predator.VSTi.v1.1.Incl.Keygen-AiR\keygen.exe"  
10/12/2007 16:35 |Size 47616 |Crc32 f6338441 |Md5 e57ac3c7a99e79f49aa13d6daac05ddb  
 
"D:\Setups\VST Instruments\Rob.Papen.Predator.VSTi.v1.1.Incl.Keygen-AiR\Setup.exe"  
10/12/2007 17:43 |Size 7155900 |Crc32 510cf6b6 |Md5 de76efcdbf8947cc73da855ec3a98733  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\KeyGen.exe"  
04/20/2007 01:39 |Size 22528 |Crc32 dc5f374b |Md5 ab4a971e254be18c3b0470bf650ff0f5  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\Setup.exe"  
08/11/2000 04:22 |Size 54272 |Crc32 15a22d1a |Md5 d765793f5d803673d1b4b5586e8fd66c  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\CHKDSK.EXE"  
03/30/2001 14:38 |Size 59471 |Crc32 4cabf4c7 |Md5 53545bed66d627e5403c6a34c090c6ed  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\EMM386.EXE"  
03/30/2001 14:38 |Size 179583 |Crc32 19be7158 |Md5 da5fd1ab76171ca857d76df1ccf748db  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\FLOPPY.EXE"  
03/30/2001 14:38 |Size 32768 |Crc32 796d1df6 |Md5 d4a997aca446bd7e58827002888587a5  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\FLOPPY9x.EXE"  
03/30/2001 14:38 |Size 57344 |Crc32 1e7d5e09 |Md5 09edb7b5c7961da474555e763d80529f  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\FLOPPYME.EXE"  
03/30/2001 14:38 |Size 57856 |Crc32 2eb70a00 |Md5 341b379b0508949603af82ea59bd821d  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\NWCDEX.EXE"  
03/30/2001 14:38 |Size 21756 |Crc32 1a99ba16 |Md5 c9c13316344a1c0645f21de0184ec1c7  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\PQBOOT.EXE"  
09/16/2002 01:18 |Size 90418 |Crc32 5ef45c93 |Md5 341398aebec50aa92061e975bb3c5e85  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\PTEDIT32.EXE"  
07/20/2001 15:27 |Size 501760 |Crc32 ccd983ed |Md5 27c4a902e350258d381ca6748a106862  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEMestrmbr.exe"  
03/30/2001 14:39 |Size 41038 |Crc32 c1c40b4c |Md5 6e712a1b4ddb46918d9461a209e46db3  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Rescueme\DOSYSTEM\WRPROG.EXE"  
09/16/2002 01:19 |Size 66544 |Crc32 a39bc5e6 |Md5 45cef90de0316e86e757f795053dac0d  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Setup\instmsia.exe"  
03/11/2002 09:45 |Size 1708856 |Crc32 3ccaccf9 |Md5 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Setup\instmsiw.exe"  
03/11/2002 10:06 |Size 1822520 |Crc32 be716ace |Md5 61a5fb191ae2ae876db31dcce75e4183  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\BTMagic\Setup\setup.exe"  
09/16/2002 03:28 |Size 217088 |Crc32 0dbf293d |Md5 ff6e6e5ff0ba6c8f6444217e33d46538  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\DKeeper\instmsia.exe"  
03/11/2002 09:45 |Size 1708856 |Crc32 3ccaccf9 |Md5 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\DKeeper\instmsiw.exe"  
03/11/2002 10:06 |Size 1822520 |Crc32 be716ace |Md5 61a5fb191ae2ae876db31dcce75e4183  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\DKeeper\setup.exe"  
09/15/2002 23:01 |Size 217088 |Crc32 175c1856 |Md5 4bcbd459621a41ffbcdaa89a6fe881f5  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\Setup.exe"  
08/11/2000 04:22 |Size 54272 |Crc32 15a22d1a |Md5 d765793f5d803673d1b4b5586e8fd66c  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\CHKDSK.EXE"  
03/30/2001 14:38 |Size 59471 |Crc32 4cabf4c7 |Md5 53545bed66d627e5403c6a34c090c6ed  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\EMM386.EXE"  
03/30/2001 14:38 |Size 179583 |Crc32 19be7158 |Md5 da5fd1ab76171ca857d76df1ccf748db  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\FLOPPY.EXE"  
03/30/2001 14:38 |Size 32768 |Crc32 796d1df6 |Md5 d4a997aca446bd7e58827002888587a5  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\FLOPPY9x.EXE"  
03/30/2001 14:38 |Size 57344 |Crc32 1e7d5e09 |Md5 09edb7b5c7961da474555e763d80529f  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\FLOPPYME.EXE"  
03/30/2001 14:38 |Size 57856 |Crc32 2eb70a00 |Md5 341b379b0508949603af82ea59bd821d  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\NWCDEX.EXE"  
03/30/2001 14:38 |Size 21756 |Crc32 1a99ba16 |Md5 c9c13316344a1c0645f21de0184ec1c7  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\RESCUEME\DOSYSTEM\PTEDIT32.EXE"  
09/16/2002 02:24 |Size 503808 |Crc32 aa3e7496 |Md5 7f7f39b5b57971f17291dfd10f01207b  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\Setup\instmsia.exe"  
03/11/2002 09:45 |Size 1708856 |Crc32 3ccaccf9 |Md5 43f7305c2e5dd4a8f3c5abeb2ffe4833  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\Setup\instmsiw.exe"  
03/11/2002 10:06 |Size 1822520 |Crc32 be716ace |Md5 61a5fb191ae2ae876db31dcce75e4183  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\PartitionMagic\Setup\setup.exe"  
09/16/2002 18:40 |Size 217088 |Crc32 10871ada |Md5 a2b0c046755a6c4b050c7b2a48d83914  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\Setup\Setup.exe"  
04/17/2007 02:45 |Size 73728 |Crc32 c17e6cfe |Md5 71e6dd8a9de4a9baf89fca951768059a  
 
"D:\Setups\VST Instruments\Swarplug.full.edition.including.keygen\Setup\_ISDel.exe"  
04/17/2007 02:45 |Size 27648 |Crc32 72a82089 |Md5 51161bf79f25ff278912005078ad93d5  
 
"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\AUTOEXE2.BAT 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\AUTOEXEC.BAT 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\CHKDSK.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\EMM386.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\FLOPPY.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\FLOPPY9x.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\FLOPPYME.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\NWCDEX.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\PQBOOT.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\PTEDIT32.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEMestrmbr.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\DOSYSTEM\WRPROG.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Rescueme\setup.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Setup\instmsia.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Setup\instmsiw.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\BTMagic\Setup\setup.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\AUTOEXE2.BAT 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\AUTOEXEC.BAT 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\CHKDSK.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\EMM386.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\FLOPPY.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\FLOPPY9x.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\FLOPPYME.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\NWCDEX.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\DOSYSTEM\PTEDIT32.EXE 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\RESCUEME\setup.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\Setup\instmsia.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\Setup\instmsiw.exe 

"D:\Setups\Apps\Norton Partition Magic 8.05 + serial.zip"
-> Contain : Norton Partition Magic 8.05 + serial\Setup\setup.exe 

"D:\Setups\Plugins\Melodyne\melodyne keygen..zip"
-> Contain : Install.exe     653293    DFLT-X    1%     644263  12-05-2002 09:48:12 f43e0899 

"D:\Setups\Plugins\Melodyne\melodyne keygen..zip"
-> Contain : CrcCheck.exe     29332    DFLT-X   10%      26443  12-05-2002 09:48:12 22764eac 

"D:\Setups\VST Instruments\Gary.Garritan.Jazz.and.Big.Band.VSTi.DXi.RTAS.AU.HYBRiD.DVDR-DYNAMiCS\Keygen\Key Gen\KONTAKT.v2.02.KEYGEN.EXE.zip"
-> Contain : Archive File: KONTAKT.v2.02.KEYGEN.EXE.zip  [ZIP] 

"D:\Setups\VST Instruments\Gary.Garritan.Jazz.and.Big.Band.VSTi.DXi.RTAS.AU.HYBRiD.DVDR-DYNAMiCS\Keygen\Key Gen\KONTAKT.v2.02.KEYGEN.EXE.zip"
-> Contain : KONTAKT.v2.02.KEYGEN.EXE 

"C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\drumagog v1.4.7.3 cracked.rar" 
-> contain :  Setup.exe

"C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR.rar" 
-> contain :  WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR\Keygen.exe

"C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR.rar" 
-> contain :  WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR\Setup.exe

"D:\EZDrummer Install\Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX.rar" 
-> contain :  Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX\EZ Drummer - Update 1.02.exe

"D:\EZDrummer Install\Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX.rar" 
-> contain :  Toontrack - EZ Drummer + KeyGen + Update 1.02 + all EZX\KeyGen.exe

"D:\Setups\Audio Apps\Tascam GigaStudio v3.21.2390 Incl Keygen\a-tg321.rar" 
-> contain :  keygen.exe

"D:\Setups\Audio Apps\Tascam GigaStudio v3.21.2390 Incl Keygen\a-tg321.rar" 
-> contain :  setup.exe

"D:\Setups\VST Instruments\Tone2.Firebird.VSTi.v1.2.1.incl.Keygen-AiR\a-fb121.rar" 
-> contain :  keygen.exe



LOG USBFIX

free-surf · Answer

ok pour les log

moment de grace · Answer

on peut dire que usbfix est ton ami

les cracks...danger, surtout si tu as des projets musicaux importants

relances Ad Remover en mode sans échec
https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

Option L Lancer le nettoyage

free-surf · Answer

J'ai des cracks pour les plugins de cubase, se sont des copain qui bosse dans d'autre studio qui me les ont installer, je sais qu'il faut faire attention avec les cracks, si j'utilise Ad remover en MSE je ne risque pas de perdre mes plugin? ou creer un bug dans les plugiin?
ou sa ne suprime que l'infection qui se trouve dans le cracks?

moment de grace · Answer

on supprime ce qui est au post 16

pour les crack, ce serait dommage de perdre tous tes projets pour ca...

free-surf · Answer

je suis d'accord avec toi que sa serais domage que l'infection plante l'ordi mais j'ai besoin de ces plugs
et je prefereb etre sur de ce que je vais faire, si jamais je suprime ces crack, les plugins fonctionneront-ils toujours entant donner qu'il sont installe?

moment de grace · Answer

là, tu es trop gourmand
et je ne sais pas tout ce que fais avec tes pc
vois avec tes amis, moi je te mets juste en garde et ne supprime aucun crack(sauf ceux repérés comme virus)...d'autant que je sais de quoi je cause par expérience perso

moment de grace · Answer

on en est là

relances Ad Remover en mode sans échec 
http://www.micro-astuce.com/depannage/demarrer-mode-sans-ech­ec.php 

Option L Lancer le nettoyage

free-surf · Answer

ok je verifie, a quel plug correspond tous ca et je lance le mode sans echec

free-surf · Answer

aller je me lance donc je passe en mode sans echec je lance ad remover et je nettoye?

moment de grace · Answer

vas y sans crainte

free-surf · Answer

heu, c'est bien la premiere fois que j'arrive pas a demarer en mode sans echec....
c'est bien F8? en tout cas c'est ce que j'ai fais au demararge et l'ordi m'affiche juste un page noir sans les option habituele tu aurais une idee?

moment de grace · Answer

fais le en mode normal

free-surf · Answer

sur un pc anglais Mode sans echec c'est safe mode?

moment de grace · Answer

euh....oui je pense

free-surf · Answer

ouai c'est bon c'est ca mais il a un acces bisard pour reuissir a demarer en mode sans echec, la supression et en cours

free-surf · Answer

c'est bon c'est fini, je redemare normalement ? je fais quoi?

moment de grace · Answer

oui et tu postes le rapport

( le rapport est sauvegardé aussi sous C:\Ad-report.log )

free-surf · Answer

juste une petite question, quel est l'interêt de faire la supression en mode sans echec?

free-surf · Answer

.
======= LOGFILE OF AD-REMOVER 1.1.4.6_E | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 07.12.2009 at 21:14
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at:  0:38:04, Tue 12/08/2009 | Safe Mode | Option: CLEAN
Executed from: C:\Program Files\Ad-Remover\
Operating system: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Computer Name: STUDIO-CC32889D | Current user: Henri
.
============== NEUTRALIZED ELEMENT(S) ==============
.

C:\WINDOWS\Prefetch\SOFTWAREUPDATE.EXE-1415D1B8.pf

(!) -- Temp files deleted.
 
.
HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} 
HKLM\Software\Classes\TypeLib\{937936AF-28CA-4973-B8AE-F250406149A2}
HKLM\Software\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}
HKLM\Software\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}
.
HKCU\..\Toolbar\WebBrowser\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} (Orphan registry key) 
.
============== Added scan ==============
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\WINDOWS\system32\blank.htm
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Start Page Redirect Cache: hxxp://www.msn.com/
Start Page Redirect Cache_TIMESTAMP: c691bd2c2068ca01
Start Page Redirect Cache AcceptLangs: en-us
Enable Browser Extensions: yes
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\Henri\Desktop\BURREAU\ANYDVD.V6.0.9.0\PATCH\SLYSOFT PRODUCTS UNIVERSAL PATCH V1.38 4IN1.EXE
C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\drumagog v1.4.7.3 cracked.rar
C:\Documents and Settings\Henri\Desktop\BURREAU\plugins rev delay comp\WaveMachine.Labs.Drumagog.Platinum.VST.RTAS.v4.10.incl.Keygen-AiR.rar
.
===================================
.
2867 Byte(s) - C:\Ad-Report-CLEAN[1].log 
3266 Byte(s) - C:\Ad-Report-SCAN[1].log 
.
0 File(s) - C:\DOCUME~1\Henri\LOCALS~1\Temp 
0 File(s) - C:\WINDOWS\Temp 
.
18 File(s) - C:\Program Files\Ad-Remover\BACKUP
1 File(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
End at:  0:41:21 | Tue 12/08/2009 - CLEAN[1]
.
============== E.O.F ==============
.

moment de grace · Answer

ok

 Téléchargez MalwareByte's Anti-Malware
  https://www.majorgeeks.com/files/details/malwarebytes_anti_malware.html

. Sur la page cliques sur Télécharger Malwarebyte's Anti-Malware 
. Enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation. 
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen complet
. Cliques sur Rechercher
. Le scan démarre. 
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés. 
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur  Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine. 
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse. 
. Rends toi dans l'onglet rapport/log 
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous 
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller 


Si tu as besoin d'aide regarde ces tutoriels : 
 Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
 http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

free-surf · Answer

ok, les plug ont ete bien ou pqs ? parce que d'apres le rapport(j'y comprend pas grand chose en log) il les as suspecte mais c'est pas indique qu'ils ont ete suprimees.
a dans 45 minutes

free-surf · Answer

le scan vient de finir et 44 infection detece voici le rapport


Malwarebytes' Anti-Malware 1.42
Version de la base de donn&#1497;es: 3312
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/8/2009 2:21:04 AM
mbam-log-2009-12-08 (02-20-54).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
El&#1497;ments examin&#1497;s: 497402
Temps &#1497;coul&#1497;: 1 hour(s), 17 minute(s), 45 second(s)

Processus m&#1497;moire infect&#1497;(s): 0
Module(s) m&#1497;moire infect&#1497;(s): 5
Cl&#1497;(s) du Registre infect&#1497;e(s): 0
Valeur(s) du Registre infect&#1497;e(s): 1
El&#1497;ment(s) de donn&#1497;es du Registre infect&#1497;(s): 2
Dossier(s) infect&#1497;(s): 1
Fichier(s) infect&#1497;(s): 35

Processus m&#1497;moire infect&#1497;(s):
(Aucun &#1497;l&#1497;ment nuisible d&#1497;tect&#1497;)

Module(s) m&#1497;moire infect&#1497;(s):
C:\Documents and Settings\Henri\Local Settings	emp\E_4\krnln.fnr (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\com.run (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\dp1.fne (Worm.AutoRun) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\shell.fne (Worm.AutoRun) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\eAPI.fne (Worm.AutoRun) -> No action taken.

Cl&#1497;(s) du Registre infect&#1497;e(s):
(Aucun &#1497;l&#1497;ment nuisible d&#1497;tect&#1497;)

Valeur(s) du Registre infect&#1497;e(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xp-24ae0b83 (Trojan.Agent) -> No action taken.

El&#1497;ment(s) de donn&#1497;es du Registre infect&#1497;(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infect&#1497;(s):
C:\Documents and Settings\Henri\Local Settings	emp\E_4 (Worm.AutoRun) -> No action taken.

Fichier(s) infect&#1497;(s):
C:\Documents and Settings\Henri\Local Settings	emp\E_4\krnln.fnr (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\com.run (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\dp1.fne (Worm.AutoRun) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\shell.fne (Worm.AutoRun) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\eAPI.fne (Worm.AutoRun) -> No action taken.
C:\Program Files\CDXTRACT4\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP284\A0065934.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP285\A0065946.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP285\A0069535.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP286\A0069543.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP287\A0069552.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP287\A0069571.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP348\A0089244.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\shell.fne (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\com.run (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\dp1.fne (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\eAPI.fne (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\krnln.fnr (Trojan.Agent) -> No action taken.
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\EZDrummer\HALion 2\HALion2 Uninstall\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken.
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\EZDrummer\Nomad Factory\Blue Tubes Bundle\Nomad Factory Blue Tubes Bundle Uninstall\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken.
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\Waves\UninstallDiamond\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken.
D:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP348\A0089249.exe (Spyware.OnlineGames) -> No action taken.
D:\Wizoo Darbuka & Latigo\best service artist grooves keygen.exe (Trojan.Downloader) -> No action taken.
D:\Wizoo Darbuka & Latigo\Wizoo Darbuka & Latigo (DVD original) need keygen\best service artist grooves keygen.exe (Trojan.Downloader) -> No action taken.
E:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP348\A0089254.exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\internet.fne (Worm.AutoRun) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\RegEx.fne (Worm.AutoRun) -> No action taken.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\spec.fne (Worm.AutoRun) -> No action taken.
C:\Documents and Settings\Henri\Start Menu\Programs\Startup\¡¡¡¡¡¡.lnk (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\internet.fne (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\og.dll (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\og.edt (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\spec.fne (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\ul.dll (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\XP-24AE0B83.EXE (Trojan.Agent) -> No action taken.

free-surf · Answer

j'attend ton accord pour supprimer etant donner qu'il y a des infections dans des plug tres important de cubase infectees

moment de grace · Answer

effectivement

D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\EZDrummer\HALion 2\HALion2 Uninstall\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken. 
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\EZDrummer\Nomad Factory\Blue Tubes Bundle\Nomad Factory Blue Tubes Bundle Uninstall\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken. 
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\Waves\UninstallDiamond\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken. 
D:\Wizoo Darbuka & Latigo\best service artist grooves keygen.exe (Trojan.Downloader) -> No action taken. 
D:\Wizoo Darbuka & Latigo\Wizoo Darbuka & Latigo (DVD original) need keygen\best service artist grooves keygen.exe (Trojan.Downloader) -> No action taken. 

je sais que tu tiens à ceux là et j'ai eu le nez fin de t'avoir conseiller de ne pas supprimer

deux solutions
1) la plus sage tout supprimer
2) la moins sage, graver les fichiers en question, puis refaire MBAM proprement en supprimant tout à la fin

c'est toi qui voit mais le 2) t'amènera forcément à nouveau des problèmes

j'attends ta réponse

free-surf · Answer

je n'ai pas ferme MBAM, je peux decocher les programes de cubases et suprimer les autres ? 
Les infections
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\EZDrummer\HALion 2\HALion2 Uninstall\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken. 
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\EZDrummer\Nomad Factory\Blue Tubes Bundle\Nomad Factory Blue Tubes Bundle Uninstall\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken. 
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\Waves\UninstallDiamond\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken. 
D:\Wizoo Darbuka & Latigo\best service artist grooves keygen.exe (Trojan.Downloader) -> No action taken. 
D:\Wizoo Darbuka & Latigo\Wizoo Darbuka & Latigo (DVD original) need keygen\best service artist grooves keygen.exe (Trojan.Downloader) -> No action taken. 
sont-elles grave? 
Merci d'avoir eu le nez fin

moment de grace · Answer

je peux decocher les programes de cubases et suprimer les autres ? 
oui

sont-elles grave? 
je ne sais pas...

Merci d'avoir eu le nez fin
j'espère pour toi que non pour leur réutilisation prochaine

refais un nouveau RSIT ensuite pour faire le point

free-surf · Answer

Malwarebytes' Anti-Malware 1.42
Version de la base de donn&#1497;es: 3312
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/8/2009 2:53:30 AM
mbam-log-2009-12-08 (02-53-30).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
El&#1497;ments examin&#1497;s: 497402
Temps &#1497;coul&#1497;: 1 hour(s), 17 minute(s), 45 second(s)

Processus m&#1497;moire infect&#1497;(s): 0
Module(s) m&#1497;moire infect&#1497;(s): 5
Cl&#1497;(s) du Registre infect&#1497;e(s): 0
Valeur(s) du Registre infect&#1497;e(s): 1
El&#1497;ment(s) de donn&#1497;es du Registre infect&#1497;(s): 2
Dossier(s) infect&#1497;(s): 1
Fichier(s) infect&#1497;(s): 35

Processus m&#1497;moire infect&#1497;(s):
(Aucun &#1497;l&#1497;ment nuisible d&#1497;tect&#1497;)

Module(s) m&#1497;moire infect&#1497;(s):
C:\Documents and Settings\Henri\Local Settings	emp\E_4\krnln.fnr (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\com.run (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\dp1.fne (Worm.AutoRun) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\shell.fne (Worm.AutoRun) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\eAPI.fne (Worm.AutoRun) -> Delete on reboot.

Cl&#1497;(s) du Registre infect&#1497;e(s):
(Aucun &#1497;l&#1497;ment nuisible d&#1497;tect&#1497;)

Valeur(s) du Registre infect&#1497;e(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xp-24ae0b83 (Trojan.Agent) -> Quarantined and deleted successfully.

El&#1497;ment(s) de donn&#1497;es du Registre infect&#1497;(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infect&#1497;(s):
C:\Documents and Settings\Henri\Local Settings	emp\E_4 (Worm.AutoRun) -> Delete on reboot.

Fichier(s) infect&#1497;(s):
C:\Documents and Settings\Henri\Local Settings	emp\E_4\krnln.fnr (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\com.run (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\dp1.fne (Worm.AutoRun) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\shell.fne (Worm.AutoRun) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\eAPI.fne (Worm.AutoRun) -> Delete on reboot.
C:\Program Files\CDXTRACT4\UNWISE.EXE (Malware.Packer.Morphine) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP284\A0065934.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP285\A0065946.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP285\A0069535.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP286\A0069543.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP287\A0069552.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP287\A0069571.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP348\A0089244.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\shell.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\com.run (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dp1.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\eAPI.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\krnln.fnr (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\EZDrummer\HALion 2\HALion2 Uninstall\UNWISE.EXE (Malware.Packer.Morphine) -> Not selected for removal.
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\EZDrummer\Nomad Factory\Blue Tubes Bundle\Nomad Factory Blue Tubes Bundle Uninstall\UNWISE.EXE (Malware.Packer.Morphine) -> Not selected for removal.
D:\Audio Programs\Steinberg\Cubase SX 3\Vstplugins\Waves\UninstallDiamond\UNWISE.EXE (Malware.Packer.Morphine) -> Not selected for removal.
D:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP348\A0089249.exe (Spyware.OnlineGames) -> Not selected for removal.
D:\Wizoo Darbuka & Latigo\best service artist grooves keygen.exe (Trojan.Downloader) -> Not selected for removal.
D:\Wizoo Darbuka & Latigo\Wizoo Darbuka & Latigo (DVD original) need keygen\best service artist grooves keygen.exe (Trojan.Downloader) -> Not selected for removal.
E:\System Volume Information\_restore{22BF0D84-E4DF-4306-84B5-810087C492F4}\RP348\A0089254.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\internet.fne (Worm.AutoRun) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\RegEx.fne (Worm.AutoRun) -> Delete on reboot.
C:\Documents and Settings\Henri\Local Settings	emp\E_4\spec.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Documents and Settings\Henri\Start Menu\Programs\Startup\¡¡¡¡¡¡.lnk (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\internet.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\og.dll (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\og.edt (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\spec.fne (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ul.dll (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\XP-24AE0B83.EXE (Trojan.Agent) -> Delete on reboot.



je fini de graver les installations et je relance le scan

moment de grace · Answer

redémarre le pc pour que les suppressions s'éxécutent
vide la quarantaine
puis RSIT

free-surf · Answer

je viens de redemarer j'ai vide la quarantaine 

et voice le RSIT



Logfile of random's system information tool 1.06 (written by random/random)
Run by Henri at 2009-12-08 03:00:56
Microsoft Windows XP Professional Service Pack 3
System drive C: has 20 GB (34%) free of 60 GB
Total RAM: 3310 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:00:58, on 12/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Henri\Desktop\RSIT.exe
C:\Program Files	rend micro\Henri.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\fix.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

free-surf · Answer

Je viens de relancer MBAM

moment de grace · Answer

c'est pas mal du tout

reste ceci
O4 - HKLM\..\Run: [TrialReset] C:\WINDOWS\fix.exe

essayons ainsi

   Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent 

&#9654; Télécharge List&Kill'em et enregistre le sur ton bureau 

http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem.zip

Il ne necessite pas d'installation 

&#9654;double clic (clic droit "executer en tant qu'administrateur" pour Vista) pour lancer le scan 

choisis la langue puis choisis l'option 1 = Mode Recherche 

&#9654;laisse travailler l'outil 

à la fin du scan la fenêtre se referme seule. 

ouvre C:\List'em.txt 

&#9654;colle le contenu dans ta prochaine réponse

free-surf · Answer

comment tu annalyses le rapport de RSIT, pour savoir ou ce trouvent les infections, que je ne sois pas obligé de venir demander de l'aide la prochaine fois que serais embeté,

Vraiment merci beaucoup pour ton aide

moment de grace · Answer

je suis une formation pour ca...et je me fais la main sur des gars comme toi
(sourire)
n'oublies pas le post 49

free-surf · Answer

ok ok 

Ravis d'etre entre tes mains alors, tu me semble bien competant,
Juste une autre petite question comme ca, je compte passer sur W7 (sur mon portable)
si tu as quelque avis sur le systeme d'exploitation a me donner ca pourait m'interreser merci d'avance

free-surf · Answer

le scan est en cour*

free-surf · Answer

il prend du temps le scan de list'em? parce que il est bloqué a 85% depuis un petit moment deja (20minutes)

moment de grace · Answer

non d'habitude c'est plus rapide mais l'outil évolue tous les jours

as tu déactiver anti virus et pare feu ?

si ca perdure encore

redemarre le pc et recommences

free-surf · Answer

oui j'ai bien tout desactivé 
je refais un ou deux teste

free-surf · Answer

le redemarage n'a pas l'air de changer grand chose

moment de grace · Answer

ok

avant de faire du mal pour rien, on va le tester ce fichier


Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\fix.exe 


Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse. 

........................

si tu ne le trouves pas

Affiche tous les fichiers et dossiers  cachés: 
Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cachés 

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK

free-surf · Answer

Antivirus Version Last Update Result 
a-squared 4.5.0.43 2009.11.27 - 
AhnLab-V3 5.0.0.2 2009.11.27 - 
AntiVir 7.9.1.79 2009.11.27 - 
Antiy-AVL 2.0.3.7 2009.11.27 - 
Authentium 5.2.0.5 2009.11.27 - 
Avast 4.8.1351.0 2009.11.27 - 
AVG 8.5.0.426 2009.11.27 - 
BitDefender 7.2 2009.11.28 - 
CAT-QuickHeal 10.00 2009.11.27 - 
ClamAV 0.94.1 2009.11.27 - 
Comodo 3064 2009.11.28 - 
DrWeb 5.0.0.12182 2009.11.28 - 
eSafe 7.0.17.0 2009.11.26 - 
eTrust-Vet 35.1.7146 2009.11.27 - 
F-Prot 4.5.1.85 2009.11.27 - 
F-Secure 9.0.15370.0 2009.11.24 - 
Fortinet 4.0.14.0 2009.11.28 - 
GData 19 2009.11.28 - 
Ikarus T3.1.1.74.0 2009.11.27 - 
K7AntiVirus 7.10.906 2009.11.27 - 
Kaspersky 7.0.0.125 2009.11.28 - 
McAfee 5815 2009.11.27 - 
McAfee+Artemis 5815 2009.11.27 - 
McAfee-GW-Edition 6.8.5 2009.11.27 - 
Microsoft 1.5302 2009.11.27 - 
NOD32 4643 2009.11.27 - 
Norman 6.03.02 2009.11.27 - 
nProtect 2009.1.8.0 2009.11.28 - 
Panda 10.0.2.2 2009.11.27 - 
PCTools 7.0.3.5 2009.11.28 - 
Prevx 3.0 2009.11.28 - 
Rising 22.23.05.03 2009.11.28 - 
Sophos 4.48.0 2009.11.27 - 
Sunbelt 3.2.1858.2 2009.11.27 - 
Symantec 1.4.4.12 2009.11.28 - 
TheHacker 6.5.0.2.080 2009.11.27 Trojan/Banbra.cga 
TrendMicro 9.100.0.1001 2009.11.28 - 
VBA32 3.12.12.0 2009.11.28 - 
ViRobot 2009.11.28.2059 2009.11.28 - 
VirusBuster 5.0.21.0 2009.11.27 - 
Additional information 
File size: 208353 bytes 
MD5   : 5a8deda00b4fd0a759b5316b8b247bcf 
SHA1  : 61e72a9dfe86622f13e585ace2b4dd03c59dea07 
SHA256: 716bcafe4530cd31ecbd470a435f26203653e6dc836d157a5ce2766e050aa37b 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x284B2
timedatestamp.....: 0x45602143 (Sun Nov 19 10:17:55 2006)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x29BB7 0x29C00 6.62 73fe38150d7c53aa60e04575d72203b1
.rdata 0x2B000 0x2446 0x2600 5.60 c33287a33267369ed2fc5565d1971806
.data 0x2E000 0x54AD8 0x3200 5.57 4d80e90d661b739b586d21356682c1e4
.rsrc 0x83000 0x10D0 0x1200 4.28 9ea9d4fa8d986018321af6c249feb313

( 0 imports )


( 0 exports )
 
TrID  : File type identification
Win32 Executable MS Visual C++ (generic) (53.1%)
Windows Screen Saver (18.4%)
Win32 Executable Generic (12.0%)
Win32 Dynamic Link Library (generic) (10.6%)
Generic Win/DOS Executable (2.8%) 
ThreatExpert: https://www.symantec.com?md5=5a8deda00b4fd0a759b5316b8b247bcf 
ssdeep: 6144:FVRPu+C/GIMMh5gbwT0LnyTl0/KKn5TyRxg:/RPsh5D0LyTl+hlOxg 
PEiD  : Armadillo v1.71 
CWSandbox: http://research.sunbelt-software.com/... 
RDS   : NSRL Reference Data Set

moment de grace · Answer

ok c'est bon on laisse tomber

comment va le pc ?

free-surf · Answer

ca a l'air d'aller

free-surf · Answer

je fais quoi je vire le .rar ?

moment de grace · Answer

s'il ne sert à rien ...oui

free-surf · Answer

et pour le fichier fix infester ?

moment de grace · Answer

non n'y touches pas c'est apparement un faux positif
demain je vérifie de chez moi tout ca et on fera le ménage si c'est ok

free-surf · Answer

d'accord pas de soucis tu seras la a quelle heure demain? ( que je me leve pas a16H comme j'ai fait aujourd'hui)
a demain

moment de grace · Answer

en général tôt...mais le plus gros est fait

free-surf · Answer

ok je te remerci pour tout, a demain

moment de grace · Answer

1) supprimes ceci
C:\Program Files\ICQ6Toolbar\ICQ Service.exe 

2)cherches  C:\Program Files	rend micro\Henri.exe et cliques dessus pour lancer hijackthis
Au menu principal, choisir do a scan only, puis cocher la case devant les lignes suivantes à corriger et cliquer en bas sur Fix Checked 
R3 - URLSearchHook: (no name) - - (no file) 
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll 
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"     
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe     
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime     
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe     
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"     
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')     
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')     
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe     

3) Important purge de restauration 
http://www.bibou0007.com/windows-xp-f101/purger-la-restauration-du-systeme-sous-windows-xp-t151.htm

4)&#9654;---> Télécharge ToolsCleaner2sur ton Bureau. 
https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/

* Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur ToolsCleaner2.exe pour le lancer. 
* Clique sur Recherche et laisse le scan agir. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options Facultatives. 
* Clique sur Quitter pour obtenir le rapport. 
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

5) tu peux mettre le topic en resolu 
https://www.commentcamarche.net/infos/25917-marquer-un-fil-de-discussion-comme-etant-resolu/


Bonne continuation et surtout , prudence et bon surf :)

Demade d'aide pour supression de virus

63 réponses

Discussions similaires