Sujet Précédent Sujet Suivant

Grosse infection

Résolu/Fermé
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 - 9 déc. 2009 à 21:20
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 - 16 déc. 2009 à 22:21
Bonjour,apres un scan avec antivir qui a trouvé environ 70 virus,voici que je viens de passer un coup de malewarebytes,et là le compteur a explosé,lol,donc 261 virus trouvé,ouahhhhh!!

voici le rapport,mais je pense qu'il y a encore un peu de boulot

Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3325
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

09/12/2009 21:04:39
mbam-log-2009-12-09 (21-04-39).txt

Type de recherche: Examen complet (C:\|D:\|E:\|I:\|J:\|)
Eléments examinés: 272818
Temps écoulé: 2 hour(s), 57 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 179
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 29
Fichier(s) infecté(s): 45

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\adpanel.panel1 (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adpanel.panel1.1 (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.coreservices (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.lfgax (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.lfgax.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbcoresrv.dynamicprop (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbcoresrv.dynamicprop.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbmain.commband (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.mailanim (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.mailanim.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.webmailsend (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.webmailsend.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\iebrowsercmp.browsercmp (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\iebrowsercmp.browsercmp.1 (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\instie.hbinstobj (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\instie.hbinstobj.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ad76633e-e50d-4844-9e7f-4dfbc7c18467} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ec1a2105-5621-440f-987d-27ef428131d9} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmo.desktopflash (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmo.desktopflash.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.clientdetector (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.clientdetector.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.userprofiles (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.userprofiles.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\srv.coreservices (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\toolbar.htmlmenuui (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\toolbar.htmlmenuui.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\toolbar.toolbarctl (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\toolbar.toolbarctl.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{00b77587-be1b-4201-b8e9-09fcf50ab771} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{067c6a37-72ea-4437-863a-5be20c246f3c} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1230cf51-6bc4-4a23-b3f1-c7cf0afed619} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1a2af056-1fe1-47ca-993d-5d09d18e674e} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2b81f920-6660-4f76-93bf-b1c67bf5d1a0} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e623b96-b166-4c70-8169-820761794299} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{34e29700-0d13-46aa-b9a5-ace68e21a091} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3661af2d-c27b-499c-9bcf-66c8502a3806} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3f0915b8-b238-4c2d-ad1e-60db1e14d27a} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{49155dae-c471-40fa-98ee-b2b3cad115ce} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4d783385-0dda-4188-a529-c97dc3d67cbd} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4e8b851b-05b0-4baf-b24d-d0dfe88dded3} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{50c3e2b3-4fd7-4cb9-91f9-641a6e6b3689} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{62b0b239-f9ac-4a5b-bfae-62c7a23f7627} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e10479b-31e8-4a3b-81b1-ddaf39097f19} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{726f0ab9-b842-4ae4-90c7-230e233e6a99} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{99123ac9-7dda-4c82-b252-44c2804bf392} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b247f5bf-bd9d-4ecd-8fc1-365f36a1fda1} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b9cc2b92-5611-453f-8381-8b6f72d9c0b8} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bbbfb891-98ae-4678-86f3-bd5a2eed86c9} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bd5258af-20ae-4bd3-b748-b2851aca7335} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c1a6d8b8-93c3-4186-9dd1-13983f9f1d9b} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c4543e64-1498-410d-8e72-4744eea99ab9} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e420a65f-9984-4b8c-9fa9-1ed69d3b0a13} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ea58c2ea-be26-49dd-9b9a-c8e4e5ca7791} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fca28ac5-c1e1-4d67-a5ae-c44d6c374d9f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{4a40e8fc-c7e4-4f57-9fa4-85dd77402897} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{79f562e5-768c-4494-8e6c-824ada4a9c2c} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e0004ec-5df0-48c7-a8f0-fbb0488a3d94} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{914a8f99-38e4-47ec-b875-2b0653516030} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e313f5dc-cfe7-4568-84a4-c76653547571} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{85e0b171-04fa-11d1-b7da-00a0c90348a7} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5b2e150d-4c8a-40e4-8c36-dd9c02771c67} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{627d894a-8a77-416e-b522-432eaf2c818e} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7138f250-5b72-48dd-adfb-9a83b429dd9e} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8971cb48-9fca-445a-be77-e8e8a4cc9df7} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b0cb585f-3271-4e42-88d9-ae5c9330d554} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b88e4484-3ff6-4ea9-815b-a54fe20d4387} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bf1bf02c-5a86-4ecf-adac-472c54c4d21e} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bfc08cff-c737-4433-bd5a-0ee7efcfee54} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d2221ccb-f2bb-4858-aad4-57c754153603} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ea0b6a1a-6a59-4a58-9c41-9966504898a5} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3160f356-e8c3-4de2-a698-92eeeb3d3400} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{995e885e-3ff5-4f66-a107-8bfb3a0f8f12} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{fbb40fdf-b715-4342-ab82-244ecc66e979} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{08755390-f46d-4d09-968c-3430166b3189} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{087c4054-0a2b-4f35-b0db-bed3e21650f4} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{0923208c-e259-4ed5-a778-cb607da350ad} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{229d2451-a617-4b30-b5e8-8138694240cb} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{9720de03-5820-4059-b4a4-639d5e52bd09} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c23fa5a4-1fea-419f-8b14-f7465df062bc} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{ccc6e232-aa4c-4813-a019-9c14b27776b6} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features\9ee2330ae5f4470cac801baac83818c9 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{79f562e5-768c-4494-8e6c-824ada4a9c2c} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fc3c36d-7635-4d43-ba62-0d9d2f2cd06e} (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4ad44d3e-7316-4251-b754-9b10ec96af92} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{79f562e5-768c-4494-8e6c-824ada4a9c2c} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6fc3c36d-7635-4d43-ba62-0d9d2f2cd06e} (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4ad44d3e-7316-4251-b754-9b10ec96af92} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{914a8f99-38e4-47ec-b875-2b0653516030} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{914a8f99-38e4-47ec-b875-2b0653516030} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e313f5dc-cfe7-4568-84a4-c76653547571} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dcads (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dcadssocial (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\superiorads (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmo.desktopflash (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmo.desktopflash.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.clientdetector (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.clientdetector.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.userprofiles (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.userprofiles.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\antivirus2008y (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AdvRemoteDbg (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\UpMedia (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\antivirus2008y (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98393bff-ae22-7d23-ce65-4a06a96b0188} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{98393bff-ae22-7d23-ce65-4a06a96b0188} (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus2008y (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spa_start (Trojan.BHO) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\Antivirus2008y (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\Seekmo (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SeekmoSA (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\db (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\Documents and Settings (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\dwld (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\report (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\res3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\db (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\dwld (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\report (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\res1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0 (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\components (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\plugins (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin\2.0.26 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\patricia\Local Settings\Application Data\vffmn_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Local Settings\Application Data\vffmn_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Local Settings\Application Data\vffmn.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Program Files\GamesBar\oberontb.dll (Adware.Gamesbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\Antivirus2008y\antvrs.exe (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAAbout.mht (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAEULA.mht (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\Config.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\res3\WhiteList.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\Config.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\report\aggr_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\report\send_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\ShoppingReport\cs\res1\WhiteList.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\arrow.ico (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\copyright.txt (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\link.ico (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\chrome.manifest (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\install.rdf (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\components\npclntax.xpt (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo\Reset Cursor.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo\Seekmo Customer Support Center.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo\Seekmo Uninstall Instructions.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\urlredir.cfg (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\Documents and Settings\tony\Application Data\urlredir.cfg (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gemam_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gqekkuq_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gzqlsrp_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gemam_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gqekkuq_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gzqlsrp_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dcads-remove.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\DcadsSocial-Uninstall.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\superiorads-uninst.exe (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WhoisCL.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\wr.txt (Malware.Trace) -> Quarantined and deleted successfully.

49 réponses

Réponse 1 / 49
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
9 déc. 2009 à 21:22
Bonsoir ;)

Tu les collectionnent ?

Treve de plaisanteries ..

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

==>Double-clique sur RSIT.exe afin de lancer RSIT.

==>Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).

==>Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

==>Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront :

log.txt (<<qui sera affiché) ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

==>Rend toi sur ce site: http://www.cijoint.fr/index.php

==>Clique sur "parcourir" et sélectionne ces fichiers ,un lien va etre créer .

==>Copie/colle ce lien dans ta prochaine réponse .

Aide en images si besoin
0
Réponse 2 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
9 déc. 2009 à 21:39
slt,ce n'est pas mon pc,mais celui a des amis qui allaient sur le net sans antivirus activé,docn tou se comprends,mdr
sinon pour rsit j'y pensais justement,mais je le ferais demain apres-midi,là je vais me coucher.je te post le rapport demain,bonne fin de soirée.
0
Réponse 3 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 15:57
salut,me revoilà,je fais de suite la manip citée plus haut.a tout de suite.
0
Réponse 4 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 16:13
voilà les liens pour les 2 rapports.

http://www.cijoint.fr/cjlink.php?file=cj200912/cijMHKqD1P.txt

http://www.cijoint.fr/cjlink.php?file=cj200912/cijOk5Zf6G.txt
je reste sur le pc,des que tu as analysé fais signe stp.
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 49
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
10 déc. 2009 à 17:29
Ok ,tu va faire ceci dans l'ordre :

Particularitées si vous avez Windows Vista :

1) Désactivez l'UAC durant toute l'utilisation de Navilog1
2) Toujours lancer Navilog1 via clic-droit "exécuter en tant qu'administrateur"
******

Télécharge Navilog1 (par IL-MAFIOSO) sur ton bureau

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, double-clique sur le raccourci Navilog1 présent sur le bureau.

Laisse-toi guider. Appuie sur une touche quand on te le demande.
Au menu principal, choisis 1 et valide.

Patiente le temps du scan. Il te sera peut-être demandé de redémarrer ton PC.
Laisse l'outil le faire automatiquement, sinon redémarre ton PC normalement s'il te le demande.

Patiente jusqu'au message "Scan terminé le......"
Appuie sur une touche comme demandé ; le bloc-notes va s'ouvrir.
Copie-colle l'intégralité dans ta réponse. Referme le bloc-notes.

PS : le rapport est, aussi, sauvegardé à la racine du disque dur C:\cleannavi.txt

=====================================

Télécharges ComboFix à partir d'un de ces liens :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Et important, enregistre le sur le bureau.

Avant d'utiliser ComboFix :

? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
la protection en temps réel de ton Antivirus et de tes Antispywares,
qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.


Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
est automatiquement sauvegardé et rangé à C:\Combofix.txt)

? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
avant de te reconnecter à internet.

? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
0
Réponse 6 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 17:52
voici le rapport navilog,par contre je le trouve un peu court,c'est normal?

Fix Navipromo version 4.0.5 commencé le 10/12/2009 17:34:04,48

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 10.11.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2800+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : patricia ( Administrator )
BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.32 (Activated)


C:\ (Local Disk) - NTFS - Total:145 Go (Free:95 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
I:\ (USB)
J:\ (USB)


Recherche executée en mode normal

Nettoyage exécuté au redémarrage de l'ordinateur


C:\WINDOWS\pack.epk supprimé !
C:\WINDOWS\system32\gemam.dat supprimé !
C:\WINDOWS\system32\gqekkuq.dat supprimé !
C:\WINDOWS\system32\gzqlsrp.dat supprimé !


Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\patricia\locals~1\Temp effectué !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil supprimé !
Certificat OOO-Favorit supprimé !



*** Scan terminé 10/12/2009 17:47:12,14 ***
0
Réponse 7 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 18:46
et voici le rapport combofix,là c'est autre chose,lol

ComboFix 09-12-09.04 - patricia 10/12/2009 17:58:12.1.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.255.100 [GMT 1:00]
Lancé depuis: c:\documents and settings\patricia\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-659206414-3928594383-2263321713-1003
C:\Thumbs.db
c:\windows\system32\MabryObj.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-11-10 au 2009-12-10 ))))))))))))))))))))))))))))))))))))
.

2009-12-09 12:36 . 2008-04-13 08:36 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys
2009-12-09 12:36 . 2008-04-13 10:40 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys
2009-12-09 03:24 . 2009-12-09 03:23 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-09 01:51 . 2009-12-09 01:51 -------- d-----w- c:\documents and settings\patricia\Application Data\Malwarebytes
2009-12-09 01:51 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-09 01:51 . 2009-12-09 01:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-09 01:51 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-09 01:51 . 2009-12-09 01:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-08 20:31 . 2009-12-08 20:31 -------- d-----w- c:\program files\CCleaner
2009-12-08 14:41 . 2009-12-10 14:47 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-08 14:41 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-08 14:41 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-08 14:41 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-08 14:40 . 2009-12-08 14:40 -------- d-----w- c:\program files\Avira
2009-12-08 14:40 . 2009-12-08 14:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-12-03 18:17 . 2009-06-30 08:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-10 16:47 . 2009-12-10 16:33 -------- d-----w- c:\program files\Navilog1
2009-12-10 16:14 . 2009-12-10 16:14 -------- d-----w- c:\program files\SuperCopier2
2009-12-10 15:40 . 2004-10-25 16:16 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-12-10 15:23 . 2009-12-10 15:23 -------- d-----w- c:\documents and settings\patricia\Application Data\vlc
2009-12-10 15:06 . 2009-12-10 15:03 -------- d-----w- c:\program files\trend micro
2009-12-10 14:44 . 2009-03-14 18:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-12-09 20:29 . 2002-09-30 11:49 81726 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-09 20:29 . 2002-09-30 11:49 502364 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-09 03:22 . 2007-10-10 11:58 -------- d-----w- c:\program files\Java
2009-12-08 20:08 . 2006-05-05 11:57 -------- d-----w- c:\documents and settings\patricia\Application Data\Shareaza
2009-12-05 08:26 . 2007-10-04 18:30 -------- d-----w- c:\program files\Google
2009-11-22 13:57 . 2009-10-20 18:35 -------- d-----w- c:\documents and settings\patricia\Application Data\Apple Computer
2009-10-20 18:53 . 2004-04-26 18:17 88576 -c--a-w- c:\documents and settings\patricia\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-20 18:33 . 2009-10-20 18:32 -------- d-----w- c:\program files\iTunes
2009-10-20 18:33 . 2009-10-20 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-20 18:32 . 2009-10-20 18:32 -------- d-----w- c:\program files\iPod
2009-10-20 18:32 . 2009-10-20 18:26 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-10-20 18:32 . 2009-10-20 18:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-20 18:31 . 2009-10-20 18:31 -------- d-----w- c:\program files\Bonjour
2009-10-20 18:30 . 2009-10-20 18:29 -------- d-----w- c:\program files\QuickTime
2009-10-20 18:27 . 2009-10-20 18:27 -------- d-----w- c:\program files\Apple Software Update
2009-10-20 18:26 . 2009-10-20 18:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-14 39408]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2009-08-16 955392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe -osboot" [X]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe -autorun" [X]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 110592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-09 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Activer le Poste de Travail Sans Fil Labtec.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Activer le Poste de Travail Sans Fil Labtec.lnk
backup=c:\windows\pss\Activer le Poste de Travail Sans Fil Labtec.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check 2.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check 2.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check 2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Printkey2000.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Printkey2000.lnk
backup=c:\windows\pss\Printkey2000.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
c:\windows\VM_STI.EXE VIMICRO USB PC Camera 301x [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eyurarydv]
c:\windows\system32\eyurarydv.exe eyurarydv [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoTrace]
c:\program files\No Trace\NoTrace.exe -mini [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\QTTask.exe -atboottime [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
c:\program files\Shareaza\Shareaza.exe -tray [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spa_start]
c:\windows\system32\sprt_ads.dll DllStart [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
c:\program files\Fichiers communs\Real\Update_OB\realsched.exe -osboot [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2001-09-04 14:24 28672 ----a-w- c:\windows\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-10-28 20:10 335872 ----a-w- c:\ati technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
2003-01-27 16:16 376912 ----a-w- c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 18:34 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo RX600]
2003-09-11 03:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I0M2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 14:36 305440 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 18:34 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]
2003-09-11 03:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I0M2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2003-08-14 22:34 57344 -c--a-w- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 02:00 132496 -c--a-w- c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
2006-08-22 20:24 111840 -c--a-w- c:\progra~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 00:01 110592 -c--a-w- c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\[Emoticons-plus.com] Winkaa 2.0.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [03/12/2009 19:17 28552]
R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [17/03/2004 19:35 11264]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [23/04/2004 17:10 12964]
R1 vcsmpdrv;vcsmpdrv;c:\windows\system32\drivers\vcsmpdrv.sys [17/03/2004 19:39 49024]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [08/12/2009 15:41 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [17/12/2008 16:16 54752]
R3 EPPSCSIx;Agfa EPPSCSI Driver;c:\windows\system32\drivers\EPPSCAN.sys [29/10/2004 12:04 95336]
S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys --> c:\program files\Softwin\BitDefender9\filespy.sys [?]
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\patricia\Application Data\Mozilla\Firefox\Profiles\tkt43fh2.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-StandardInstall - (no file)
HKLM-Run-Firevall Administrating - rndll.exe
HKU-Default-Run-Symantec NetDriver Warning - c:\progra~1\SYMNET~1\SNDWarn.exe
MSConfigStartUp-BDSwitchAgent - c:\progra~1\softwin\bitdef~1\bdswitch.exe
MSConfigStartUp-ccApp - c:\program files\Fichiers communs\Symantec Shared\ccApp.exe
MSConfigStartUp-Kernel - c:\windows\services.exe
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
MSConfigStartUp-Netcom - c:\program files\Netcom\Netcom.exe
MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
MSConfigStartUp-SeekmoOE - c:\program files\Seekmo\bin\10.0.406.0\OEAddOn.exe
MSConfigStartUp-SeekmoSA - c:\program files\Seekmo\bin\10.0.406.0\SeekmoSA.exe
AddRemove-1500logi - c:\1500logi\1500logi\ACCSIM~1.EXE
AddRemove-ActiveScan 2.0 - c:\program files\Panda Security\ActiveScan 2.0\as2uninst.exe
AddRemove-LiveUpdate - c:\program files\Symantec\LiveUpdate\LSETUP.EXE
AddRemove-Smart Audio Converter_is1 - c:\documents and settings\patricia\Mes documents\My Music\SmartAudioConverter\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-10 18:16
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-12-10 18:29:59
ComboFix-quarantined-files.txt 2009-12-10 17:29

Avant-CF: 104 862 711 808 octets libres
Après-CF: 104 995 950 592 octets libres

- - End Of File - - 5454F2954258018A0FBF0FD68788F5D5
0
Réponse 8 / 49
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
10 déc. 2009 à 19:13
Il va falloir analyser un ou des fichier(s) suspect(s) !

Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.

Pour afficher les dossiers et fichiers cachés:

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence.

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ces fichiers : c:\windows\system32\drivers\pavboot.sys
c:\windows\system32\drivers\sffp_mmc.sy­s

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.
0
Réponse 9 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 19:51
alors pour le premier fichier

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.10 -
AhnLab-V3 5.0.0.2 2009.12.10 -
AntiVir 7.9.1.108 2009.12.10 -
Antiy-AVL 2.0.3.7 2009.12.10 -
Authentium 5.2.0.5 2009.12.02 -
Avast 4.8.1351.0 2009.12.10 -
AVG 8.5.0.426 2009.12.10 -
BitDefender 7.2 2009.12.10 -
CAT-QuickHeal 10.00 2009.12.10 -
ClamAV 0.94.1 2009.12.10 -
Comodo 3103 2009.12.01 -
DrWeb 5.0.0.12182 2009.12.10 -
eSafe 7.0.17.0 2009.12.10 -
eTrust-Vet 35.1.7168 2009.12.10 -
F-Prot 4.5.1.85 2009.12.10 -
F-Secure 9.0.15370.0 2009.12.10 -
Fortinet 4.0.14.0 2009.12.10 -
GData 19 2009.12.10 -
Ikarus T3.1.1.74.0 2009.12.10 -
Jiangmin 13.0.900 2009.12.10 -
K7AntiVirus 7.10.917 2009.12.10 -
Kaspersky 7.0.0.125 2009.12.10 -
McAfee 5828 2009.12.10 -
McAfee+Artemis 5828 2009.12.10 -
McAfee-GW-Edition 6.8.5 2009.12.10 -
Microsoft 1.5302 2009.12.10 -
NOD32 4677 2009.12.10 -
Norman 6.04.03 2009.12.10 -
nProtect 2009.1.8.0 2009.12.10 -
Panda 10.0.2.2 2009.12.10 -
PCTools 7.0.3.5 2009.12.10 -
Prevx 3.0 2009.12.10 -
Rising 22.25.03.09 2009.12.10 -
Sophos 4.48.0 2009.12.10 -
Sunbelt 3.2.1858.2 2009.12.10 -
Symantec 1.4.4.12 2009.12.10 -
TheHacker 6.5.0.2.089 2009.12.10 -
TrendMicro 9.100.0.1001 2009.12.10 -
VBA32 3.12.12.0 2009.12.10 -
ViRobot 2009.12.10.2081 2009.12.10 -
VirusBuster 5.0.21.0 2009.12.09 -
Information additionnelle
File size: 28552 bytes
MD5...: 3adb8bd6154a3ef87496e8fce9c22493
SHA1..: 90212e5b5c714e7a0f27614c516b0e0316d7730e
SHA256: f87dc89a1d8613a92fa1b1454f4cacaf6730252c2ccacc424de87998b24d19c2
ssdeep: 768:UYMyRLCfOeTEMNgKlhFcRbpZoW7L+bVm:UYnLCWBRbv7is
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4605
timedatestamp.....: 0x4a48aa64 (Mon Jun 29 11:49:56 2009)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x3d30 0x3d80 6.28 fc0244152da77bc3b9dfbff4e82524ce
.rdata 0x4200 0x224 0x280 3.63 776e04898c922c80549514e1be08db79
.data 0x4480 0x180 0x180 0.21 b26d6caa04f4b123fdc98b003a534973
INIT 0x4600 0x7bc 0x800 5.31 11defc6a960c00fcb75056c61e2711c9
.rsrc 0x4e00 0x300 0x300 3.24 c48713d5d89b7922c239ff2761129f2b
.reloc 0x5100 0x432 0x480 5.73 f4344bcdcbf0fdee142946b371a56d56

( 2 imports )
> ntoskrnl.exe: InitSafeBootMode, strncmp, PsGetVersion, ExAllocatePoolWithTag, IoGetCurrentProcess, memcpy, memset, ExFreePoolWithTag, IoDeleteDevice, ZwClose, ZwQueryValueKey, ZwOpenKey, RtlAppendUnicodeToString, RtlCopyUnicodeString, ZwSetValueKey, ZwCreateKey, RtlAppendUnicodeStringToString, RtlCompareUnicodeString, ObQueryNameString, ZwQuerySymbolicLinkObject, RtlFreeUnicodeString, ZwOpenSymbolicLinkObject, RtlAnsiStringToUnicodeString, RtlInitAnsiString, MmIsAddressValid, _stricmp, strncpy, PsSetCreateProcessNotifyRoutine, IofCallDriver, IofCompleteRequest, PsGetCurrentThreadId, ExQueueWorkItem, IoAttachDeviceToDeviceStack, RtlInitUnicodeString, ObfReferenceObject, ObfDereferenceObject, IoDetachDevice, RtlFreeAnsiString, RtlCompareString, sprintf, RtlUnicodeStringToAnsiString, IoGetDeviceObjectPointer, IoRegisterFsRegistrationChange, NtOpenProcessToken, RtlCopySid, RtlLengthSid, NtQueryInformationToken, NtQuerySecurityObject, NtSetSecurityObject, RtlSetOwnerSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlAddAccessAllowedAce, RtlCreateAcl, RtlCreateSecurityDescriptor, ZwDeleteKey, ZwReadFile, ZwWriteFile, ZwQueryInformationFile, wcsncpy, ZwSetInformationFile, ZwCreateFile, ZwDeleteFile, NtQueryDirectoryFile, _wcsicmp, KeTickCount, KeBugCheckEx, IoCreateDevice, IoCreateSymbolicLink, KeDelayExecutionThread, IoDeleteSymbolicLink, RtlUnwind
> HAL.dll: KfAcquireSpinLock, KfReleaseSpinLock, KeGetCurrentIrql

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (51.1%)
Win16/32 Executable Delphi generic (12.4%)
Clipper DOS Executable (12.1%)
Generic Win/DOS Executable (12.0%)
DOS Executable Generic (12.0%)
sigcheck:
publisher....: Panda Security, S.L.
copyright....: (c) Panda Security 2008
product......: n/a
description..: Panda Boot Driver
original name: pavboot.sys
internal name: pavboot
file version.: 1.0.11.0
comments.....: n/a
signers......: Panda Security S.L
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 9:37 AM 6/30/2009
verified.....: -
0
Réponse 10 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 19:53
et voici pour le deuxieme

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.10 -
AhnLab-V3 5.0.0.2 2009.12.10 -
AntiVir 7.9.1.108 2009.12.10 -
Antiy-AVL 2.0.3.7 2009.12.10 -
Authentium 5.2.0.5 2009.12.02 -
Avast 4.8.1351.0 2009.12.10 -
AVG 8.5.0.426 2009.12.10 -
BitDefender 7.2 2009.12.10 -
CAT-QuickHeal 10.00 2009.12.10 -
ClamAV 0.94.1 2009.12.10 -
Comodo 3103 2009.12.01 -
DrWeb 5.0.0.12182 2009.12.10 -
eSafe 7.0.17.0 2009.12.10 -
eTrust-Vet 35.1.7168 2009.12.10 -
F-Prot 4.5.1.85 2009.12.10 -
F-Secure 9.0.15370.0 2009.12.10 -
Fortinet 4.0.14.0 2009.12.10 -
GData 19 2009.12.10 -
Ikarus T3.1.1.74.0 2009.12.10 -
Jiangmin 13.0.900 2009.12.10 -
K7AntiVirus 7.10.917 2009.12.10 -
Kaspersky 7.0.0.125 2009.12.10 -
McAfee 5828 2009.12.10 -
McAfee+Artemis 5828 2009.12.10 -
McAfee-GW-Edition 6.8.5 2009.12.10 -
Microsoft 1.5302 2009.12.10 -
NOD32 4677 2009.12.10 -
Norman 6.04.03 2009.12.10 -
nProtect 2009.1.8.0 2009.12.10 -
Panda 10.0.2.2 2009.12.10 -
PCTools 7.0.3.5 2009.12.10 -
Prevx 3.0 2009.12.10 -
Rising 22.25.03.09 2009.12.10 -
Sophos 4.48.0 2009.12.10 -
Sunbelt 3.2.1858.2 2009.12.10 -
Symantec 1.4.4.12 2009.12.10 -
TheHacker 6.5.0.2.089 2009.12.10 -
TrendMicro 9.100.0.1001 2009.12.10 -
VBA32 3.12.12.0 2009.12.10 -
ViRobot 2009.12.10.2081 2009.12.10 -
VirusBuster 5.0.21.0 2009.12.09 -
Information additionnelle
File size: 10240 bytes
MD5...: d66d22d76878bf3483a6be30183fb648
SHA1..: 5499f41540a14a711f2cc276d9c07ab50b030ae7
SHA256: bbec0bf430f13a8387b8a49de5da5bef9493f5d674d7fa1c9155e0919bde6a55
ssdeep: 192:HaYAnLgrD7DUI0sM2SheAidtrS/HW2ZLWv:6Y2grPQISuAidtkW2ZLWv
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1e16
timedatestamp.....: 0x480253af (Sun Apr 13 18:40:47 2008)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x82c 0x880 6.15 a65ecbabb7630ef151bd1d1828ab3a7f
.rdata 0xb80 0x294 0x300 2.75 90c737f0ac6164c5259c4358e1ab8bde
.data 0xe80 0x20c 0x280 0.10 bdc1304b6667dba03c2aaa10058a0d14
PAGE 0x1100 0xaac 0xb00 6.27 8c1b2591235a2fe5ce003b56245e643c
INIT 0x1c00 0x56a 0x580 5.92 a6391dae0c13f95eec5f082dec03246b
.rsrc 0x2180 0x410 0x480 3.16 f4060de35cd9ebae4f36705884276ba9
.reloc 0x2600 0x192 0x200 4.61 79efb19d8e55fed9f885858ca6d41101

( 1 imports )
> ntoskrnl.exe: ExFreePoolWithTag, ExAllocatePoolWithTag, _except_handler3, IofCompleteRequest, IofCallDriver, KeWaitForSingleObject, KeInitializeEvent, _allmul, _allshl, KeSetEvent, IoFreeIrp, IoDeleteDevice, IoAllocateMdl, IoAttachDeviceToDeviceStack, IoCreateDevice, PoStartNextPowerIrp, IoAllocateIrp, RtlCompareMemory, PoCallDriver, ZwQueryValueKey, RtlInitUnicodeString, ZwClose, ZwOpenKey, KeTickCount, KeBugCheckEx, MmBuildMdlForNonPagedPool, IoDetachDevice, IoFreeMdl, ObfDereferenceObject, IoBuildSynchronousFsdRequest, IoGetAttachedDeviceReference

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
packers (Kaspersky): PE_Patch
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Small Form Factor MMC Protocol Driver
original name: sffp_mmc.sys
internal name: sffp_mmc.sys
file version.: 6.0.4069.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
0
Réponse 11 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 20:22
tu es là jfk??
0
Réponse 12 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 20:46
ouhhh ouhhh,la suite c'est quoi?
0
Réponse 13 / 49
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
10 déc. 2009 à 21:06 
Ouhhh ouhhh,la suite c'est quoi?


Tu n'as pas lu ma signature ??

> Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)
- Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie/colle dedans les lignes suivantes :




File::
c:\windows\services.exe



- Enregistre ce fichier sous le nom CFScript
- Fait un glisser/déposer de ce fichier CFScrïpt sur le fichier ComboFix.exe comme sur cette image. (Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris.) Combofix va démarrer.
- Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
- Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
- Ne touche à rien tant que le scan n'est pas terminé sinon le PC peut planter !
- Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Note : Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

================================================

Télécharge Superantispyware (SAS) en cliquant sur ce lien :

https://www.superantispyware.com/superantispywarefreevspro.html

Choisis "enregistrer" et enregistre-le sur ton bureau.

Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.

Créé une icône sur le bureau.

Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.

- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
- Sous Configuration and Preferences, clique sur le bouton "Preferences"
- Clique sur l'onglet "Scanning Control "
- Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :

Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
- Laisse les autres lignes décochées.

- Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.

- Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".

Dans la colonne de gauche, coche C:\Fixed Drive.

Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"

Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.

A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.

Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".

Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.

Pour recopier les informations sur le forum, fais ceci :

- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.

- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.

- Copie son contenu dans ta réponse.

As tu Malware's Byte's anti-malware sur ton pc ?
0
Réponse 14 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
10 déc. 2009 à 21:53
voici le rapport combofix

ComboFix 09-12-09.04 - patricia 10/12/2009 21:19:41.2.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.255.100 [GMT 1:00]
Lancé depuis: c:\documents and settings\patricia\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\patricia\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\services.exe"
.

((((((((((((((((((((((((((((( Fichiers créés du 2009-11-10 au 2009-12-10 ))))))))))))))))))))))))))))))))))))
.

2009-12-10 18:16 . 2009-11-21 15:58 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2009-12-10 16:33 . 2009-12-10 16:47 -------- d-----w- c:\program files\Navilog1
2009-12-10 16:14 . 2009-12-10 16:14 -------- d-----w- c:\program files\SuperCopier2
2009-12-10 15:23 . 2009-12-10 15:23 -------- d-----w- c:\documents and settings\patricia\Application Data\vlc
2009-12-10 15:03 . 2009-12-10 15:06 -------- d-----w- c:\program files\trend micro
2009-12-10 15:02 . 2009-12-10 15:06 -------- d-----w- C:\rsit
2009-12-09 12:36 . 2008-04-13 08:36 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys
2009-12-09 12:36 . 2008-04-13 10:40 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys
2009-12-09 03:24 . 2009-12-09 03:23 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-09 01:51 . 2009-12-09 01:51 -------- d-----w- c:\documents and settings\patricia\Application Data\Malwarebytes
2009-12-09 01:51 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-09 01:51 . 2009-12-09 01:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-09 01:51 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-09 01:51 . 2009-12-09 01:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-08 20:31 . 2009-12-08 20:31 -------- d-----w- c:\program files\CCleaner
2009-12-08 14:41 . 2009-12-10 14:47 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-08 14:41 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-08 14:41 . 2009-02-13 10:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-08 14:41 . 2009-02-13 10:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-08 14:40 . 2009-12-08 14:40 -------- d-----w- c:\program files\Avira
2009-12-08 14:40 . 2009-12-08 14:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-12-03 18:17 . 2009-06-30 08:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-10 15:40 . 2004-10-25 16:16 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-12-10 14:44 . 2009-03-14 18:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-12-09 20:29 . 2002-09-30 11:49 81726 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-09 20:29 . 2002-09-30 11:49 502364 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-09 12:51 . 2002-09-30 12:03 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-12-09 03:22 . 2007-10-10 11:58 -------- d-----w- c:\program files\Java
2009-12-08 20:08 . 2006-05-05 11:57 -------- d-----w- c:\documents and settings\patricia\Application Data\Shareaza
2009-12-05 08:26 . 2007-10-04 18:30 -------- d-----w- c:\program files\Google
2009-11-22 13:57 . 2009-10-20 18:35 -------- d-----w- c:\documents and settings\patricia\Application Data\Apple Computer
2009-11-21 15:58 . 2002-09-30 11:48 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-10-29 07:42 . 2004-08-23 18:35 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:39 . 2004-08-19 23:09 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-19 23:09 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 18:53 . 2004-04-26 18:17 88576 -c--a-w- c:\documents and settings\patricia\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-20 18:33 . 2009-10-20 18:32 -------- d-----w- c:\program files\iTunes
2009-10-20 18:33 . 2009-10-20 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-20 18:32 . 2009-10-20 18:32 -------- d-----w- c:\program files\iPod
2009-10-20 18:32 . 2009-10-20 18:26 -------- d-----w- c:\program files\Fichiers communs\Apple
2009-10-20 18:32 . 2009-10-20 18:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-20 18:31 . 2009-10-20 18:31 -------- d-----w- c:\program files\Bonjour
2009-10-20 18:30 . 2009-10-20 18:29 -------- d-----w- c:\program files\QuickTime
2009-10-20 18:27 . 2009-10-20 18:27 -------- d-----w- c:\program files\Apple Software Update
2009-10-20 18:26 . 2009-10-20 18:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-10-20 16:20 . 2004-08-04 06:00 265728 ------w- c:\windows\system32\drivers\http.sys
2009-10-13 10:33 . 2002-09-30 11:49 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:39 . 2002-09-30 11:49 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:39 . 2002-09-30 11:49 150528 ----a-w- c:\windows\system32\rastls.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-14 39408]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2009-08-16 955392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe -osboot" [X]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe -autorun" [X]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 110592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-09 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Activer le Poste de Travail Sans Fil Labtec.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Activer le Poste de Travail Sans Fil Labtec.lnk
backup=c:\windows\pss\Activer le Poste de Travail Sans Fil Labtec.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check 2.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check 2.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check 2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Printkey2000.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Printkey2000.lnk
backup=c:\windows\pss\Printkey2000.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
c:\windows\VM_STI.EXE VIMICRO USB PC Camera 301x [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eyurarydv]
c:\windows\system32\eyurarydv.exe eyurarydv [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoTrace]
c:\program files\No Trace\NoTrace.exe -mini [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\QTTask.exe -atboottime [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
c:\program files\Shareaza\Shareaza.exe -tray [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spa_start]
c:\windows\system32\sprt_ads.dll DllStart [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
c:\program files\Fichiers communs\Real\Update_OB\realsched.exe -osboot [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2001-09-04 14:24 28672 ----a-w- c:\windows\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-10-28 20:10 335872 ----a-w- c:\ati technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
2003-01-27 16:16 376912 ----a-w- c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 18:34 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo RX600]
2003-09-11 03:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I0M2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 14:36 305440 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 18:34 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]
2003-09-11 03:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I0M2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2003-08-14 22:34 57344 -c--a-w- c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 02:00 132496 -c--a-w- c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
2006-08-22 20:24 111840 -c--a-w- c:\progra~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 00:01 110592 -c--a-w- c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\[Emoticons-plus.com] Winkaa 2.0.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [03/12/2009 19:17 28552]
R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [17/03/2004 19:35 11264]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [23/04/2004 17:10 12964]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [17/12/2008 16:16 54752]
R3 EPPSCSIx;Agfa EPPSCSI Driver;c:\windows\system32\drivers\EPPSCAN.sys [29/10/2004 12:04 95336]
S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys --> c:\program files\Softwin\BitDefender9\filespy.sys [?]
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\patricia\Application Data\Mozilla\Firefox\Profiles\tkt43fh2.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-10 21:36
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(2140)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2009-12-10 21:49:12
ComboFix-quarantined-files.txt 2009-12-10 20:49
ComboFix2.txt 2009-12-10 17:30

Avant-CF: 104 648 200 192 octets libres
Après-CF: 104 604 651 520 octets libres

- - End Of File - - 92494F2C169D6F37831FB295C2C45665
0
Réponse 15 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
11 déc. 2009 à 03:59
et voici pour super antispyware

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 12/11/2009 at 03:38 AM

Application Version : 4.31.1000

Core Rules Database Version : 4356
Trace Rules Database Version: 2202

Scan type : Complete Scan
Total Scan Time : 05:30:40

Memory items scanned : 459
Memory threats detected : 0
Registry items scanned : 6933
Registry threats detected : 8
File items scanned : 66369
File threats detected : 91

Adware.Tracking Cookie
C:\Documents and Settings\patricia\Cookies\patricia@atdmt[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@serving-sys[3].txt
C:\Documents and Settings\patricia\Cookies\patricia@specificclick[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@mediaplex[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@bs.serving-sys[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@msnportal.112.2o7[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@doubleclick[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@tradedoubler[3].txt
C:\Documents and Settings\patricia\Cookies\patricia@adviva[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@atdmt[2].txt
C:\Documents and Settings\Invité\Cookies\invité@247realmedia[1].txt
C:\Documents and Settings\Invité\Cookies\invité@2o7[2].txt
C:\Documents and Settings\Invité\Cookies\invité@ad.yieldmanager[2].txt
C:\Documents and Settings\Invité\Cookies\invité@ad.zanox[1].txt
C:\Documents and Settings\Invité\Cookies\invité@adrevolver[2].txt
C:\Documents and Settings\Invité\Cookies\invité@adtech[2].txt
C:\Documents and Settings\Invité\Cookies\invité@advertising[2].txt
C:\Documents and Settings\Invité\Cookies\invité@atdmt[1].txt
C:\Documents and Settings\Invité\Cookies\invité@bluestreak[2].txt
C:\Documents and Settings\Invité\Cookies\invité@boursoramabanque.solution.weborama[2].txt
C:\Documents and Settings\Invité\Cookies\invité@bs.serving-sys[2].txt
C:\Documents and Settings\Invité\Cookies\invité@cetelem.solution.weborama[2].txt
C:\Documents and Settings\Invité\Cookies\invité@cnam.solution.weborama[2].txt
C:\Documents and Settings\Invité\Cookies\invité@consolidationwindowsfrie8.solution.weborama[2].txt
C:\Documents and Settings\Invité\Cookies\invité@doubleclick[1].txt
C:\Documents and Settings\Invité\Cookies\invité@exoclick[2].txt
C:\Documents and Settings\Invité\Cookies\invité@fleshfinder[2].txt
C:\Documents and Settings\Invité\Cookies\invité@himedia.individuad[2].txt
C:\Documents and Settings\Invité\Cookies\invité@ie8audience.solution.weborama[1].txt
C:\Documents and Settings\Invité\Cookies\invité@media.adrevolver[1].txt
C:\Documents and Settings\Invité\Cookies\invité@mediaplex[1].txt
C:\Documents and Settings\Invité\Cookies\invité@microsoftinternetexplorer.112.2o7[1].txt
C:\Documents and Settings\Invité\Cookies\invité@msnportal.112.2o7[1].txt
C:\Documents and Settings\Invité\Cookies\invité@mypornmotion[1].txt
C:\Documents and Settings\Invité\Cookies\invité@serving-sys[2].txt
C:\Documents and Settings\Invité\Cookies\invité@smartadserver[1].txt
C:\Documents and Settings\Invité\Cookies\invité@statse.webtrendslive[1].txt
C:\Documents and Settings\Invité\Cookies\invité@tradedoubler[1].txt
C:\Documents and Settings\Invité\Cookies\invité@virginmobile.solution.weborama[2].txt
C:\Documents and Settings\Invité\Cookies\invité@weborama[1].txt
C:\Documents and Settings\Invité\Cookies\invité@www.pornattitude[2].txt
C:\Documents and Settings\Invité\Cookies\invité@xiti[1].txt
C:\Documents and Settings\Invité\Cookies\invité@zanox[1].txt
C:\Documents and Settings\Invité\Cookies\invité@zedo[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@atwola[2].txt
C:\Documents and Settings\patricia\Cookies\patricia@atwola[3].txt
C:\Documents and Settings\patricia\Cookies\patricia@bluestreak[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@bluestreak[2].txt
C:\Documents and Settings\patricia\Cookies\patricia@bs.serving-sys[2].txt
C:\Documents and Settings\patricia\Cookies\patricia@eas4.emediate[2].txt
C:\Documents and Settings\patricia\Cookies\patricia@kelpromo.solution.weborama[2].txt
C:\Documents and Settings\patricia\Cookies\patricia@questionmarket[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@serving-sys[2].txt
C:\Documents and Settings\patricia\Cookies\patricia@smartadserver[2].txt
C:\Documents and Settings\patricia\Cookies\patricia@smartadserver[3].txt
C:\Documents and Settings\patricia\Cookies\patricia@statse.webtrendslive[2].txt
C:\Documents and Settings\patricia\Cookies\patricia@tacoda[1].txt
C:\Documents and Settings\patricia\Cookies\patricia@tacoda[3].txt
C:\Documents and Settings\patricia\Cookies\patricia@tradedoubler[2].txt
C:\Documents and Settings\tony\Cookies\tony@247realmedia[2].txt
C:\Documents and Settings\tony\Cookies\tony@2o7[2].txt
C:\Documents and Settings\tony\Cookies\tony@ad.yieldmanager[1].txt
C:\Documents and Settings\tony\Cookies\tony@ad.zanox[1].txt
C:\Documents and Settings\tony\Cookies\tony@adrevolver[2].txt
C:\Documents and Settings\tony\Cookies\tony@adserver.aol[2].txt
C:\Documents and Settings\tony\Cookies\tony@adtech[2].txt
C:\Documents and Settings\tony\Cookies\tony@advertising[2].txt
C:\Documents and Settings\tony\Cookies\tony@advertstream[2].txt
C:\Documents and Settings\tony\Cookies\tony@atdmt[1].txt
C:\Documents and Settings\tony\Cookies\tony@bluestreak[1].txt
C:\Documents and Settings\tony\Cookies\tony@cdiscount[2].txt
C:\Documents and Settings\tony\Cookies\tony@consolidationwindowsfrie8.solution.weborama[2].txt
C:\Documents and Settings\tony\Cookies\tony@doubleclick[1].txt
C:\Documents and Settings\tony\Cookies\tony@fastclick[1].txt
C:\Documents and Settings\tony\Cookies\tony@fl01.ct2.comclick[2].txt
C:\Documents and Settings\tony\Cookies\tony@fr.at.atwola[1].txt
C:\Documents and Settings\tony\Cookies\tony@ie8audience.solution.weborama[1].txt
C:\Documents and Settings\tony\Cookies\tony@media.adrevolver[1].txt
C:\Documents and Settings\tony\Cookies\tony@microsoftinternetexplorer.112.2o7[1].txt
C:\Documents and Settings\tony\Cookies\tony@msnportal.112.2o7[1].txt
C:\Documents and Settings\tony\Cookies\tony@smartadserver[2].txt
C:\Documents and Settings\tony\Cookies\tony@statcounter[1].txt
C:\Documents and Settings\tony\Cookies\tony@tradedoubler[2].txt
C:\Documents and Settings\tony\Cookies\tony@weba.cdiscount[1].txt
C:\Documents and Settings\tony\Cookies\tony@weborama[2].txt
C:\Documents and Settings\tony\Cookies\tony@windowslivemessenger.solution.weborama[1].txt
C:\Documents and Settings\tony\Cookies\tony@ww57.smartadserver[2].txt
C:\Documents and Settings\tony\Cookies\tony@www.cdiscount[1].txt
C:\Documents and Settings\tony\Cookies\tony@www.smartadserver[2].txt
C:\Documents and Settings\tony\Cookies\tony@www3.smartadserver[1].txt
C:\Documents and Settings\tony\Cookies\tony@xiti[1].txt

Registry Cleaner Trial
HKCR\Install.Install
HKCR\Install.Install\CLSID
HKCR\Install.Install\CurVer
HKCR\Install.Install.1
HKCR\Install.Install.1\CLSID

Adware.180solutions/Seekmo
HKCR\AppId\SeekmoSA_df.exe
HKCR\AppId\SeekmoSA_df.exe#AppID

Adware.UpMedia/SearchTool
HKU\S-1-5-21-925099772-242501028-509977922-1008\Software\UptownInstaller



pour malewarebytes oui je l'ai,d'ailleurs j'en ai passé un scan complet avant et il a trouvé 261 fichiers infectés.
0
Réponse 16 / 49
Utilisateur anonyme
11 déc. 2009 à 08:53
salut jfk ^^

salut mouton , j'ai cru que tu t'y etais encore mis dedans ....!! lol
0
Réponse 17 / 49
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
11 déc. 2009 à 12:26
Salut Gen ;)

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)
0
Réponse 18 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
11 déc. 2009 à 13:03
salut a toi gen-hackman,c'est encore des amis qui sont pas au courant qu'il faut un antivirus avant d'aller sur le net,alors le resultat est là!!! mdr
slt jfk,me revoilà apres une dure journée de boulot,je te post le rapport toolbar-s&d


-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2800+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : patricia ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
C:\ (Local Disk) - NTFS - Total:145 Go (Free:97 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
I:\ (USB)
J:\ (USB)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 11/12/2009|12:57 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\Dcads Games Collection
C:\Program Files\Dcads Games Collection\BattlesOfHelicopters.exe
C:\Program Files\Dcads Games Collection\BobAndBill.exe
C:\Program Files\Dcads Games Collection\CrazyBlocks.exe
C:\Program Files\Dcads Games Collection\Lines.exe
C:\Program Files\Dcads Games Collection\uninstall.exe
C:\Program Files\Dcads Games Collection\VideoPool.exe
C:\DOCUME~1\patricia\MENUDM~1\PROGRA~1\Dcads Games Collection
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-11-19-04-49
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-19-17-46-20
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-22-19-37-57
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-02-13-29-02
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-08-14-18-07
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-20-19-44-53
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-21-19-58-12
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-27-20-56-16
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-05-06-17-02
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-19-15-44-43
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-27-16-10-17
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-30-19-06-19
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-03-20-34-44
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-11-19-49-34
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-20-19-08-26
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-24-20-18-14
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-26-09-26-05
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-28-20-26-17
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-28-20-33-09
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-01-11-01-57
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-05-12-27-19
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-05-20-27-15
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\about.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\action.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\adventures_of_robinson_crusoe16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\alabama_smith16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\arcade.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\blood_ties16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\buy.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\cards.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\deals.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\download.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\dream_chronicles16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\dream_chronicles_216x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\escape_rosecliff_island16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\feedback.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\help.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\herods_lost_tomb16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\highlight.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\jigsaw.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\kids.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\laura_jones16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mahjong.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mygames.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mystery_of_unicorn_castle16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\my_kingdom_for_the_princess16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\newGames.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\oberonconfig.xm_
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\obSearchHistory.dat
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\partner.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\party_down16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_off.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_on.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\pure_hidden16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\puzzle.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\ranch_rush16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\search.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\secrets-of-great-art16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sendafriend.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sports.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sprill16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\trial.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\uninstall.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\update.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\about.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\feedback.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\help.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\highlight.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\partner.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\popup_off.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\popup_on.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\search.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\sendafriend.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\uninstall.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\update.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\about.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\action.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\AliceGreenfingers16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\arcade.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\Azada16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\battleship16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\ChickRush_deluxe16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\Chromadrome_216x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\chroma_crash16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\death_nile16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\download.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\feedback.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\help.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\highlight.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\mahjong_quest_216x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\MCF_raven16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\newGames.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\partner.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\popup_off.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\popup_on.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\search.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\sendafriend.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\snapshot_adventures16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\the_apprentice_LA16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\turbo_pizza16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\uninstall.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\update.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\about.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\Azada16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\battleship16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\ChickRush_deluxe16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\Chromadrome_216x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\chroma_crash16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\death_nile16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\download.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\feedback.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\help.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\highlight.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\mahjong_quest_216x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\newGames.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\partner.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\popup_off.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\popup_on.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\search.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\sendafriend.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\snapshot_adventures16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\the_apprentice_LA16x16.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\uninstall.gif
C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\update.gif
C:\Program Files\GamesBar
C:\Program Files\GamesBar\Localization-French.ini
C:\Program Files\GamesBar\Localization2-French.ini
C:\Program Files\GamesBar\OBGet.exe
C:\Program Files\GamesBar\search.bin
C:\Program Files\GamesBar\uninst.exe
C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1\GamesBar
C:\WINDOWS\iun6002.exe

-----------\\ Extensions

(patricia) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 11/12/2009|12:59 - Option : [1]

-----------\\ Fin du rapport a 12:59:09,15
0
Réponse 19 / 49
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 1 175
11 déc. 2009 à 17:58
Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

Ensuite recolle moi un nouveau log RSIT .
0
Réponse 20 / 49
mouton72 Messages postés 569 Date d'inscription dimanche 28 septembre 2008 Statut Membre Dernière intervention 8 mars 2011 2
11 déc. 2009 à 18:02
ok,de suite chef lol
0

Discussions similaires

Infection d'une URL.blacklist
marina41 -
Malekal_morte- -

6 réponses
Infection ?
Tomy -
MisteryBean -

10 réponses
Infection ou pas ???
karissia -
helpcenter -

1 réponse
infection ou pas?
jpn1000 -
mcvivien2 -

5 réponses
Infection ad.doubleclick.net
93 -
93 -

66 réponses