Pop-up explorer Résolu

Question

Bonjour,
j'ai un petit problème qui dure depuis un bout. Il y a des pop-up d'internet explorer (CID:) qui apparaissent et je ne comprend pas pourquoi ! De plus mon ordi est vraiment lent et je ne suis pas capable de faire un scan complet, mon ordi  géle avant la fin.

Merci d'avance pour votre aide !

Lucioole

dédétraqué · Answer

Salut Lucioole


On va vérifier cela, télécharge RSIT (de random/random) sur le bureau ici :
http://images.malwareremoval.com/random/RSIT.exe

- Double clique sur RSIT.exe qui est sur le bureau
- Clique sur Continue dans la fenêtre
- RSIT téléchargera HijackThis si il n’est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenue des deux rapports, log.txt et info.txt(réduit dans la barre des tâches) à la fin de l’analyse

Les rapports sont dans le dossier ici C:\rsit


@++ :)

Marion · Answer

Bonjour,
Si tu utilise internet explorer il faut que tu désactive tes pop up dans la barre outil de ton internet explorer (débloquer fenetre pop up et parametre) Si le fait via firefox par exemple si c'est celui là que tu utilise  ca ne marchera pas. Tu peux installer la tollbar de google mais cela n'a pas trop marché sur mon ordi. Tu peux surtout mettre firefox (encore une fois si tu l'utilise) par défaut pour aller sur le net. Je crois que c'est depuis que j'ai fait ça que mes (insupportables) fenêtres pop up  ont disparues.

Lucioole · Answer

Voici le rapport info :

info.txt logfile of random's system information tool 1.05 2009-02-12 22:43:40

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat 5.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AutoCAD 2009 - Français-->C:\Program Files\AutoCAD 2009\Setup\Setup.exe /P {5783F2D7-7001-040C-0002-0060B0CE6BBA} /M ACAD
Autodesk Design Review 2009-->C:\Program Files\Autodesk\Autodesk Design Review\Setup\Setup.exe /P {450063AA-643B-417C-8CF5-405BA3F4EF40} /M ADR
Avanquest update-->C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe -runfromtemp -l0x0009 -removeonly
CC_ccProxyExt-->MsiExec.exe /I{DA42FDCA-7C5A-43EF-9A05-CCE148ADF919}
ccCommon-->MsiExec.exe /I{DC367608-64A7-4BF7-92F4-8BAA25BA02DB}
ccPxyCore-->MsiExec.exe /I{FC08587A-4F01-4188-819F-F55880022917}
Combined Community Codec Pack 2008-09-21 16:18-->"C:\Program Files\Combined Community Codec Pack\unins000.exe"
Contextual Tool Snappyads-->C:\WINDOWS\system32\414ee295-9566-1070-5bde-bb57783c87be.exe
Contextual Tool Snappyads-->C:\WINDOWS\system32\undefined-remove.exe
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
IEEE 802.11g Wireless Cardbus/PCI Adapter-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{29F15D3F-5B37-44DB-BB89-390B3AD1404E} 
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LimeWire 4.18.8-->"C:\Program Files\LimeWire\uninstall.exe"
LiveReg (Symantec Corporation)-->C:\Program Files\Fichiers communs\Symantec Shared\LiveReg\VCSetup.exe /REMOVE
LiveUpdate 3.0 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft .NET Framework 3.0-->MsiExec.exe /X{15095BF3-A3D7-4DDF-B193-3A496881E003}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB925720)-->"C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
Motorola Driver Installation 3.5.0-->MsiExec.exe /I{D2BD3C8F-9D7F-472B-BDF9-7309A5CB813A}
Motorola Phone Tools-->C:\Program Files\InstallShield Installation Information\{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}\setup.exe -runfromtemp -l0x0009 -removeonly
Motorola Software Update-->MsiExec.exe /I{922D9CCA-4317-425F-9AA5-94829DF8BA6D}
Mozilla Firefox (3.0.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSRedist-->MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
Norton AntiSpam-->MsiExec.exe /I{3B29A786-5803-4e9e-9B58-3014A5B4E519}
Norton AntiSpam-->MsiExec.exe /I{5677563D-0CB1-485f-9E18-C5025306BB3F}
Norton AntiVirus 2005-->MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B}
Norton Internet Security 2005 (Symantec Corporation)-->C:\Program Files\Fichiers communs\Symantec Shared\SymSetup\{A93C9E60-29B6-49da-BA21-F70AC6AADE20}.exe /X
Norton Internet Security-->MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125}
Norton Internet Security-->MsiExec.exe /I{449F3A9E-9903-4a0d-A209-08030D45A935}
Norton Internet Security-->MsiExec.exe /I{48185814-A224-447a-81DA-71BD20580E1B}
Norton Internet Security-->MsiExec.exe /I{526AD5DC-CFC4-4f2a-8442-C84CC91D6C7F}
Norton Internet Security-->MsiExec.exe /I{A93C9E60-29B6-49da-BA21-F70AC6AADE20}
Norton Internet Security-->MsiExec.exe /I{C9D599E1-6B68-4a1f-8A4F-A1DB433DB1BF}
Norton Internet Security-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Internet Security-->MsiExec.exe /I{FC2C0536-583C-46c0-844A-62CECAE01F22}
Norton WMI Update-->MsiExec.exe /X{E85FA9A1-C241-4698-893B-DD99509B8DB0}
Norton WMI Update-->MsiExec.exe /X{F64306A5-4C32-41bb-B153-53986527FAB4}
OpenOffice.org 3.0-->MsiExec.exe /I{1572F66F-F9AD-4D45-B0D2-0F45A0D5A0F6}
Performance Dashboard Snappyads-->C:\WINDOWS\system32\yfypdoqmdorxivwme.exe
PokerStars-->"C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe" 
SPBBC-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Symantec Script Blocking Installer-->MsiExec.exe /I{D327AFC9-7BAA-473A-8319-6EB7A0D40138}
SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
Vuze-->C:\Program Files\Vuze\uninstall.exe
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Sign-in Assistant-->MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======Security center information======

AV: Norton Internet Security
FW: Norton Internet Security

System event log

Computer Name: SANDRA-73F10F61
Event Code: 1007
Message: Votre ordinateur a automatiquement configuré l'adresse IP pour la
carte avec l'adresse réseau 0040F4F34D71. L'adresse IP utilisée est 169.254.178.87.

Record Number: 2361
Source Name: Dhcp
Time Written: 20090118163008.000000-300
Event Type: warning
User: 

Computer Name: SANDRA-73F10F61
Event Code: 4201
Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{F3FFE787-B336-4F34-9F6E-701AE7E0827F} était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 2360
Source Name: Tcpip
Time Written: 20090118162906.000000-300
Event Type: information
User: 

Computer Name: SANDRA-73F10F61
Event Code: 8033
Message: L'explorateur a forcé une élection sur le réseau \Device\NetBT_Tcpip_{F3FFE787-B336-4F34-9F6E-701AE7E0827F} car un maître explorateur a été arrêté.

Record Number: 2359
Source Name: BROWSER
Time Written: 20090118162857.000000-300
Event Type: information
User: 

Computer Name: SANDRA-73F10F61
Event Code: 1007
Message: Votre ordinateur a automatiquement configuré l'adresse IP pour la
carte avec l'adresse réseau 0040F4F34D71. L'adresse IP utilisée est 169.254.178.87.

Record Number: 2358
Source Name: Dhcp
Time Written: 20090118124424.000000-300
Event Type: warning
User: 

Computer Name: SANDRA-73F10F61
Event Code: 4201
Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{F3FFE787-B336-4F34-9F6E-701AE7E0827F} était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 2357
Source Name: Tcpip
Time Written: 20090118124321.000000-300
Event Type: information
User: 

Application event log

Computer Name: SANDRA-73F10F61
Event Code: 101
Message: Information Level: success

The next run has been scheduled to occur at approximately 11:15 AM.

Record Number: 3382
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20090207074518.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

Computer Name: SANDRA-73F10F61
Event Code: 101
Message: Information Level: success

Automatic LiveUpdate has terminated.

Record Number: 3381
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20090207074518.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

Computer Name: SANDRA-73F10F61
Event Code: 101
Message: Information Level: success

Scheduler launched Automatic LiveUpdate.

Record Number: 3380
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20090207074444.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

Computer Name: SANDRA-73F10F61
Event Code: 101
Message: Information Level: success

Rolling back the schedule; execution will occur at approximately 7:44 AM.

Record Number: 3379
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20090207073944.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

Computer Name: SANDRA-73F10F61
Event Code: 101
Message: Information Level: success

Service started.

Record Number: 3378
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20090207073944.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Lucioole · Answer

Et le rapport log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sandra Laurence at 2010-01-19 21:27:19
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 34 GB (45%) free of 76 GB
Total RAM: 1279 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:27:32, on 2010-01-19
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Sandra Laurence\Bureau\RSIT.exe
C:\Program Files	rend micro\Sandra Laurence.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tattoodle.com?tid={A7108FB8-08B3-4652-BE50-4FB80B0B4BD7}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O2 - BHO: Mirar - {F6D0DE13-23C4-4604-A33C-E722646411E3} - C:\WINDOWS\system32\7478.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Mirar - {F6D0DE12-23C4-4604-A33C-E722646411E3} - C:\WINDOWS\system32\7478.dll
O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [CHIN PING PHONE PILE] C:\Documents and Settings\All Users\Application Data\Proxy Long Chin Ping\owns soft.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [procaudio] C:\DOCUME~1\SANDRA~1\APPLIC~1\SHOWBE~1\CurbSettingsPoll.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

dédétraqué · Answer

Salut Lucioole


Plusieurs infections, on va t'en séparer vite fais.

Important : Désactive toute protection résidente ! (Antivirus, antispywares) : 
https://forum.pcastuces.com/default.asp


Télécharge Lop S&D sur ton bureau ici :

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 


- Double clique sur LopSD.exe qui est sur le bureau pour lancer l'installation

- Double clique sur le raccourci Lop S&D créé sur ton Bureau 

- Sélectionne la langue souhaitée et choisis l'option 1 (Recherche) 

- Poste le rapport (C:\lopR.txt) dans ton prochain poste 

Note : Si le bureau ne réapparaît pas appuis sur Ctrl + Alt + Suppr , le gestionnaire des tâche apparaît. Dans le haut clique sur Fichier/Nouvelle tâche, tape explorer.exe et OK pour valider

Tutoriel : http://www.malekal.com/tutorial_Lop_SD.php


@++   :)

Lucioole · Answer

VOICI LE RESULTAT DE Lop S&D :


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.40GHz )
   BIOS : BIOS Date: 02/17/05 20:34:41 Ver: 08.00.09
   USER : Sandra Laurence ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Not Activated)
   Firewall  : PC Tools Firewall Plus 6.0.0 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:33 Go)
   D:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 2010-01-19|21:48 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [2009-06-13|21:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{49A66877-6FAE-4C05-9EDF-A4F8EAF72A02}
   [2009-09-25|13:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
   [2009-10-24|19:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [2009-10-27|01:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [2009-04-15|17:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [2009-02-10|01:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
   [2009-10-17|20:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [2009-09-25|12:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [2009-01-07|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [2009-01-22|01:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
   [2009-04-01|00:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FarmFrenzy2
   [2009-02-15|11:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [2009-10-30|21:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
   [2010-01-07|23:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Last.fm
   [2009-02-12|23:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [2009-11-14|00:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [2009-10-22|15:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [2009-02-13|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
   [2009-02-13|11:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [2009-10-28|15:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
   [2009-12-28|00:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Proxy Long Chin Ping
   [2010-01-19|21:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [2009-11-04|21:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
   [2009-01-28|01:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

   [2009-01-06|01:49] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [2009-01-06|01:53] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [2009-01-06|01:52] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [2009-02-15|01:48] C:\DOCUME~1\SANDRA~1\APPLIC~1\Adobe
   [2009-10-09|10:41] C:\DOCUME~1\SANDRA~1\APPLIC~1\Apple Computer
   [2009-02-10|01:05] C:\DOCUME~1\SANDRA~1\APPLIC~1\Autodesk
   [2009-09-25|12:27] C:\DOCUME~1\SANDRA~1\APPLIC~1\AVS4YOU
   [2010-01-14|21:19] C:\DOCUME~1\SANDRA~1\APPLIC~1\Azureus
   [2009-10-17|10:53] C:\DOCUME~1\SANDRA~1\APPLIC~1\DealAssistant
   [2009-01-06|01:55] C:\DOCUME~1\SANDRA~1\APPLIC~1\Identities
   [2010-01-15|22:41] C:\DOCUME~1\SANDRA~1\APPLIC~1\LimeWire
   [2009-01-06|04:53] C:\DOCUME~1\SANDRA~1\APPLIC~1\Macromedia
   [2009-02-12|23:19] C:\DOCUME~1\SANDRA~1\APPLIC~1\Malwarebytes
   [2009-01-13|10:37] C:\DOCUME~1\SANDRA~1\APPLIC~1\Media Player Classic
   [2009-03-28|00:10] C:\DOCUME~1\SANDRA~1\APPLIC~1\Microsoft
   [2009-01-06|04:56] C:\DOCUME~1\SANDRA~1\APPLIC~1\Mozilla
   [2009-01-29|12:22] C:\DOCUME~1\SANDRA~1\APPLIC~1\OpenOffice.org
   [2009-11-17|17:37] C:\DOCUME~1\SANDRA~1\APPLIC~1\PCToolsFirewallPlus
   [2009-10-28|15:49] C:\DOCUME~1\SANDRA~1\APPLIC~1\PlayFirst
   [2009-04-17|10:14] C:\DOCUME~1\SANDRA~1\APPLIC~1\SanDisk
   [2009-12-28|00:07] C:\DOCUME~1\SANDRA~1\APPLIC~1\SHOWBEEPACID
   [2009-01-22|02:23] C:\DOCUME~1\SANDRA~1\APPLIC~1\Sun
   [2009-04-05|07:31] C:\DOCUME~1\SANDRA~1\APPLIC~1\vghd
   [2009-01-29|12:37] C:\DOCUME~1\SANDRA~1\APPLIC~1\WinRAR
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [2010-01-19 21:00][--ah-----] C:\WINDOWS	asks\8747D1ED98E87FF9.job
   [2010-01-16 07:05][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [2010-01-19 19:57][--ah-----] C:\WINDOWS	asks\SA.DAT
   [2006-03-02 07:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   ( 8747D1ED98E87FF9.job )=( c:\docume~1\sandra~1\applic~1\showbe~1\CAMPDENTBODY.exe )

   --------------------\  Listing des dossiers dans C:\Program Files

   [2009-01-06|02:00] C:\Program Files\802.11 Wireless LAN
   [2009-10-22|16:13] C:\Program Files\Adobe
   [2009-01-06|02:08] C:\Program Files\Analog Devices
   [2009-03-17|15:34] C:\Program Files\Apple Software Update
   [2009-01-06|02:33] C:\Program Files\ATI Technologies
   [2009-02-03|23:42] C:\Program Files\AutoCAD 2009
   [2009-02-03|23:20] C:\Program Files\Autodesk
   [2009-01-22|01:45] C:\Program Files\Avanquest update
   [2009-10-17|20:45] C:\Program Files\Avira
   [2009-10-17|20:51] C:\Program Files\AVS4YOU
   [2009-09-15|19:30] C:\Program Files\Bonjour
   [2009-11-07|12:15] C:\Program Files\Circle Devlopement
   [2009-01-07|22:56] C:\Program Files\Combined Community Codec Pack
   [2009-01-06|01:46] C:\Program Files\ComPlus Applications
   [2009-07-21|11:03] C:\Program Files\DivX
   [2009-04-15|23:08] C:\Program Files\Domain Tools
   [2009-11-17|17:07] C:\Program Files\Fast Browser Search
   [2009-09-25|12:25] C:\Program Files\Fichiers communs
   [2009-12-02|13:26] C:\Program Files\Full Tilt Poker
   [2009-11-11|00:14] C:\Program Files\InstallShield Installation Information
   [2009-01-06|02:07] C:\Program Files\Intel
   [2009-12-10|03:03] C:\Program Files\Internet Explorer
   [2009-09-25|13:49] C:\Program Files\iPod
   [2010-01-07|23:18] C:\Program Files\iTunes
   [2009-10-17|20:50] C:\Program Files\Java
   [2009-10-17|10:53] C:\Program Files\Jookz
   [2010-01-07|23:17] C:\Program Files\Last.fm
   [2010-01-07|22:43] C:\Program Files\LimeWire
   [2009-04-24|23:15] C:\Program Files\Ma Pension d'animaux 2
   [2009-01-06|03:09] C:\Program Files\Marvell
   [2009-02-15|04:12] C:\Program Files\Messenger
   [2009-11-07|12:15] C:\Program Files\Messenger Plus! Live
   [2009-02-07|00:31] C:\Program Files\MessengerDiscovery
   [2009-03-12|21:53] C:\Program Files\Microsoft
   [2009-03-14|02:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [2009-01-06|01:49] C:\Program Files\microsoft frontpage
   [2009-02-03|23:29] C:\Program Files\Microsoft Office
   [2009-09-10|02:09] C:\Program Files\Microsoft Silverlight
   [2009-03-12|21:55] C:\Program Files\Microsoft SQL Server Compact Edition
   [2009-03-12|21:56] C:\Program Files\Microsoft Sync Framework
   [2009-11-04|21:45] C:\Program Files\Monopoly Build-a-lot Edition
   [2009-04-15|23:36] C:\Program Files\Motorola Phone Tools
   [2009-03-12|21:46] C:\Program Files\Movie Maker
   [2010-01-19|21:27] C:\Program Files\Mozilla Firefox
   [2009-02-03|23:25] C:\Program Files\MSBuild
   [2009-01-06|01:45] C:\Program Files\MSN
   [2009-01-06|01:45] C:\Program Files\MSN Gaming Zone
   [2009-01-22|04:11] C:\Program Files\MSXML 4.0
   [2009-02-05|03:00] C:\Program Files\MSXML 6.0
   [2009-02-15|02:56] C:\Program Files\NetMeeting
   [2009-02-13|11:35] C:\Program Files\NOS
   [2009-01-29|12:19] C:\Program Files\OpenOffice.org 3
   [2009-08-13|02:02] C:\Program Files\Outlook Express
   [2010-01-19|21:40] C:\Program Files\PC Tools Firewall Plus
   [2010-01-07|22:34] C:\Program Files\PokerStars
   [2009-09-25|13:48] C:\Program Files\QuickTime
   [2009-02-03|22:23] C:\Program Files\Reference Assemblies
   [2009-01-06|01:47] C:\Program Files\Services en ligne
   [2009-11-17|17:07] C:\Program Files\SGPSA
   [2009-12-28|00:06] C:\Program Files\SHOWBEEPACID
   [2010-01-19|21:27] C:\Program Files	rend micro
   [2009-01-06|01:55] C:\Program Files\Uninstall Information
   [2009-12-18|20:22] C:\Program Files\Vuze
   [2009-10-22|15:50] C:\Program Files\Windows Live
   [2009-03-12|21:53] C:\Program Files\Windows Live SkyDrive
   [2009-01-28|01:26] C:\Program Files\Windows Media Connect 2
   [2009-08-30|14:52] C:\Program Files\Windows Media Player
   [2009-02-15|02:56] C:\Program Files\Windows NT
   [2009-01-06|01:48] C:\Program Files\WindowsUpdate
   [2009-01-29|12:37] C:\Program Files\WinRAR
   [2009-01-06|01:49] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [2009-10-22|16:13] C:\Program Files\Fichiers communs\Adobe
   [2009-09-25|13:49] C:\Program Files\Fichiers communs\Apple
   [2009-02-03|23:43] C:\Program Files\Fichiers communs\Autodesk Shared
   [2009-10-17|20:51] C:\Program Files\Fichiers communs\AVSMedia
   [2009-02-03|23:29] C:\Program Files\Fichiers communs\Designer
   [2009-07-21|11:03] C:\Program Files\Fichiers communs\DivX Shared
   [2009-01-07|14:48] C:\Program Files\Fichiers communs\i4j_jres
   [2009-10-17|20:59] C:\Program Files\Fichiers communs\InstallShield
   [2009-03-12|21:53] C:\Program Files\Fichiers communs\Microsoft Shared
   [2009-01-22|01:34] C:\Program Files\Fichiers communs\Motorola Shared
   [2009-01-06|01:47] C:\Program Files\Fichiers communs\MSSoap
   [2009-01-05|21:34] C:\Program Files\Fichiers communs\ODBC
   [2009-11-17|17:36] C:\Program Files\Fichiers communs\PC Tools
   [2009-01-06|01:47] C:\Program Files\Fichiers communs\Services
   [2009-01-05|21:34] C:\Program Files\Fichiers communs\SpeechEngines
   [2009-02-15|02:56] C:\Program Files\Fichiers communs\System
   [2009-03-12|21:45] C:\Program Files\Fichiers communs\Windows Live

   --------------------\  Process

   ( 51 Processes )

   IEXPLORE.EXE ~ [PID:3912]
   IEXPLORE.EXE ~ [PID:1216]
   IEXPLORE.EXE ~ [PID:3620]
   IEXPLORE.EXE ~ [PID:2740]

   --------------------\  Recherche avec S_Lop

   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp\bis322.exe
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Proxy Long Chin Ping
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Proxy Long Chin Ping\owns soft.dat
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Proxy Long Chin Ping\owns soft.exe
   C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1
   C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\CAMP DENT BODY.exe
   C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\CurbSettingsPoll.exe
   C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\ewnhkydr.exe
   C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\medialinkheartblue.exe
   C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\swksltxy.exe
   C:\Program Files\showbe~1
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sl1A7.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sl358.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sn330.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sn331.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
spA16.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sq356.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sv1C1.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sz35A.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sz35B.tmp
   C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp\sta1E1.exe
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.adserver5[1].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.adserver5[2].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@cotedazurpalace[1].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@cotedazurpalace[2].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@cotedazurpalace[4].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@serve.cotedazurpalace[1].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@serve.cotedazurpalace[2].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.cotedazurpalace[1].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.cotedazurpalace[2].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@partypoker[1].txt
   C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.partypoker[1].txt
   C:\WINDOWS\Tasks\8747D1ED98E87FF9.job
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "procaudio"="C:\DOCUME~1\SANDRA~1\APPLIC~1\SHOWBE~1\CurbSettingsPoll.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "CHIN PING PHONE PILE"="C:\Documents and Settings\All Users\Application Data\Proxy Long Chin Ping\owns soft.exe"

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2010-01-19 21:49:57
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\SANDRA~1\Mes documents\Azureus Downloads\Kate Voegele All Songs@160 kbps VBR MP3Pro\Kate Voegele - Where the Sidewalk Cracks.mp3
   C:\DOCUME~1\SANDRA~1\Mes documents\LimeWire\Saved\Eminem Feat Dr. Dre & 50 Cent - Crack A Bottle.mp3


   [F:2497][D:141]-> C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
   [F:145][D:0]-> C:\DOCUME~1\SANDRA~1\Cookies
   [F:4444][D:19]-> C:\DOCUME~1\SANDRA~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 2010-01-19|21:52 - Option : [1]

   --------------------\  Fin du rapport a 21:52:31

dédétraqué · Answer

Salut Lucioole


- Double clique sur le raccourci Lop S&D créé sur ton Bureau

- Choisis l'Option 2 (Suppression)

- Poste le rapport (C:\lopR.txt) dans ton prochain poste.

Note : Si le bureau ne réapparaît pas appuis sur Ctrl + Alt + Suppr , le gestionnaire des tâche apparaît. Dans le haut clique sur Fichier/Nouvelle tâche, tape explorer.exe et OK pour valider


-----


[*]Télécharge AD-Remover (de Cyrildu17 / C_XX) sur ton Bureau.
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe

Déconnecte-toi et ferme toutes applications en cours

[*]Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program files).
[*]Double-clique sur l'icône AD-Remover située sur ton Bureau
[*]Au menu principal, choisis l'option L.
[*]Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report(date).log)

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus comme une infection, ne pas en tenir compte, il s'agit d'un faux positif, continue la procédure

Aide : https://kerio.probb.fr/t3786-tuto-ad-remover


@++  :)

Lucioole · Answer

Salut Dédétraqué,
voici le rapport de lop option 2 :

   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.40GHz )
   BIOS : BIOS Date: 02/17/05 20:34:41 Ver: 08.00.09
   USER : Sandra Laurence ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Not Activated)
   Firewall  : PC Tools Firewall Plus 6.0.0 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:74 Go (Free:33 Go)
   D:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 2010-01-19|22:22 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Proxy Long Chin Ping\owns soft.dat
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Proxy Long Chin Ping\owns soft.exe
   Supprime! - C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\CAMP DENT BODY.exe
   Supprime! - C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\CurbSettingsPoll.exe
   Supprime! - C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\ewnhkydr.exe
   Supprime! - C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\medialinkheartblue.exe
   Supprime! - C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1\swksltxy.exe
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sl1A7.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sl358.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sn330.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sn331.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
spA16.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sq356.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sv1C1.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sz35A.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
sz35B.tmp
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp\sta1E1.exe
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.adserver5[1].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.adserver5[2].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@cotedazurpalace[1].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@cotedazurpalace[4].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@serve.cotedazurpalace[1].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@serve.cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.cotedazurpalace[1].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.cotedazurpalace[2].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@partypoker[1].txt
   Supprime! - C:\DOCUME~1\SANDRA~1\Cookies\sandra_laurence@www.partypoker[1].txt
   Supprime! - C:\WINDOWS\Tasks\8747D1ED98E87FF9.job 
   Supprime! - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp\bis322.exe
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Proxy Long Chin Ping
   Supprime! - C:\DOCUME~1\SANDRA~1\APPLIC~1\showbe~1
   Supprime! - C:\Program Files\showbe~1
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [2009-06-13|21:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{49A66877-6FAE-4C05-9EDF-A4F8EAF72A02}
   [2009-09-25|13:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
   [2009-10-24|19:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [2009-10-27|01:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [2009-04-15|17:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [2009-02-10|01:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Autodesk
   [2009-10-17|20:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [2009-09-25|12:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [2009-01-07|14:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
   [2009-01-22|01:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
   [2009-04-01|00:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FarmFrenzy2
   [2009-02-15|11:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [2009-10-30|21:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
   [2010-01-07|23:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Last.fm
   [2009-02-12|23:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [2009-11-14|00:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [2009-10-22|15:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [2009-02-13|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
   [2009-02-13|11:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [2009-10-28|15:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
   [2010-01-19|21:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [2009-11-04|21:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
   [2009-01-28|01:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

   [2009-01-06|01:49] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [2009-01-06|01:53] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [2009-01-06|01:52] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [2009-02-15|01:48] C:\DOCUME~1\SANDRA~1\APPLIC~1\Adobe
   [2009-10-09|10:41] C:\DOCUME~1\SANDRA~1\APPLIC~1\Apple Computer
   [2009-02-10|01:05] C:\DOCUME~1\SANDRA~1\APPLIC~1\Autodesk
   [2009-09-25|12:27] C:\DOCUME~1\SANDRA~1\APPLIC~1\AVS4YOU
   [2010-01-14|21:19] C:\DOCUME~1\SANDRA~1\APPLIC~1\Azureus
   [2009-10-17|10:53] C:\DOCUME~1\SANDRA~1\APPLIC~1\DealAssistant
   [2009-01-06|01:55] C:\DOCUME~1\SANDRA~1\APPLIC~1\Identities
   [2010-01-15|22:41] C:\DOCUME~1\SANDRA~1\APPLIC~1\LimeWire
   [2009-01-06|04:53] C:\DOCUME~1\SANDRA~1\APPLIC~1\Macromedia
   [2009-02-12|23:19] C:\DOCUME~1\SANDRA~1\APPLIC~1\Malwarebytes
   [2009-01-13|10:37] C:\DOCUME~1\SANDRA~1\APPLIC~1\Media Player Classic
   [2009-03-28|00:10] C:\DOCUME~1\SANDRA~1\APPLIC~1\Microsoft
   [2009-01-06|04:56] C:\DOCUME~1\SANDRA~1\APPLIC~1\Mozilla
   [2009-01-29|12:22] C:\DOCUME~1\SANDRA~1\APPLIC~1\OpenOffice.org
   [2009-11-17|17:37] C:\DOCUME~1\SANDRA~1\APPLIC~1\PCToolsFirewallPlus
   [2009-10-28|15:49] C:\DOCUME~1\SANDRA~1\APPLIC~1\PlayFirst
   [2009-04-17|10:14] C:\DOCUME~1\SANDRA~1\APPLIC~1\SanDisk
   [2009-01-22|02:23] C:\DOCUME~1\SANDRA~1\APPLIC~1\Sun
   [2009-04-05|07:31] C:\DOCUME~1\SANDRA~1\APPLIC~1\vghd
   [2009-01-29|12:37] C:\DOCUME~1\SANDRA~1\APPLIC~1\WinRAR
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [2010-01-16 07:05][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [2010-01-19 19:57][--ah-----] C:\WINDOWS	asks\SA.DAT
   [2006-03-02 07:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [2009-01-06|02:00] C:\Program Files\802.11 Wireless LAN
   [2009-10-22|16:13] C:\Program Files\Adobe
   [2009-01-06|02:08] C:\Program Files\Analog Devices
   [2009-03-17|15:34] C:\Program Files\Apple Software Update
   [2009-01-06|02:33] C:\Program Files\ATI Technologies
   [2009-02-03|23:42] C:\Program Files\AutoCAD 2009
   [2009-02-03|23:20] C:\Program Files\Autodesk
   [2009-01-22|01:45] C:\Program Files\Avanquest update
   [2009-10-17|20:45] C:\Program Files\Avira
   [2009-10-17|20:51] C:\Program Files\AVS4YOU
   [2009-09-15|19:30] C:\Program Files\Bonjour
   [2009-11-07|12:15] C:\Program Files\Circle Devlopement
   [2009-01-07|22:56] C:\Program Files\Combined Community Codec Pack
   [2009-01-06|01:46] C:\Program Files\ComPlus Applications
   [2009-07-21|11:03] C:\Program Files\DivX
   [2009-04-15|23:08] C:\Program Files\Domain Tools
   [2009-11-17|17:07] C:\Program Files\Fast Browser Search
   [2009-09-25|12:25] C:\Program Files\Fichiers communs
   [2009-12-02|13:26] C:\Program Files\Full Tilt Poker
   [2009-11-11|00:14] C:\Program Files\InstallShield Installation Information
   [2009-01-06|02:07] C:\Program Files\Intel
   [2009-12-10|03:03] C:\Program Files\Internet Explorer
   [2009-09-25|13:49] C:\Program Files\iPod
   [2010-01-07|23:18] C:\Program Files\iTunes
   [2009-10-17|20:50] C:\Program Files\Java
   [2009-10-17|10:53] C:\Program Files\Jookz
   [2010-01-07|23:17] C:\Program Files\Last.fm
   [2010-01-07|22:43] C:\Program Files\LimeWire
   [2009-04-24|23:15] C:\Program Files\Ma Pension d'animaux 2
   [2009-01-06|03:09] C:\Program Files\Marvell
   [2009-02-15|04:12] C:\Program Files\Messenger
   [2009-11-07|12:15] C:\Program Files\Messenger Plus! Live
   [2009-02-07|00:31] C:\Program Files\MessengerDiscovery
   [2009-03-12|21:53] C:\Program Files\Microsoft
   [2009-03-14|02:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [2009-01-06|01:49] C:\Program Files\microsoft frontpage
   [2009-02-03|23:29] C:\Program Files\Microsoft Office
   [2009-09-10|02:09] C:\Program Files\Microsoft Silverlight
   [2009-03-12|21:55] C:\Program Files\Microsoft SQL Server Compact Edition
   [2009-03-12|21:56] C:\Program Files\Microsoft Sync Framework
   [2009-11-04|21:45] C:\Program Files\Monopoly Build-a-lot Edition
   [2009-04-15|23:36] C:\Program Files\Motorola Phone Tools
   [2009-03-12|21:46] C:\Program Files\Movie Maker
   [2010-01-19|21:53] C:\Program Files\Mozilla Firefox
   [2009-02-03|23:25] C:\Program Files\MSBuild
   [2009-01-06|01:45] C:\Program Files\MSN
   [2009-01-06|01:45] C:\Program Files\MSN Gaming Zone
   [2009-01-22|04:11] C:\Program Files\MSXML 4.0
   [2009-02-05|03:00] C:\Program Files\MSXML 6.0
   [2009-02-15|02:56] C:\Program Files\NetMeeting
   [2009-02-13|11:35] C:\Program Files\NOS
   [2009-01-29|12:19] C:\Program Files\OpenOffice.org 3
   [2009-08-13|02:02] C:\Program Files\Outlook Express
   [2010-01-19|21:40] C:\Program Files\PC Tools Firewall Plus
   [2010-01-07|22:34] C:\Program Files\PokerStars
   [2009-09-25|13:48] C:\Program Files\QuickTime
   [2009-02-03|22:23] C:\Program Files\Reference Assemblies
   [2009-01-06|01:47] C:\Program Files\Services en ligne
   [2009-11-17|17:07] C:\Program Files\SGPSA
   [2010-01-19|21:27] C:\Program Files	rend micro
   [2009-01-06|01:55] C:\Program Files\Uninstall Information
   [2009-12-18|20:22] C:\Program Files\Vuze
   [2009-10-22|15:50] C:\Program Files\Windows Live
   [2009-03-12|21:53] C:\Program Files\Windows Live SkyDrive
   [2009-01-28|01:26] C:\Program Files\Windows Media Connect 2
   [2009-08-30|14:52] C:\Program Files\Windows Media Player
   [2009-02-15|02:56] C:\Program Files\Windows NT
   [2009-01-06|01:48] C:\Program Files\WindowsUpdate
   [2009-01-29|12:37] C:\Program Files\WinRAR
   [2009-01-06|01:49] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [2009-10-22|16:13] C:\Program Files\Fichiers communs\Adobe
   [2009-09-25|13:49] C:\Program Files\Fichiers communs\Apple
   [2009-02-03|23:43] C:\Program Files\Fichiers communs\Autodesk Shared
   [2009-10-17|20:51] C:\Program Files\Fichiers communs\AVSMedia
   [2009-02-03|23:29] C:\Program Files\Fichiers communs\Designer
   [2009-07-21|11:03] C:\Program Files\Fichiers communs\DivX Shared
   [2009-01-07|14:48] C:\Program Files\Fichiers communs\i4j_jres
   [2009-10-17|20:59] C:\Program Files\Fichiers communs\InstallShield
   [2009-03-12|21:53] C:\Program Files\Fichiers communs\Microsoft Shared
   [2009-01-22|01:34] C:\Program Files\Fichiers communs\Motorola Shared
   [2009-01-06|01:47] C:\Program Files\Fichiers communs\MSSoap
   [2009-01-05|21:34] C:\Program Files\Fichiers communs\ODBC
   [2009-11-17|17:36] C:\Program Files\Fichiers communs\PC Tools
   [2009-01-06|01:47] C:\Program Files\Fichiers communs\Services
   [2009-01-05|21:34] C:\Program Files\Fichiers communs\SpeechEngines
   [2009-02-15|02:56] C:\Program Files\Fichiers communs\System
   [2009-03-12|21:45] C:\Program Files\Fichiers communs\Windows Live

   --------------------\  Process

   ( 47 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2010-01-19 22:23:30
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\SANDRA~1\Mes documents\Azureus Downloads\Kate Voegele All Songs@160 kbps VBR MP3Pro\Kate Voegele - Where the Sidewalk Cracks.mp3
   C:\DOCUME~1\SANDRA~1\Mes documents\LimeWire\Saved\Eminem Feat Dr. Dre & 50 Cent - Crack A Bottle.mp3


   [F:2483][D:139]-> C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp
   [F:134][D:0]-> C:\DOCUME~1\SANDRA~1\Cookies
   [F:4450][D:19]-> C:\DOCUME~1\SANDRA~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 2010-01-19|21:52 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 2010-01-19|22:25 - Option : [2]

   --------------------\  Fin du rapport a 22:25:24

dédétraqué · Answer

Salut Lucioole 


As-tu le rapport de AD-Remover?


@++    :)

Lucioole · Answer

voici celui de ad-r :

.
======= LOGFILE OF AD-REMOVER 1.1.4.6_I | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 19.01.2010 at 21:16
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at: 22:28:21, 2010-01-19 | Normal Boot | Option: CLEAN
Executed from: C:\Ad-Remover\
Operating system: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Computer Name: SANDRA-73F10F61 | Current user: Sandra Laurence
.
============== NEUTRALIZED ELEMENT(S) ==============
.

C:\DOCUME~1\SANDRA~1\APPLIC~1\Mozilla\FireFox\Profiles\v2orw9lo.default\searchplugins\Yoog Search.xml 
C:\Program Files\Fast Browser Search 
C:\Program Files\SGPSA 
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia 
C:\WINDOWS\system32\7478.dll 
C:\DOCUME~1\SANDRA~1\Bureau\programme\IMBoosterSetup.mhe0zcb0ll3ad4455tyaof55.exe 

(!) -- Temp files deleted.
 
.
HKCU\software\appdatalow\9f725d00-0f3c-c285-e769-568fd41b7113
HKCU\Software\AppDataLow\software\{AF0E9EA4-3EDC-1EB0-581F-C8B893CE3345}
HKCU\software\Casino Tropez
HKCU\software\FBSearch
HKCU\software\MediaHoldings
HKCU\software\microsoft\internet explorer\searchscopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
HKCU\software\microsoft\internet explorer\searchscopes\{19F2B849-4ADE-4d4b-85F9-C31C643DBDE9}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{1BB22D38-A411-4B13-A746-C2A4F4EC7344} 
HKCU\software\PlayMP3
HKLM\software\Casino Tropez
HKLM\Software\Classes\CLSID\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKLM\Software\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
HKLM\Software\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
HKLM\Software\Classes\CLSID\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKLM\Software\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKLM\software\classes\ComObject.DeskbarEnabler
HKLM\software\classes\ComObject.DeskbarEnabler.1
HKLM\Software\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
HKLM\Software\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}
HKLM\software\classes\URLSearchHook.ToolbarURLSearchHook
HKLM\software\classes\URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0C1FD5D0-8A20-43e3-89AC-1FAB06FCE01C}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{42E5B5FD-F72A-48a4-970A-E2881CD6C3D7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{535389FC-FD44-4a95-970F-B471F3BBCABD}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{1BB22D38-A411-4B13-A746-C2A4F4EC7344} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKLM\software\microsoft\windows\currentversion\uninstall\{F6D0DE12-23C4-4604-A33C-E722646411E3}
.
============== Added scan ==============
.
.
* Mozilla FireFox Version 3.0.17 [fr] *
.
 ProfilePath: v2orw9lo.default (Sandra Laurence)
.
(SANDRA~1, prefs.js) Browser.download.lastDir, C:\Documents and Settings\Sandra Laurence\Mes documents\Mes images\image gi
(SANDRA~1, prefs.js) Browser.search.defaultenginename, Fast Browser Search
(SANDRA~1, prefs.js) Browser.search.defaulturl, hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
(SANDRA~1, prefs.js) Browser.search.selectedEngine, Fast Browser Search
(SANDRA~1, prefs.js) Extensions.enabledItems, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.2,autopager@mozilla.org:0.5.5.6,fr@dictionaries.addons.mozilla.org:2.1,{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}:2.4.0,{3112ca9c-de6d-4884-a869-9855de68056c}:6.1.20091216W,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13,{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15,jqs@sun.com:1.0,{20a82645-c095-46ed-80e3-08825760534b}:0.0.0,personas@christopher.beard:1.5,{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.17
(SANDRA~1, prefs.js) Keyword.URL, hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={43862B63-B3A9-95C3-469B-87922B4594EB}&q=
. 
(SANDRA~1, prefs.js) ERASED - Browser.search.defaultenginename, Fast Browser Search
(SANDRA~1, prefs.js) ERASED - Browser.search.defaulturl, hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
(SANDRA~1, prefs.js) ERASED - Browser.search.order.1, Fast Browser Search
(SANDRA~1, prefs.js) ERASED - Browser.search.selectedEngine, Fast Browser Search
(SANDRA~1, prefs.js) ERASED - Keyword.URL, hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={43862B63-B3A9-95C3-469B-87922B4594EB}&q=
. 
(SANDRA~1, user.js) Browser.search.defaultenginename, Yoog Search
(SANDRA~1, user.js) Browser.search.defaulturl, hxxp://www15.yoog.com/search.php?q=
(SANDRA~1, user.js) Browser.search.selectedEngine, Yoog Search
(SANDRA~1, user.js) Keyword.URL, hxxp://www15.yoog.com/search.php?q=
. 
(SANDRA~1, user.js) ERASED - Browser.search.defaultenginename, Yoog Search
(SANDRA~1, user.js) ERASED - Browser.search.defaulturl, hxxp://www15.yoog.com/search.php?q=
(SANDRA~1, user.js) ERASED - Browser.search.selectedEngine, Yoog Search
(SANDRA~1, user.js) ERASED - Keyword.URL, hxxp://www15.yoog.com/search.php?q=
. 
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\WINDOWS\system32\blank.htm
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Enable Browser Extensions: yes
Use Custom Search URL: 1 (0x1)
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Use Search Asst: 
SearchAssistant: 
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Search Bar: hxxp://search.msn.com/spbasic.htm
Use Custom Search URL: 1 (0x1)
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
.
===================================
.
6629 Byte(s) - C:\Ad-Report-CLEAN[1].log 
.
1651 File(s) - C:\DOCUME~1\SANDRA~1\LOCALS~1\Temp 
164 File(s) - C:\WINDOWS\Temp 
0 File(s) - C:\WINDOWS\Prefetch 
.
19 File(s) - C:\Ad-Remover\BACKUP
56 File(s) - C:\Ad-Remover\QUARANTINE
.
End at: 22:37:41 | 2010-01-19 - CLEAN[1]
.
============== E.O.F ==============
.

dédétraqué · Answer

Salut Lucioole


-Télécharge et installe MalwareByte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

- Mets le à jour

---

- Redémarre en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur

---

- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur  sur OK

- Si MalwareByte's n'a rien détecté, clique sur OK  Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats  ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's  a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur OK

Tutoriel pour MalwareByte's ici : 
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/


@++   :)

Lucioole · Answer

Salut Dédétraqué,

dsl pour e décalage mais je devais dormir. voici le rapport de malaware :

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3601
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

2010-01-20 07:12:32
mbam-log-2010-01-20 (07-12-32).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 178140
Temps écoulé: 1 hour(s), 58 minute(s), 31 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 8

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\MegaSwellAdsForYou (Adware.MegaSwellAdsForYou) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f6d0de13-23c4-4604-a33c-e722646411e3} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f6d0de13-23c4-4604-a33c-e722646411e3} (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\Sandra Laurence\Application Data\DealAssistant (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Ad-Remover\QUARANTINE\WINDOWS\system32\7478.dll.vir (Adware.Mirar) -> Quarantined and deleted successfully.
C:\ComboFix\Combo-Fix.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sandra Laurence\Local Settings	emp\92.exe (Adware.Mirar) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3D879070-0751-46D8-B9B3-15A209B3A780}\RP413\A0135505.dll (Adware.Mirar) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sandra Laurence\Application Data\DealAssistant\config.cfg (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sandra Laurence\Application Data\DealAssistant\DAUninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sandra Laurence\Application Data\asd.bat (Rogue.WinPCDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sandra Laurence\Local Settings	emp\_ir_sf_temp_0\irsetup.exe (Trojan.Agent) -> Quarantined and deleted successfully.

dédétraqué · Answer

Salut Lucioole


Supprime ce dossier C:\rsit

Refais un scan avec RSIT et poste le rapport log.txt et info.txt à la fin de l’analyse

Le rapport est dans le dossier ici C:\rsit


@++   :)

Lucioole · Answer

salut !

voici le log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sandra Laurence at 2010-01-20 17:50:08
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 35 GB (46%) free of 76 GB
Total RAM: 1279 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:50:28, on 2010-01-20
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\Sandra Laurence\Bureau\RSIT.exe
C:\Program Files	rend micro\Sandra Laurence.exe
C:\WINDOWS\system32\wscntfy.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Mirar - {F6D0DE12-23C4-4604-A33C-E722646411E3} - C:\WINDOWS\system32\7478.dll (file missing)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Lucioole · Answer

et le info :

info.txt logfile of random's system information tool 1.06 2010-01-20 17:50:32

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A92000000001}
Ad-Remover By C_XX-->"C:\Ad-Remover\Un-ADR.exe"
Apple Application Support-->MsiExec.exe /I{0C34B801-6AEC-4667-B053-03A67E2D0415}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AutoCAD 2009 - Français-->C:\Program Files\AutoCAD 2009\Setup\Setup.exe /P {5783F2D7-7001-040C-0002-0060B0CE6BBA} /M ACAD
Autodesk Design Review 2009-->C:\Program Files\Autodesk\Autodesk Design Review\Setup\Setup.exe /P {450063AA-643B-417C-8CF5-405BA3F4EF40} /M ADR
Avanquest update-->C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe -runfromtemp -l0x0009 -removeonly
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Combined Community Codec Pack 2008-09-21 16:18-->"C:\Program Files\Combined Community Codec Pack\unins000.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Fast Browser Search (My Web Tattoo)-->regsvr32 /u /s "C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll" 
Full Tilt Poker-->"C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -runfromtemp -l0x040c -removeonly
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
IEEE 802.11g Wireless Cardbus/PCI Adapter-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{29F15D3F-5B37-44DB-BB89-390B3AD1404E} 
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
iTunes-->MsiExec.exe /I{EC2A8F27-4FBF-4E41-B27B-FE822511B761}
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
Kaspersky Online Scanner-->C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
Kaspersky On-line Scanner-->C:\WINDOWS\system32\KASPER~1\KASPER~1\kavuninstall.exe
Last.fm 1.5.4.24567-->"C:\Program Files\Last.fm\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LimeWire 5.4.6-->"C:\Program Files\LimeWire\uninstall.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Messenger Plus! Live & Sponsor (CiD)-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB974455)-->"C:\WINDOWS\ie7updates\KB974455-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB974455)-->"C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB973874)-->"C:\WINDOWS\ie8updates\KB973874-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows Internet Explorer 8 (KB976749)-->"C:\WINDOWS\ie8updates\KB976749-IE8\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
Monopoly Build-a-lot Edition 1.00-->C:\Program Files\Monopoly Build-a-lot Edition\Monopoly Build-a-lot Edition\Uninstall.exe
Mozilla Firefox (3.0.17)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
OpenOffice.org 3.0-->MsiExec.exe /I{1572F66F-F9AD-4D45-B0D2-0F45A0D5A0F6}
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
PC Tools Firewall Plus 6.0-->C:\Program Files\PC Tools Firewall Plus\unins000.exe /LOG
PokerStars-->"C:\Program Files\PokerStars\PokerStarsUninstall.exe" /u:PokerStars
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
SoundMAX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\Setup.exe" 
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Vuze-->C:\Program Files\Vuze\uninstall.exe
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D5D81435-B8DE-4CAF-867F-7998F2B92CFC}
Windows Live FolderShare-->MsiExec.exe /X{2075CB0A-D26F-4DAA-B424-5079296B43BA}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
Windows Live Writer-->MsiExec.exe /X{4634B21A-CC07-4396-890C-2B8168661FEA}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======Security center information======

AV: AntiVir Desktop
FW: PC Tools Firewall Plus (disabled)

======System event log======

Computer Name: SANDRA-73F10F61
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 11228
Source Name: Tcpip
Time Written: 20091130082211.000000-300
Event Type: warning
User: 

Computer Name: SANDRA-73F10F61
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 11227
Source Name: Tcpip
Time Written: 20091129182047.000000-300
Event Type: warning
User: 

Computer Name: SANDRA-73F10F61
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 11223
Source Name: Tcpip
Time Written: 20091129173408.000000-300
Event Type: warning
User: 

Computer Name: SANDRA-73F10F61
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 11222
Source Name: Tcpip
Time Written: 20091129155332.000000-300
Event Type: warning
User: 

Computer Name: SANDRA-73F10F61
Event Code: 36
Message: Le service de temps n'a pas pu synchroniser l'heure système de 49152
secondes car aucun fournisseur de temps n'a pu fournir de datage
utilisable. L'horloge système n'est pas synchronisée.

Record Number: 11221
Source Name: W32Time
Time Written: 20091129113555.000000-300
Event Type: warning
User: 

=====Application event log=====

Computer Name: SANDRA-73F10F61
Event Code: 1001
Message: Détecteur d'erreurs 1141397321.

Record Number: 102
Source Name: Application Hang
Time Written: 20090606175626.000000-240
Event Type: error
User: 

Computer Name: SANDRA-73F10F61
Event Code: 1002
Message: Application bloquée msnmsgr.exe, version 14.0.8064.206, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Record Number: 101
Source Name: Application Hang
Time Written: 20090606175601.000000-240
Event Type: error
User: 

Computer Name: SANDRA-73F10F61
Event Code: 1002
Message: Application bloquée firefox.exe, version 1.9.0.3399, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Record Number: 9
Source Name: Application Hang
Time Written: 20090517014601.000000-240
Event Type: error
User: 

Computer Name: SANDRA-73F10F61
Event Code: 4113
Message: AntiVir has detected 'TR/Dropper.Gen'
in the file
C:\Documents and Settings\Sandra Laurence\Local Settings\Application Data\Mozilla\Firefox\Profiles\v2orw9lo.default\Cache\C09BBE1Bd01

Record Number: 8
Source Name: Avira AntiVir
Time Written: 20090517014456.000000-240
Event Type: warning
User: AUTORITE NT\SYSTEM

Computer Name: SANDRA-73F10F61
Event Code: 4113
Message: AntiVir has detected 'TR/Dropper.Gen'
in the file
C:\Documents and Settings\Sandra Laurence\Local Settings\Application Data\Mozilla\Firefox\Profiles\v2orw9lo.default\Cache\C09BBE1Bd01

Record Number: 7
Source Name: Avira AntiVir
Time Written: 20090517014456.000000-240
Event Type: warning
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

Lucioole · Answer

Bonsoir,

est-ce que quelqu'un pourrait m'aider ?

Lucioole

dédétraqué · Answer

Salut Lucioole


Via Ajout/Suppression de programmes désinstalle le Sponsor de Messenger Plus! Live & Sponsor 


Télécharge OTM (de Old_Timer) sur le bureau :

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/


Double-clique sur OTM.exe sur le bureau

- Copie le texte qui se trouve en gras ci-dessous et colle le dans le cadre de gauche de OTM nommé Paste Instructions for Items to be Moved

 :reg 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F6D0DE12-23C4-4604-A33C-E722646411E3}]

:files 
C:\Program Files\Circle Devlopement

:commands 
[purity] 
[emptytemp] 
[reboot]

- Clique sur MoveIt! pour lancer la suppression.
- Ferme OTM

Ton PC va redémarrer pour finir la suppression, si il ne le fais pas lui-même, redémarre le.

Poste le rapport de OTMoveIt qui se trouve dans C:\_OTM\MovedFiles.


-----


Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :

https://www.eset.com/int/home/online-scanner/

(coche toutes les cases à chaque fois) 
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt


@++   :)

Lucioole · Answer

Salut,
je ne peut pas désintaller messenger car sa me dit que le programme de sponcer ne peut etre lancé.

qu'est ce que je dois faire ?

dédétraqué · Answer

Salut Lucioole


Redémarre le PC pour voir.


@++   :)

Lucioole · Answer

Ok, j'ai réusis voici le rapport de OTM :

Files moved on Reboot...

Registry entries deleted on Reboot...

Lucioole

dédétraqué · Answer

Salut Lucioole


Il n'est pas complet, tu as seulement cela?


@++   :)

Lucioole · Answer

oui c'est la seul chose que j'ai !

lucioole

Lucioole · Answer

Est-ce que je fais l'autre scan quand meme ou je refait OTM ?

Lucioole

dédétraqué · Answer

Salut Lucioole


Refais OTM


@++   :)

Lucioole · Answer

Re-voici le nouveau rapport :

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F6D0DE12-23C4-4604-A33C-E722646411E3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D0DE12-23C4-4604-A33C-E722646411E3}\ not found.
========== FILES ==========
File/Folder C:\Program Files\Circle Devlopement not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Sandra Laurence
->Temp folder emptied: 918123 bytes
->Temporary Internet Files folder emptied: 984653 bytes
->Java cache emptied: 45688531 bytes
->FireFox cache emptied: 114493357 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2148155 bytes
%systemroot%\System32 .tmp files removed: 5914624 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 27915700 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23962344 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 69054 bytes
 
Total Files Cleaned = 212,00 mb
 
 
OTM by OldTimer - Version 3.1.6.0 log created on 01202010_225138

Files moved on Reboot...

Registry entries deleted on Reboot...

dédétraqué · Answer

Salut Lucioole 


OK c'est bon, faire le scan en ligne


@++   :)

Lucioole · Answer

voici le log du scan en ligne :

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=7787bb53dee0e245b1a571671ff8d82a
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-01-21 08:26:56
# local_time=2010-01-21 03:26:56 (-0500, Est)
# country="Canada"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1797 16775125 100 100 0 39544269 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=63502
# found=4
# cleaned=4
# scan_time=15791
C:\Lop SD\Backup-Lop\DOCUME~1\ALLUSE~1\APPLIC~1\Proxy Long Chin Ping\owns soft.exe	a variant of Win32/TrojanDownloader.Swizzor.NDP trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Lop SD\Backup-Lop\DOCUME~1\SANDRA~1\APPLIC~1\SHOWBE~1\CAMP DENT BODY.exe	a variant of Win32/TrojanDownloader.Swizzor.NDQ trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Lop SD\Backup-Lop\DOCUME~1\SANDRA~1\APPLIC~1\SHOWBE~1\swksltxy.exe	a variant of Win32/TrojanDownloader.Swizzor.NDP trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Lop SD\Backup-Lop\DOCUME~1\SANDRA~1\LOCALS~1	emp\bis322.exe	a variant of Win32/TrojanDownloader.Swizzor.NCY trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C

dédétraqué · Answer

Salut Lucioole


Mettre à jour Antivir, faire un scan en mode sans échec et poste le rapport après avoir démarré en mode normal.

Aide : https://www.malekal.com/avira-free-security-antivirus-gratuit/


@++   :)

Lucioole · Answer

Bonsoir, 
voici le rapport de antivir :



Avira AntiVir Personal
Report file date: 21 janvier 2010  20:00

Scanning for 1628331 virus strains and unwanted programs.

Licensee        : Avira AntiVir Personal - FREE Antivirus
Serial number   : 0000149996-ADJIE-0000001
Platform        : Windows XP
Windows version : (Service Pack 3)  [5.1.2600]
Boot mode       : Save mode
Username        : Sandra Laurence
Computer name   : SANDRA-73F10F61

Version information:
BUILD.DAT       : 9.0.0.418     21723 Bytes  2009-12-02 16:28:00
AVSCAN.EXE      : 9.0.3.10     466689 Bytes  2009-11-23 05:19:09
AVSCAN.DLL      : 9.0.3.0       40705 Bytes  2009-02-27 15:58:24
LUKE.DLL        : 9.0.3.2      209665 Bytes  2009-02-20 16:35:49
LUKERES.DLL     : 9.0.2.0       12033 Bytes  2009-02-27 15:58:52
VBASE000.VDF    : 7.10.0.0   19875328 Bytes  2009-11-06 05:19:08
VBASE001.VDF    : 7.10.1.0    1372672 Bytes  2009-11-19 05:19:08
VBASE002.VDF    : 7.10.3.1    3143680 Bytes  2010-01-20 12:47:58
VBASE003.VDF    : 7.10.3.2       2048 Bytes  2010-01-20 12:47:58
VBASE004.VDF    : 7.10.3.3       2048 Bytes  2010-01-20 12:47:58
VBASE005.VDF    : 7.10.3.4       2048 Bytes  2010-01-20 12:47:58
VBASE006.VDF    : 7.10.3.5       2048 Bytes  2010-01-20 12:47:58
VBASE007.VDF    : 7.10.3.6       2048 Bytes  2010-01-20 12:47:59
VBASE008.VDF    : 7.10.3.7       2048 Bytes  2010-01-20 12:47:59
VBASE009.VDF    : 7.10.3.8       2048 Bytes  2010-01-20 12:47:59
VBASE010.VDF    : 7.10.3.9       2048 Bytes  2010-01-20 12:47:59
VBASE011.VDF    : 7.10.3.10      2048 Bytes  2010-01-20 12:48:00
VBASE012.VDF    : 7.10.3.11      2048 Bytes  2010-01-20 12:48:00
VBASE013.VDF    : 7.10.3.12      2048 Bytes  2010-01-20 12:48:00
VBASE014.VDF    : 7.10.3.13      2048 Bytes  2010-01-20 12:48:00
VBASE015.VDF    : 7.10.3.14      2048 Bytes  2010-01-20 12:48:01
VBASE016.VDF    : 7.10.3.15      2048 Bytes  2010-01-20 12:48:01
VBASE017.VDF    : 7.10.3.16      2048 Bytes  2010-01-20 12:48:01
VBASE018.VDF    : 7.10.3.17      2048 Bytes  2010-01-20 12:48:01
VBASE019.VDF    : 7.10.3.18      2048 Bytes  2010-01-20 12:48:02
VBASE020.VDF    : 7.10.3.19      2048 Bytes  2010-01-20 12:48:02
VBASE021.VDF    : 7.10.3.20      2048 Bytes  2010-01-20 12:48:02
VBASE022.VDF    : 7.10.3.21      2048 Bytes  2010-01-20 12:48:02
VBASE023.VDF    : 7.10.3.22      2048 Bytes  2010-01-20 12:48:02
VBASE024.VDF    : 7.10.3.23      2048 Bytes  2010-01-20 12:48:02
VBASE025.VDF    : 7.10.3.24      2048 Bytes  2010-01-20 12:48:03
VBASE026.VDF    : 7.10.3.25      2048 Bytes  2010-01-20 12:48:03
VBASE027.VDF    : 7.10.3.26      2048 Bytes  2010-01-20 12:48:03
VBASE028.VDF    : 7.10.3.27      2048 Bytes  2010-01-20 12:48:03
VBASE029.VDF    : 7.10.3.28      2048 Bytes  2010-01-20 12:48:03
VBASE030.VDF    : 7.10.3.29      2048 Bytes  2010-01-20 12:48:03
VBASE031.VDF    : 7.10.3.38    122880 Bytes  2010-01-21 00:55:46
Engineversion   : 8.2.1.146
AEVDF.DLL       : 8.1.1.2      106867 Bytes  2009-10-18 04:18:11
AESCRIPT.DLL    : 8.1.3.9      659834 Bytes  2010-01-21 12:48:21
AESCN.DLL       : 8.1.3.1      127348 Bytes  2010-01-15 02:14:59
AESBX.DLL       : 8.1.1.1      246132 Bytes  2009-11-23 05:19:08
AERDL.DLL       : 8.1.3.4      479605 Bytes  2009-12-01 22:05:49
AEPACK.DLL      : 8.2.0.5      422262 Bytes  2010-01-15 02:14:58
AEOFFICE.DLL    : 8.1.0.38     196987 Bytes  2009-07-23 14:59:39
AEHEUR.DLL      : 8.1.0.195   2232695 Bytes  2010-01-15 02:14:56
AEHELP.DLL      : 8.1.10.0     237942 Bytes  2010-01-15 02:14:51
AEGEN.DLL       : 8.1.1.83     369014 Bytes  2010-01-05 06:38:44
AEEMU.DLL       : 8.1.1.0      393587 Bytes  2009-10-18 04:18:03
AECORE.DLL      : 8.1.9.5      184693 Bytes  2010-01-15 02:14:50
AEBB.DLL        : 8.1.0.3       53618 Bytes  2008-10-09 19:32:40
AVWINLL.DLL     : 9.0.0.3       18177 Bytes  2008-12-12 13:47:59
AVPREF.DLL      : 9.0.3.0       44289 Bytes  2009-10-18 04:18:11
AVREP.DLL       : 8.0.0.3      155905 Bytes  2009-01-20 19:34:28
AVREG.DLL       : 9.0.0.0       36609 Bytes  2008-12-05 15:32:09
AVARKT.DLL      : 9.0.0.3      292609 Bytes  2009-03-24 20:05:41
AVEVTLOG.DLL    : 9.0.0.7      167169 Bytes  2009-01-30 15:37:08
SQLITE3.DLL     : 3.6.1.0      326401 Bytes  2009-01-28 20:03:49
SMTPLIB.DLL     : 9.2.0.25      28417 Bytes  2009-02-02 13:21:33
NETNT.DLL       : 9.0.0.0       11521 Bytes  2008-12-05 15:32:10
RCIMAGE.DLL     : 9.0.0.25    2438913 Bytes  2009-05-15 20:39:58
RCTEXT.DLL      : 9.0.73.0      86785 Bytes  2009-11-23 05:19:07

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, 
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: 21 janvier 2010  20:00

Starting search for hidden objects.
The driver could not be initialized.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '56' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
    [NOTE]      This file is a Windows system file.
    [NOTE]      This file cannot be opened for scanning.
C:\Ad-Remover\1\List.dat
    [DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
C:\Ad-Remover\BACKUP\AD-R.exe
  [0] Archive type: NSIS
    --> ProgramFilesDir/List.dat
      [DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
C:\Documents and Settings\Sandra Laurence\Bureau\AD-R.exe
  [0] Archive type: NSIS
    --> ProgramFilesDir/List.dat
      [DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
C:\Documents and Settings\Sandra Laurence\Mes documents\LimeWire\Saved\daimond girl kmw greatest hit 2009.wma
    [DETECTION] Is the TR/Dldr.Wimad.1395 Trojan

Beginning disinfection:
C:\Ad-Remover\1\List.dat
    [DETECTION] Contains recognition pattern of the HTML/Malicious.ActiveX.Gen HTML script virus
    [NOTE]      The file was moved to '4bcc170e.qua'!
C:\Ad-Remover\BACKUP\AD-R.exe
    [NOTE]      The file was moved to '4b8616e9.qua'!
C:\Documents and Settings\Sandra Laurence\Bureau\AD-R.exe
    [NOTE]      The file was moved to '4ae0b842.qua'!
C:\Documents and Settings\Sandra Laurence\Mes documents\LimeWire\Saved\daimond girl kmw greatest hit 2009.wma
    [DETECTION] Is the TR/Dldr.Wimad.1395 Trojan
    [NOTE]      The file was moved to '4bc21707.qua'!


End of the scan: 21 janvier 2010  22:08
Used time:  2:05:36 Hour(s)

The scan has been done completely.

   9351 Scanned directories
 285659 Files were scanned
      4 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 files were deleted
      0 Viruses and unwanted programs were repaired
      4 Files were moved to quarantine
      0 Files were renamed
      1 Files cannot be scanned
 285654 Files not concerned
   1560 Archives were scanned
      1 Warnings
      5 Notes

Lucioole

dédétraqué · Answer

Salut Lucioole 


Cela est bon, as-tu d'autre souci?


@++   :)

Lucioole · Answer

Salut, 
pour commencer merci beaucoup pour ton aide !

deuxièmement, mon anti-virus est désactivé et je ne suis pas capable de le réactivé ???

Pourrais-tu m'aider encore une fois ?

Lucioole

dédétraqué · Answer

Salut Lucioole


Refais un scan avec RSIT et poste le rapport log.txt seulement à la fin de l’analyse

Le rapport est dans le dossier ici C:\rsit


@++   :)

Lucioole · Answer

Salut, voici le log :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sandra Laurence at 2010-01-28 21:06:57
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 36 GB (47%) free of 76 GB
Total RAM: 1279 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:07:03, on 2010-01-28
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sandra Laurence\Bureau\RSIT.exe
C:\Program Files	rend micro\Sandra Laurence.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.plusnetwork.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: (no name) - {F6D0DE12-23C4-4604-A33C-E722646411E3} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Sandra Laurence\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.51.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.51 V1.00\WlanCU.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

dédétraqué · Answer

Salut Lucioole 


Rien de suspect et un redémarrage n'as pas réglé le souci?


@++   :)

Pop-up explorer

34 réponses

Discussions similaires

Newsletters