Cheval de Troie impossible a supprimer, Fermé

Question

Bonjour,

Alors voila je possède un cheval de Troie dans mon système qu'Avast a détecté. Hors je ne peux pas le supprimer car il revient tout le temps. Merci de me guider dans les opérations a faire pour le supprimer définitivement. 

Le rapport d'Avast est: 

C:\windows\Temp\ysfb.tmp\svchost.exe
Win32:Small-CHC [Trj]
Cheval de Troie,

J'ai fait une analyse avec HijackThis et le voici: 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:38:24, on 29/01/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\System32undll32.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32undll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\conime.exe
C:\Program Files\SolidWorks (2)\SolidWorks\sldworks.exe
C:\Users\ALEXAN~1\AppData\Local\Temp\SolidWorksLicTemp.0001
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Users\Alexandre\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [SolidWorks_CheckForUpdates] "C:\Program Files\Common Files\Gestionnaire d'installation SolidWorks\Scheduler\sldIMScheduler.exe" /scheduler
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Livestation] C:\Program Files\Livestation\Livestation.exe -startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [LosAlamos] rundll32.exe C:\Windows\system32\sshnas21.dll,AttachConsoleA
O4 - HKCU\..\Run: [BMIMZMHMFM] C:\Users\ALEXAN~1\AppData\Local\Temp\Ymj.exe
O4 - HKUS\S-1-5-18\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'Default user')
O4 - Startup: .lnk = C:\Program Files\SolidWorks (2)\SolidWorks\swScheduler\swBOEngine.exe
O4 - Startup: Moteur du Planificateur de tâches SolidWorks.lnk = C:\Program Files\SolidWorks (2)\SolidWorks\swScheduler\swBOEngine.exe
O4 - Global Startup: FancyStart daemon.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service Google Update (gupdate1ca2fdae7c5582a) (gupdate1ca2fdae7c5582a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Norton Internet Security - Unknown owner - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: Remote Solver for COSMOSFloWorks 2007 - Unknown owner - C:\Program Files\SolidWorks (2)\COSMOSFloWorks\FloWorks\binCFW\StandAloneSlv.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

Utilisateur anonyme · Answer

Hello ,

Infecté en effet .

Commence par ceci :


• Télécharge UsbFix sur ton Bureau : 

(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir. 

• Double clic sur UsbFix.exe présent sur ton bureau . 

• Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

• Au second menu Choisis l'option " 2 " ( Suppression ) et tape sur [entrée] 

• Ton bureau disparaîtra et le pc redémarrera. 

• Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil. 

• Ensuite poste le rapport UsbFix.txt qui apparaîtra avec le bureau. 

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt ) 

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 

• Tuto : http://pagesperso-orange.fr/NosTools/tuto_usbfix3.html
• Home : http://pagesperso-orange.fr/NosTools/usbfix.html

Kbalex · Answer

J'ai bien réaliser les opérations demandées mais Je ne peux pas vous envoyer le rapport  UsbFix par la suite car le PC se coupe dès que j'accède a internet en échec bios, donc obliger de le redémarrer manuellement. Avast détecte toujours le virus. 

Merci de bien me guider d'avantage,

Utilisateur anonyme · Answer

• Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau. 
• Double-clique sur le fichier téléchargé pour lancer le processus d'installation. 
• Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte. 
• Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche. 
• Sélectionne Exécuter un examen rapide. 
• Clique sur Rechercher. L'analyse démarre. 
• A la fin de l'analyse, un message s'affiche : 

"L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés."

• Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi. 
• Ferme tes navigateurs. 
• Si des malwares ont été détectés, clique sur Afficher les résultats. 
• Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine. 
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

Kbalex · Answer

Voila le rapport de MBAM: 

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3658
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

29/01/2010 21:37:45
mbam-log-2010-01-29 (21-37-45).txt

Type de recherche: Examen rapide
Eléments examinés: 108398
Temps écoulé: 10 minute(s), 25 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\ROUA3O12PW (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\Winsudate (Adware.Gibmedia) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\Alexandre\AppData\Local\Temp\extracting.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Alexandre\AppData\Local\Temp\extractor.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibcom.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibidl.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibupt.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Internet Explorer\minftnet.exe (Adware.Agent) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Réouvre malewarebyte's va sur quarantaine et supprime tout .

Le pc va mieux .?

Post ce rapport C:\UsbFix.txt stp

Kbalex · Answer

Non toujours pareil, j'ai l'impression que quand je demande trop de programmes en même temps, le Pc se met en échec et Avast détecte toujours le Cheval de Troie. 

Voici le rapport Usbfix:


############################## | UsbFix V6.082 |

User : Alexandre (Administrateurs) # PC-DE-ALEXANDRE
Update on 29/01/2010 by El Desaparecido , C_XX & Chimay8
Start at: 20:13:31 | 29/01/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 Duo CPU     T5850  @ 2.16GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Disabled

C:\ -> Disque fixe local # 149,04 Go (42,34 Go free) [VistaOS] # NTFS
D:\ -> Disque fixe local # 137,33 Go (80,7 Go free) [DATA] # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
G:\ -> Disque CD-ROM
H:\ -> Disque amovible # 7,2 Go (4,48 Go free) # FAT32

############################## | Processus actifs |

C:\Windows\System32\smss.exe 524
C:\Windows\system32\csrss.exe 600
C:\Windows\system32\wininit.exe 652
C:\Windows\system32\csrss.exe 660
C:\Windows\system32\services.exe 700
C:\Windows\system32\lsass.exe 712
C:\Windows\system32\lsm.exe 720
C:\Windows\system32\winlogon.exe 828
C:\Windows\system32\svchost.exe 884
C:\Windows\system32
vvsvc.exe 956
C:\Windows\system32\svchost.exe 984
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe 1024
C:\Windows\system32\LogonUI.exe 1064
C:\Windows\system32\svchost.exe 1104
C:\Windows\System32\svchost.exe 1196
C:\Windows\System32\svchost.exe 1296
C:\Windows\system32\svchost.exe 1332
C:\Windows\system32\svchost.exe 1420
C:\Windows\system32\SLsvc.exe 1484
C:\Windows\system32undll32.exe 1528
C:\Windows\system32\svchost.exe 1564
C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe 1872
C:\Windows\system32\WLANExt.exe 1880
C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe 1892
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1948
C:\Program Files\ATKGFNEX\GFNEXSrv.exe 2020
C:\Program Files\Alwil Software\Avast4\ashServ.exe 2040
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe 204
C:\Windows\system32	askeng.exe 1632
C:\Windows\System32\spoolsv.exe 1472
C:\Windows\system32\svchost.exe 788
C:\Windows\System32\lpksetup.exe 372
C:\Windows\system32	askeng.exe 2368
C:\Windows\system32\Dwm.exe 2392
C:\Program Files\ASUS\ASUS Live Update\ALU.exe 2456
C:\Windows\system32	askeng.exe 2464
C:\Windows\Explorer.EXE 2480
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe 2696
C:\Program files\P4G\BatteryLife.exe 2712
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe 2732
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe 2740
C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe 2820
C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe 2892
C:\Program Files\ASUS\ATK Hotkey\HControl.exe 2900
C:\Program Files\Wireless Console 2\wcourier.exe 2908
C:\Program Files\ASUS\Splendid\ACMON.exe 2916
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 3060
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe 3088
C:\Windows\System32\ACEngSvr.exe 3100
C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe 3116
C:\Program Files\Bonjour\mDNSResponder.exe 3124
C:\Program Files\ASUS\ATK Hotkey\WDC.exe 3176
C:\Program Files\Google\Update\GoogleUpdate.exe 3188
C:\Program Files\Common Files\LightScribe\LSSrvc.exe 3332
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe 3380
C:\Windows\System32\svchost.exe 3440
C:\Windows\System32\svchost.exe 3468
C:\Windows\system32\svchost.exe 3512
C:\Program Files\SolidWorks (2)\COSMOSFloWorks\FloWorks\binCFW\StandAloneSlv.exe 3532
C:\Windows\system32\svchost.exe 3576
C:\Windows\System32\svchost.exe 3612
C:\Windows\system32\SearchIndexer.exe 3640
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 3852
C:\Windows\system32\WUDFHost.exe 3860
C:\Windows\system32\wbem\unsecapp.exe 3884
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 3976
C:\Windows\system32\wbem\wmiprvse.exe 4012
C:\Windows\servicing\TrustedInstaller.exe 4052
C:\Windows\system32unonce.exe 2852
C:\Windows\system32\conime.exe 2980
C:\Windows\system32\wbem\wmiprvse.exe 2444

################## | Elements infectieux |

Supprimé ! C:\$Recycle.Bin\S-1-5-21-2935786315-453686088-2412967987-1000 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2935786315-453686088-2412967987-1000 

################## | Registre |


################## | Mountpoints2 |


################## | Listing des fichiers présent |

[29/01/2010 20:12|--a------|4028] C:\aaw7boot.log 
[12/03/2009 03:11|--a------|23] C:\app3.LOG 
[18/09/2006 22:43|--a------|24] C:\autoexec.bat 
[21/01/2008 03:24|-rahs----|333203] C:\bootmgr 
[16/04/2008 12:27|-ra-s----|8192] C:\BOOTSECT.BAK 
[04/04/2007 20:01|--a------|19] C:\CA21.txt 
[18/09/2006 22:43|--a------|10] C:\config.sys 
[16/04/2009 22:46|--a------|13235] C:\devlist.txt 
[23/03/2009 09:12|--a------|13] C:\F70SG_F70SV_N70SV_VISTA.10 
[19/03/2009 10:11|-rah-----|1048576] C:\F70SV.BIN 
[16/04/2009 22:46|--a------|9] C:\Finish.log 
[?|?|?] C:\hiberfil.sys 
[16/04/2009 22:10|--a------|481] C:\igoogle_log.txt 
[16/04/2009 22:36|--a------|19922944] C:\inject.log 
[16/04/2009 22:36|--a------|17404208] C:\inject.log.txt 
[29/08/2009 01:06|-rahs----|0] C:\IO.SYS 
[29/08/2009 01:06|-rahs----|0] C:\MSDOS.SYS 
[08/08/2008 08:22|--a------|30] C:\NERO.LOG 
[07/01/2009 10:16|--a------|30] C:\NIS2009.TXT 
[16/03/2007 00:18|--a------|25] C:\OFFICE2007_A.TXT 
[29/02/2004 16:44|--a------|52576] C:\orange.bmp 
[?|?|?] C:\pagefile.sys 
[16/04/2009 09:55|--a------|105] C:\Pass.txt 
[23/02/2009 03:38|--a------|3188] C:\Patch.LOG 
[29/04/2008 15:30|--a------|20] C:\READER_A.TXT 
[23/03/2009 09:12|--a------|21] C:\RECOVERY.DAT 
[16/04/2009 22:30|--a------|2355] C:\RHDSetup.log 
[23/07/2009 10:06|--a------|163] C:\setup.log 
[16/04/2009 22:28|--a------|86] C:\sis19x.log 
[16/05/2006 01:22|--a------|5] C:\store.log 
[16/04/2009 21:48|--a------|166] C:\SumHidd.txt 
[16/04/2009 21:47|--a------|98] C:\SumOS.txt 
[29/01/2010 20:24|--a------|5968] C:\UsbFix.txt 
[12/02/2009 19:24|--a------|25] C:\V554.txt 
[09/02/2009 06:30|--a------|41] C:\WindowsLive_A.TXT 
[19/01/2010 11:09|--a------|9720230] D:\95.psd 
[17/01/2010 22:20|--a------|10342] D:\Dormez tranquilles citoyens.docx 
[22/01/2010 14:57|--a------|19883228] D:\fenˆtre.psd 
[29/12/2009 15:32|--a------|0] D:\~WRA0001.wbk 
[26/01/2010 16:27|--ah-----|4096] H:\._.Trashes 

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix.  
# D:\autorun.inf -> Dossier créé par UsbFix.  
# H:\autorun.inf -> Dossier créé par UsbFix.  

################## | Upload |

Utilisateur anonyme · Answer

Télécharge Combofix : 
http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

et suis ce tutoriel : 
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Kbalex · Answer

j'ai fait la manipulation avec ComboFix, donc toujours la même chose,

Son rapport est:

ComboFix 10-01-29.04 - Alexandre 29/01/2010 22:53:58.2.2 - x86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3071.2094 [GMT 1:00]
Lancé depuis: c:\users\Alexandre\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
PEV Error: ProgramsFolder

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\temp
c:\users\Alexandre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.lnk
c:\windows\Fonts\MyriadPro-Regular.otf
c:\windows\system32\sqlite3.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-12-28 au 2010-01-29 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans ce laps de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-29 21:50 . 2009-04-16 21:44 45056 ----a-w- c:\windows\system32\acovcnt.exe
2010-01-29 20:24 . 2010-01-29 20:24 -------- d-----w- c:\users\Alexandre\AppData\Roaming\Malwarebytes
2010-01-29 20:23 . 2010-01-29 20:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-29 20:23 . 2010-01-29 20:23 -------- d-----w- c:\programdata\Malwarebytes
2010-01-28 22:22 . 2009-10-17 08:05 -------- d-----w- c:\users\Alexandre\AppData\Roaming\IM
2010-01-28 22:16 . 2010-01-27 19:11 -------- d-----w- c:\program files\AGEIA Technologies
2010-01-28 21:47 . 2009-10-17 16:00 -------- d-----w- c:\programdata\DassaultSystemes
2010-01-28 20:21 . 2010-01-28 20:21 -------- d-----w- c:\users\Alexandre\AppData\Roaming\SolidWorks 2008
2010-01-28 20:18 . 2009-10-17 08:37 -------- d-----w- c:\users\Alexandre\AppData\Roaming\SolidWorks
2010-01-28 20:17 . 2009-07-22 18:52 -------- d-----w- c:\users\Alexandre\AppData\Roaming\uTorrent
2010-01-28 20:13 . 2010-01-28 19:53 -------- d-----w- c:\program files\SolidWorks (2)
2010-01-28 20:06 . 2009-07-29 15:45 -------- d-----w- c:\program files\Common Files\SolidWorks Shared
2010-01-28 20:05 . 2010-01-27 18:34 -------- d-----w- c:\program files\DWGeditor
2010-01-28 20:03 . 2010-01-28 19:53 -------- d-----w- c:\program files\Common Files\eDrawings2008
2010-01-28 19:53 . 2009-10-17 08:12 -------- d-----w- c:\programdata\SolidWorks
2010-01-28 19:51 . 2009-04-16 21:06 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-28 19:33 . 2009-10-17 08:05 -------- d-----w- c:\program files\Common Files\Gestionnaire d'installation SolidWorks
2010-01-27 21:47 . 2010-01-27 21:47 -------- d-----w- c:\program files\Safari
2010-01-27 21:01 . 2009-07-22 19:54 80537 ----a-w- c:\programdata\nvModes.dat
2010-01-27 20:00 . 2009-07-22 13:22 146984 ----a-w- c:\users\Alexandre\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-27 19:11 . 2009-12-17 12:05 -------- d-----w- c:\program files\SolidWorks Corp
2010-01-27 18:59 . 2009-07-29 15:45 -------- d-----w- c:\program files\SolidWorks
2010-01-27 18:57 . 2010-01-27 18:30 -------- d-----w- c:\program files\Common Files\eDrawings2007
2010-01-27 18:33 . 2010-01-27 18:33 61440 ----a-r- c:\users\Alexandre\AppData\Roaming\Microsoft\Installer\{26621E14-A45B-45CD-9ED9-7A0A9B585DB4}\NewShortcut1_3668F00AED454A6E8105AD5B99FD99C6.exe
2010-01-27 18:33 . 2010-01-27 18:33 61440 ----a-r- c:\users\Alexandre\AppData\Roaming\Microsoft\Installer\{26621E14-A45B-45CD-9ED9-7A0A9B585DB4}\ARPPRODUCTICON.exe
2010-01-27 18:33 . 2009-07-29 15:53 -------- d-----w- c:\program files\SolidWorks Installation Manager
2010-01-27 15:50 . 2010-01-26 21:49 862040 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-01-27 15:50 . 2010-01-26 21:44 1181328 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-27 10:00 . 2010-01-27 00:56 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-01-27 10:00 . 2010-01-26 21:49 15880 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-01-27 10:00 . 2010-01-26 21:49 206944 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-01-27 10:00 . 2010-01-26 21:49 390288 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-01-27 10:00 . 2010-01-26 21:48 537576 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-01-27 10:00 . 2010-01-26 21:48 389272 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-01-27 09:59 . 2010-01-26 21:48 163728 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-01-27 09:59 . 2010-01-26 21:48 8 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2010-01-27 09:59 . 2010-01-26 21:46 6296864 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Resources.dll
2010-01-27 09:58 . 2010-01-26 21:46 327000 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-01-27 09:57 . 2010-01-26 21:46 87496 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-01-27 09:57 . 2010-01-26 21:46 933120 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-01-27 09:57 . 2010-01-26 21:46 3803208 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-01-27 09:55 . 2010-01-26 21:45 816784 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-01-27 09:55 . 2010-01-26 21:44 823928 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-01-27 09:54 . 2010-01-26 21:44 1643272 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-01-27 09:53 . 2010-01-26 21:44 788880 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-01-27 06:52 . 2010-01-27 06:51 -------- d-----w- c:\program files\trend micro
2010-01-26 21:54 . 2009-04-16 21:09 -------- d-----w- c:\program files\Google
2010-01-26 21:49 . 2010-01-26 21:40 -------- d-----w- c:\programdata\Lavasoft
2010-01-26 21:41 . 2010-01-26 21:41 -------- dc-h--w- c:\programdata\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2010-01-26 21:40 . 2010-01-26 21:40 -------- d-----w- c:\program files\Lavasoft
2010-01-26 21:34 . 2009-04-16 21:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-26 21:30 . 2009-07-22 13:29 -------- d-----w- c:\program files\Windows Live
2010-01-26 20:21 . 2010-01-26 20:11 -------- d-----w- c:\programdata\Comodo
2010-01-26 20:10 . 2010-01-26 20:10 -------- d-----w- c:\program files\COMODO
2010-01-26 20:10 . 2010-01-26 20:10 74328 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-01-26 20:10 . 2010-01-26 20:10 29520 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-01-26 20:10 . 2010-01-26 20:10 171552 ----a-w- c:\windows\system32\guard32.dll
2010-01-26 20:10 . 2010-01-26 20:10 128376 ----a-w- c:\windows\system32\drivers\cmdguard.sys
2010-01-26 07:08 . 2008-04-16 11:16 669566 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-26 07:08 . 2008-04-16 11:16 123556 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-21 19:54 . 2010-01-21 19:54 680 ----a-w- c:\users\Alexandre\AppData\Local\d3d9caps.dat
2010-01-19 11:26 . 2010-01-19 11:26 1924744 ----a-w- c:\users\Alexandre\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2010-01-14 10:12 . 2009-10-04 00:17 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-08 18:33 . 2009-04-16 21:26 -------- d-----w- c:\program files\ASUS
2010-01-07 15:07 . 2010-01-29 20:23 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2010-01-29 20:23 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 17:35 . 2010-01-04 17:35 -------- d-----w- c:\program files\Pvm
2009-12-28 19:01 . 2009-10-07 20:13 -------- d-----w- c:\users\Alexandre\AppData\Roaming\vlc
2009-12-24 00:16 . 2009-12-24 00:16 653560 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-21 12:54 . 2009-09-20 13:02 -------- d-----w- c:\users\Alexandre\AppData\Roaming\dvdcss
2009-12-18 15:16 . 2009-07-22 13:25 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-18 15:11 . 2009-12-18 15:11 -------- d-----w- c:\programdata\ALM
2009-12-18 14:49 . 2009-12-18 14:49 -------- d-----w- c:\program files\Adobe Media Player
2009-12-18 14:48 . 2009-12-18 14:48 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-11-05 20:16 . 2009-11-05 20:16 73728 ----a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2008-12-23 20:36 . 2008-12-23 20:36 106496 ----a-w- c:\program files\Common Files\CPInstallAction.dll
2008-05-22 15:35 . 2008-05-22 15:35 51962 ----a-w- c:\program files\Common Files\banner.jpg
2007-06-12 16:34 . 2007-06-12 16:34 35822 ----a-w- c:\program files\Common Files\ASPG_icon.ico
2009-04-16 21:05 . 2009-04-16 21:05 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08 143360 ----a-w- c:\program files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2005-09-25 94208]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]
"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2008-09-03 8105984]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-12-29 159744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-16 13605408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-16 92704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-02-11 6711840]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2008-04-01 266240]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-10-01 851968]
"ASUS Screen Saver Protector"="c:\windows\AsScrPro.exe" [2009-04-16 3054136]
"ASUS Camera ScreenSaver"="c:\windows\AsScrProlog.exe" [2009-04-16 47672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-08-05 647520]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2005-09-25 155648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"SolidWorks_CheckForUpdates"="c:\program files\Common Files\Gestionnaire d'installation SolidWorks\Scheduler\sldIMScheduler.exe" [2008-09-15 7218472]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-01-26 1800464]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

c:\users\Alexandre\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Moteur du Planificateur de tƒches SolidWorks.lnk - c:\program files\SolidWorks (2)\SolidWorks\swScheduler\swBOEngine.exe [2007-9-9 488728]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FancyStart daemon.lnk - c:\windows\Installer\{F9F20920-313D-4D6F-866B-2737B77E1857}\_DC60F4E342E06843E7FCD0.exe [2009-4-16 12862]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [26/01/2010 22:49 64288]
R0 lullaby;lullaby;c:\windows\System32\drivers\lullaby.sys [16/04/2009 22:36 15416]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [22/07/2009 17:19 114768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\System32\drivers\cmdguard.sys [26/01/2010 21:10 128376]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\System32\drivers\cmdhlp.sys [26/01/2010 21:10 29520]
R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [06/09/2009 05:06 169312]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [22/07/2009 17:19 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [22/07/2009 17:19 51792]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 12:17 1181328]
R2 Remote Solver for COSMOSFloWorks 2007;Remote Solver for COSMOSFloWorks 2007;c:\program files\SolidWorks (2)\COSMOSFloWorks\FloWorks\binCFW\StandAloneSlv.exe [23/07/2007 09:05 675840]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\System32\drivers\SiSGB6.sys [02/05/2008 09:07 48128]
R3 SRS_PremiumSound_Service;SRS Labs Premium Sound;c:\windows\System32\drivers\SRS_PremiumSound_i386.sys [16/04/2009 22:30 230952]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [23/07/2009 10:22 721904]
S2 gupdate1ca2fdae7c5582a;Service Google Update (gupdate1ca2fdae7c5582a);c:\program files\Google\Update\GoogleUpdate.exe [07/09/2009 17:47 133104]
S2 Norton Internet Security;Norton Internet Security;"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1 --> c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [?]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 05:46 284016]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [03/10/2009 10:55 54632]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [23/09/2005 06:01 2799808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'

2010-01-29 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:55]

2010-01-29 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:55]

2010-01-29 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:55]

2010-01-29 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:55]

2010-01-29 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 09:55]

2010-01-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-07 16:46]

2010-01-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-07 16:46]

2010-01-28 c:\windows\Tasks\NeroLiveEpgUpdate-PC-de-Alexandre_Alexandre.job
- c:\program files\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 11:51]

2009-08-25 c:\windows\Tasks\NSSstub.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2009-08-24 14:08]

2010-01-29 c:\windows\Tasks\User_Feed_Synchronization-{C7BEA652-79CA-4B50-A8EC-17DE8EC7119C}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Examen supplémentaire -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convertir au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Alexandre\AppData\Roaming\Mozilla\Firefox\Profiles\rpimz2aj.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ig?brand=ASUS&bmod=ASUS
FF - prefs.js: keyword.URL - hxxp://www.searcheo.fr/recherche?search&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-Livestation - c:\program files\Livestation\Livestation.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-29 23:09
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

c:\users\ALEXAN~1\AppData\Local\Temp\catchme.dll 53248 bytes executable
C:\ADSM_PData_0150

Scan terminé avec succès
Fichiers cachés: 2

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x8598C856]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x82fa1322
\Driver\ACPI -> acpi.sys @ 0x8069dd4c
\Driver\atapi -> ataport.SYS @ 0x807b99a8
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2935786315-453686088-2412967987-1000\Software\SecuROM\License information*]
"datasecu"=hex:cb,19,0e,db,a8,1a,be,ed,ed,c9,47,53,27,e4,ed,b4,26,37,ff,c6,92,
8a,62,c0,fd,42,cb,e2,92,da,b2,1f,e1,7c,3b,89,08,da,1d,8b,1c,51,0b,18,e2,8a,\
"rkeysecu"=hex:16,a2,19,11,ff,e7,88,49,08,fb,04,f0,04,71,a3,53
.
Heure de fin: 2010-01-29 23:15:56
ComboFix-quarantined-files.txt 2010-01-29 22:15

Avant-CF: 43 645 722 624 octets libres
Après-CF: 43 649 785 856 octets libres

- - End Of File - - 0EA716DA873054F19189B3F9023F0F07

Désoler pour mon problème ! ^^

Utilisateur anonyme · Answer

Tu peux me dire ce que detecte avast ( quel fichier ) ..

Kbalex · Answer

Donc Avast me détecte toute les 15 minutes environ:

C:\windows\Temp\ysfb.tmp\svchost.exe

Win32:Small-CHC [Trj]

Utilisateur anonyme · Answer

OK , met malewarebyte's a jours et refais un scan rapide stp .

Kbalex · Answer

Il n'y a aucuns éléments nuisible détecté avec Malewarebyte's,

Utilisateur anonyme · Answer

Dans ce cas lance un scan avec avast .

Kbalex · Answer

De même, il y a aucun virus détecté dans le scan d'Avast,

Utilisateur anonyme · Answer

rend toi à ce dossier : C:\Windows	emp et vide son contenu .

• Télécharge ToolsCleaner2 sur ton Bureau. 
• Clique droit sur ToolsCleaner2.exe et choisis Exécuter en tant qu'administrateur. 
• Clique sur Recherche et laisse le scan agir. 
• Clique sur Suppression pour finaliser. 
• Tu peux, si tu le souhaites, te servir des Options Facultatives. 
• Clique sur Quitter pour obtenir le rapport. 
• Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).


#############


*Désactive ta restauration : 
Clique droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK 
---> Redémarre ton PC ... 

*Réactive ta restauration : 
Clique droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK 
--->Redémarre ton PC ... 

( Note : tu peux aussi y accéder via panneau de configuration->" système "->" restauration système " ). 

Tuto : https://forum.pcastuces.com/desactiver_la_restauration_systeme-f31s7.htm

Ensuite dis moi si t as encore des alertes .

Kbalex · Answer

Est-il normal que Toolscleaner bug ?  Le programme ne répond plus en début de de recherche !

Utilisateur anonyme · Answer

ça arrive parfois ... 

Tu vas devoir supprimer les outils que je t ai fais télécharger à la main ..

Kbalex · Answer

Euh oui, la je viens de supprimer les outils dans (C:) et faut il allé voir autre part dans les programmes files etc... car sa bug toujours ?

Utilisateur anonyme · Answer

car sa bug toujours ?

Tu parles de toolcleaner je suppose ? si oui vire le .

Va dans panneau de configuration , ajout et suppression et désinstal hijackthis .

Supprime :

C:\Rsit 
C:\Qoobox
C:\Combofix 
C:\UsbFix 

et les exécutable que je  t ai fais télécharger .

plus d alerte d avast sinon ?

Kbalex · Answer

Oui toolcleaner bug, et j'ai toujours les alertes d'avast.

Utilisateur anonyme · Answer

Refais un scan RSIT et post log.txt stp

On finira ce soir car je dois bouger , à tout a l heure .

Kbalex · Answer

Voila le rapport:  a tout a l'heure,


ogfile of random's system information tool 1.06 (written by random/random)
Run by Alexandre at 2010-01-30 15:23:52
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 42 GB (27%) free of 153 GB
Total RAM: 3071 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:24:41, on 30/01/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program files\P4G\BatteryLife.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\System32undll32.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SolidWorks (2)\SolidWorks\swScheduler\swBOEngine.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\ALEXAN~1\AppData\Local\Temp\SolidWorksLicTemp.0001
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Alexandre\Desktop\RSIT.exe
C:\Program Files	rend micro\Alexandre.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [SolidWorks_CheckForUpdates] "C:\Program Files\Common Files\Gestionnaire d'installation SolidWorks\Scheduler\sldIMScheduler.exe" /scheduler
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'Default user')
O4 - Startup: Moteur du Planificateur de tâches SolidWorks.lnk = C:\Program Files\SolidWorks (2)\SolidWorks\swScheduler\swBOEngine.exe
O4 - Global Startup: FancyStart daemon.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service Google Update (gupdate1ca2fdae7c5582a) (gupdate1ca2fdae7c5582a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Norton Internet Security - Unknown owner - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: Remote Solver for COSMOSFloWorks 2007 - Unknown owner - C:\Program Files\SolidWorks (2)\COSMOSFloWorks\FloWorks\binCFW\StandAloneSlv.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

Utilisateur anonyme · Answer

Re ,

En fait je devais aller courrir avec un pote mais on ira ce soir .

Envoi ce fichier : C:\Windows\AsScrPro.exe 

ici : https://www.virustotal.com/gui/

post le rapport généré stp .

Kbalex · Answer

Moi aussi je voulais allé courir, mais tout seul c'est chiant a force ^^, 

Voici le rapport: 

File size: 3054136 bytes
MD5   : 2b2f678cc761afc91e4085a519b33d75
SHA1  : 2bcc66a5c825a90d09e44bcb77c6f97b01634fa8
SHA256: fbfcb69f66c54a82ef29ae2f376eed58bccb095b089efd8420032449fe3b41af
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2FB0
timedatestamp.....: 0x4832D278 (Tue May 20 15:30:32 2008)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2252 0x3000 4.93 b015c64f27d00bf11d2d2e4d3040f687
.rdata 0x4000 0xC72 0x1000 4.32 c3ac7f51f6c8e5f567c7d39f3b1ba8b6
.data 0x5000 0xD68 0x1000 4.60 b885ee1c2e761902a16f7bdff0d7383c
.rsrc 0x6000 0x2E1F58 0x2E2000 6.82 f763271be92e68b81e1099c15f377e6e

( 7 imports )

> kernel32.dll: SetEvent, GetStartupInfoA, GetModuleHandleA, CreateProcessA, FindFirstFileA, SetFileAttributesA, DeleteFileA, CompareFileTime, GetLastError, CreateEventA, GetSystemPowerStatus, FormatMessageA, OutputDebugStringA, Sleep, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, FindClose, FindNextFileA, CloseHandle
> mfc42.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> msvcrt.dll: _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, _onexit, __dllonexit, atoi, sprintf, __CxxFrameHandler, _mbsupr, _mbsstr, _mbstok, _mbsicmp, _setmbcp
> powrprof.dll: IsPwrSuspendAllowed, IsPwrHibernateAllowed, SetSuspendState, GetCurrentPowerPolicies
> shell32.dll: SHGetSpecialFolderPathA, SHCreateDirectoryExA
> user32.dll: FindWindowExA, wsprintfA, DispatchMessageA, TranslateMessage, GetMessageA, SetTimer, UpdateWindow, ShowWindow, CreateWindowExA, RegisterClassA, PostMessageA, LoadIconA, DefWindowProcA, PostQuitMessage, SystemParametersInfoA, keybd_event, mouse_event, SendMessageA, DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, LoadCursorA
> version.dll: GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

( 0 exports )
TrID  : File type identification
DirectShow filter (43.0%)
Windows OCX File (26.3%)
Win64 Executable Generic (18.2%)
Win32 Executable MS Visual C++ (generic) (8.0%)
Win32 Executable Generic (1.8%)
ssdeep: 49152:v8CC1JS6n1kypaSNOda/z4FvB015y5S2kQjNQvT4eKfSh5zuSevTTJR02wQ:kZ1E6n1kyTn/zSvF55kGxSeRN
PEiD  : Armadillo v1.71
RDS   : NSRL Reference Data Set
-

Utilisateur anonyme · Answer

C est clair , à 2 c est mieux .

C est le début du rapport qu il me faut ^^

Kbalex · Answer

Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.41 	2009.11.21 	-
AhnLab-V3 	5.0.0.2 	2009.11.20 	-
AntiVir 	7.9.1.72 	2009.11.20 	-
Antiy-AVL 	2.0.3.7 	2009.11.20 	-
Authentium 	5.2.0.5 	2009.11.20 	-
Avast 	4.8.1351.0 	2009.11.20 	-
AVG 	8.5.0.425 	2009.11.20 	-
BitDefender 	7.2 	2009.11.21 	-
CAT-QuickHeal 	10.00 	2009.11.20 	-
ClamAV 	0.94.1 	2009.11.21 	-
Comodo 	2983 	2009.11.19 	-
DrWeb 	5.0.0.12182 	2009.11.20 	-
eSafe 	7.0.17.0 	2009.11.19 	-
eTrust-Vet 	None 	2009.11.20 	-
F-Prot 	4.5.1.85 	2009.11.20 	-
F-Secure 	9.0.15370.0 	2009.11.20 	-
Fortinet 	3.120.0.0 	2009.11.21 	-
GData 	19 	2009.11.21 	-
Ikarus 	T3.1.1.74.0 	2009.11.21 	-
Jiangmin 	11.0.800 	2009.11.21 	-
K7AntiVirus 	7.10.901 	2009.11.20 	-
Kaspersky 	7.0.0.125 	2009.11.21 	-
McAfee 	5808 	2009.11.20 	-
McAfee+Artemis 	5808 	2009.11.20 	-
McAfee-GW-Edition 	6.8.5 	2009.11.20 	-
Microsoft 	1.5302 	2009.11.21 	-
NOD32 	4626 	2009.11.21 	-
Norman 	6.03.02 	2009.11.21 	-
nProtect 	2009.1.8.0 	2009.11.21 	-
Panda 	10.0.2.2 	2009.11.20 	-
PCTools 	7.0.3.5 	2009.11.21 	-
Prevx 	3.0 	2009.11.21 	-
Rising 	22.22.05.04 	2009.11.21 	-
Sophos 	4.47.0 	2009.11.21 	-
Sunbelt 	3.2.1858.2 	2009.11.21 	-
Symantec 	1.4.4.12 	2009.11.21 	-
TheHacker 	6.5.0.2.075 	2009.11.20 	-
TrendMicro 	9.0.0.1003 	2009.11.21 	-
VBA32 	3.12.12.0 	2009.11.20 	-
ViRobot 	2009.11.20.2047 	2009.11.20 	-
VirusBuster 	5.0.21.0 	2009.11.20 	-

Utilisateur anonyme · Answer

Rend toi à ce fichier : C:\Program Files	rend micro\Alexandre.exe , c est hijackthis renomé.

Fais un clic droit dessus et choisis executer en tant qu administrateur .

Ensuite chosis Do a system Scan only .

Dans la liste coches ces lignes :


O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org
O1 - Hosts: 91.121.221.171 thepiratebay.org
O1 - Hosts: 91.121.221.171 www.thepiratebay.org

tu les coches et tu clic sur fix checked .

########

• Télécharge OTM (OldTimer) sur ton Bureau. 
• Clique droit sur OTM.exe et choisis Exécuter en tant qu'administrateur. 
• Copie (Ctrl+C) le texte suivant ci-dessous : 



:processes 
explorer.exe 

:services
InCDPass
InCDRm
SRTSP
SRTSPX
af3jwx79
catchme
ipswuio
NAVENG
InCDFs
Norton Internet Security

:files
C:\Program Files\Norton Internet Security
C:\ProgramData\Norton
C:\Windows\SWXCACLS.exe 
C:\Windows\NIRCMD.exe 
C:\Windows\MBR.exe 
C:\Windows\zip.exe 
C:\Windows\SWSC.exe 
C:\Windows\SWREG.exe 
C:\Windows\sed.exe 
C:\Windows\PEV.exe 
C:\Windows\grep.exe 
C:\Windows\ERDNT 

:reg 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] 
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] 

:commands 
[purity] 
[emptytemp] 
[reboot]



• Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 
• Clique maintenant sur le bouton MoveIt! puis ferme OTM. 

---> Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 


• Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 
---> Le nom du rapport correspond au moment de sa création : date_heure.log

Kbalex · Answer

Voila le rapport, 



ll processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
Error: No service named InCDPass was found to stop!
Unable to stop service InCDPass!
Error: No service named InCDRm was found to stop!
Unable to stop service InCDRm!
Error: No service named SRTSP was found to stop!
Unable to stop service SRTSP!
Error: No service named SRTSPX was found to stop!
Unable to stop service SRTSPX!
Error: No service named af3jwx79 was found to stop!
Unable to stop service af3jwx79!
Error: No service named catchme was found to stop!
Unable to stop service catchme!
Error: No service named ipswuio was found to stop!
Unable to stop service ipswuio!
Error: No service named NAVENG was found to stop!
Unable to stop service NAVENG!
Error: No service named InCDFs was found to stop!
Unable to stop service InCDFs!
Error: No service named Norton Internet Security was found to stop!
Unable to stop service Norton Internet Security!
========== FILES ==========
File/Folder C:\Program Files\Norton Internet Security not found.
File/Folder C:\ProgramData\Norton not found.
File/Folder C:\Windows\SWXCACLS.exe not found.
File/Folder C:\Windows\NIRCMD.exe not found.
File/Folder C:\Windows\MBR.exe not found.
File/Folder C:\Windows\zip.exe not found.
File/Folder C:\Windows\SWSC.exe not found.
File/Folder C:\Windows\SWREG.exe not found.
File/Folder C:\Windows\sed.exe not found.
File/Folder C:\Windows\PEV.exe not found.
File/Folder C:\Windows\grep.exe not found.
File/Folder C:\Windows\ERDNT not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Explorer\ShellExecuteHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Alexandre
->Temp folder emptied: 1006702 bytes
->Temporary Internet Files folder emptied: 4374203 bytes
->FireFox cache emptied: 32275838 bytes
->Apple Safari cache emptied: 10687704 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 39768 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 406766 bytes
RecycleBin emptied: 1623149141 bytes
 
Total Files Cleaned = 1 594,00 mb
 
 
OTM by OldTimer - Version 3.1.7.0 log created on 01302010_164758

Files moved on Reboot...
File move failed. C:\Windows	emp\_avast4_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Utilisateur anonyme · Answer

T as fait deux fois le scan ?

remet un nouveau rapport rsit ( log.txt ) 

toujours des soucis ?

Cette fois ci , je vais courrir J en ai pour 2H environ .

@ + tard .

Kbalex · Answer

Oui toujours des soucis, et je vais courir aussi. 

voila le rapport de RSIT: 


Logfile of random's system information tool 1.06 (written by random/random)
Run by Alexandre at 2010-01-30 16:59:52
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 43 GB (28%) free of 153 GB
Total RAM: 3071 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:00:00, on 30/01/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program files\P4G\BatteryLife.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\ASUS\Net4Switch\Net4Switch.exe
C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\System32undll32.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\AsScrPro.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SolidWorks (2)\SolidWorks\swScheduler\swBOEngine.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\ALEXAN~1\AppData\Local\Temp\SolidWorksLicTemp.0001
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Alexandre\Desktop\RSIT.exe
C:\Program Files	rend micro\Alexandre.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [SolidWorks_CheckForUpdates] "C:\Program Files\Common Files\Gestionnaire d'installation SolidWorks\Scheduler\sldIMScheduler.exe" /scheduler
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'Default user')
O4 - Startup: Moteur du Planificateur de tâches SolidWorks.lnk = C:\Program Files\SolidWorks (2)\SolidWorks\swScheduler\swBOEngine.exe
O4 - Global Startup: FancyStart daemon.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Ajouter à un fichier PDF existant - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service Google Update (gupdate1ca2fdae7c5582a) (gupdate1ca2fdae7c5582a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: Remote Solver for COSMOSFloWorks 2007 - Unknown owner - C:\Program Files\SolidWorks (2)\COSMOSFloWorks\FloWorks\binCFW\StandAloneSlv.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe

Cheval de Troie impossible a supprimer,

30 réponses

Discussions similaires