iexplore.exe ouvre plusieurs fois Résolu

Question

Bonjour,

Le titre dit tout et ceci me cause de grave ralentissement voire même arrêt de mon PC. J'ai suivi des forums sur le sujet, mais le problème semble être du cas par cas. Donc voici mon HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:01:58, on 2010-02-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Program Files\play2p\play2p.exe
C:\WINDOWS\system32	askmgr.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\Michel\Bureau\HiJackThis.exe
C:\WINDOWS\system32\cmd.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.navigationplus.com/e404.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare\BearShareIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [winshost.exe] C:\WINDOWS\system32\winshost.exe
O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [BearSharePersonalization] "C:\Program Files\BearShare Applications\Personalization\BearSharePersonalization.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: play2p.lnk = C:\Program Files\play2p\play2p.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Jeux\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Jeux\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (Talisma NetAgent Customer ActiveX Control version 3) - https://intuitcanada.ehosts.net/netagent/objects/custappx3.cab
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 3D Viewer) - http://design-concept.ca/Core/Player/2020PlayerAX_Win32.cab
O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://qsindoc1.csst.qc.ca/iNotes6W.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04b8ba931923e51d0902/netzip/RdxIE601_fr.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://geo.ville.quebec.qc.ca/carte_int/acgm.cab
O18 - Protocol: intu-ir2007 - {52BAEC6B-9405-46F9-A131-6D50720A3CC4} - C:\Program Files\ImpotRapide\ImpotRapide 2007\ic2007pp.dll
O18 - Protocol: intu-ir2008 - {729D3592-92E7-4CBC-8E44-3C22B3F457B3} - C:\Program Files\ImpotRapide\ImpotRapide 2008\ic2008pp.dll
O18 - Protocol: intu-ir2009 - {E4616804-F2F8-4839-B728-5305004DA6A7} - C:\Program Files\ImpotRapide\ImpotRapide 2009\ic2009pp.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZONELABS\vsmon.exe

moment de grace · Answer

bonjour

• Téléchargez FindyKill sur le Bureau. 

http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe 

Mirroir : 

http://findykill.changelog.fr/Setup.exe 

• Double-cliquez sur FindyKill présent sur le Bureau. 

• Choisissez l'option 1 (Recherche). 

• Laissez travailler l'outil. 

• Ensuite postez le rapport FindyKill.txt qui apparaîtra (si vous avez créé un sujet sur un forum pour vous faire aider). 

• Note : Le rapport FindyKill.txt est sauvegardé à la racine du disque (C:\FindyKill.txt). 

(CTRL+A pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller) 

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 

• Tuto : http://pagesperso-orange.fr/NosTools/index.html

dédétraqué · Answer

Salut aimedjie


Bonne désinfection


@++ :)

moment de grace · Answer

merci lyonnais et bonjour

j'attendais que le drôle ai fini de poster partout pour demander une modération....


aimedjie,on reprends donc ici

https://forums.commentcamarche.net/forum/affich-16524444-iexplore-exe-ouvre-plusieurs-fois#1

aimedjie · Answer

############################## | FindyKill V5.034 |

# User : Michel (Administrateurs) # N-219A6ZIGBCH7V
# Update on 08/02/2010 by El Desaparecido
# Start at: 12:25:23 | 2010-02-11
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

#               Intel(R) Pentium(R) 4 CPU 2.40GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Disabled
# FW : ZoneAlarm Pro Firewall[ Enabled ]8.0.298.004

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 114,46 Go (32,22 Go free) # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\play2p\play2p.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\WgaTray.exe

################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\Prefetch |


################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Michel\Application Data |


################## | Zip File ... |


################## | Temporary Internet Files |


################## | Registre |


################## | Etat |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | ! Fin du rapport # FindyKill V5.034 ! |

aimedjie · Answer

############################## | FindyKill V5.034 |

# User : Michel (Administrateurs) # N-219A6ZIGBCH7V
# Update on 08/02/2010 by El Desaparecido
# Start at: 12:25:23 | 2010-02-11
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

#               Intel(R) Pentium(R) 4 CPU 2.40GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Disabled
# FW : ZoneAlarm Pro Firewall[ Enabled ]8.0.298.004

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 114,46 Go (32,22 Go free) # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\play2p\play2p.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\WgaTray.exe

################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\Prefetch |


################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Michel\Application Data |


################## | Zip File ... |


################## | Temporary Internet Files |


################## | Registre |


################## | Etat |

# Affichage des fichiers cachés : OK
 
# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | ! Fin du rapport # FindyKill V5.034 ! |

moment de grace · Answer

vu


! Déconnecte toi et ferme toutes application en cours (navigateur compris ) . 

• Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc... 

• Double clique sur setup.exe présent sur ton bureau pour lancer l’outil. 

• Au menu principal choisis l'option " F " pour français et tape sur [entrée] . 

• Au second menu choisis l'option 2 (suppression) et tape sur [entrée] 

• Le pc va redémarrer automatiquement ... 

&#9654; le programme va travailler, ne touche à rien ... , ton bureau ne sera pas accessible c est normal ! 

&#9658; Poste le rapport qui apparaît à la fin ( le rapport est sauvegardé aussi sous C:\FindyKill.txt) 

 Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide

………………………………………………………………

ensuite


• Télécharge Random's System Information Tool (RSIT) de Random/Random. 

(outil de diagnostic)

http://images.malwareremoval.com/random/RSIT.exe 

• Enregistre le sur ton Bureau. 

• Double clique sur RSIT.exe pour lancer l'outil. 

• Clique sur "Continue" à l'écran Disclaimer. 

• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) 

et tu devras accepter la licence. 

• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

Les rapports se trouvent à cet endroit: 
C:\rsit\info.txt 
C:\rsit\log.txt

aimedjie · Answer

############################## | FindyKill V5.034 |

# User : Michel (Administrateurs) # N-219A6ZIGBCH7V
# Update on 08/02/2010 by El Desaparecido
# Start at: 23:00:40 | 2010-02-11
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

#               Intel(R) Pentium(R) 4 CPU 2.40GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Disabled
# FW : ZoneAlarm Pro Firewall[ Enabled ]8.0.298.004

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 114,46 Go (32 Go free) # FAT32
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | C: |


################## | C:\WINDOWS |


################## | C:\WINDOWS\Prefetch |

Supprimé ! C:\WINDOWS\prefetch\WINUPGRO.EXE-2D513C93.pf  

################## | C:\WINDOWS\system32 |


################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Michel\Application Data |


################## | Autres suppressions ... |


################## | Zip File ... |

################## | Temporary Internet Files |


################## | Registre | 


################## | Etat |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 ) 
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 ) 
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 ) 
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 ) 
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 ) 

################## | PEH |


################## | Upload |

Veuillez envoyer le fichier : C:\FindyKill_Upload_Me_N-219A6ZIGBCH7V.zip : https://www.ionos.fr/?affiliate_id=77097 
Merci pour votre contribution .  

################## | ! Fin du rapport # FindyKill V5.034 ! |

aimedjie · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Michel at 2010-02-12 00:49:54
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 33 GB (28%) free of 117 GB
Total RAM: 511 MB (34% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:50:10, on 2010-02-12
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Program Files\play2p\play2p.exe
C:\Documents and Settings\Michel\Bureau\RSIT.exe
C:\Program Files\play2p\update.exe
C:\Documents and Settings\Michel\Bureau\Michel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.navigationplus.com/e404.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare\BearShareIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [winshost.exe] C:\WINDOWS\system32\winshost.exe
O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [BearSharePersonalization] "C:\Program Files\BearShare Applications\Personalization\BearSharePersonalization.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: play2p.lnk = C:\Program Files\play2p\play2p.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Jeux\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Jeux\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (Talisma NetAgent Customer ActiveX Control version 3) - https://intuitcanada.ehosts.net/netagent/objects/custappx3.cab
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 3D Viewer) - http://design-concept.ca/Core/Player/2020PlayerAX_Win32.cab
O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://qsindoc1.csst.qc.ca/iNotes6W.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04b8ba931923e51d0902/netzip/RdxIE601_fr.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://geo.ville.quebec.qc.ca/carte_int/acgm.cab
O18 - Protocol: intu-ir2007 - {52BAEC6B-9405-46F9-A131-6D50720A3CC4} - C:\Program Files\ImpotRapide\ImpotRapide 2007\ic2007pp.dll
O18 - Protocol: intu-ir2008 - {729D3592-92E7-4CBC-8E44-3C22B3F457B3} - C:\Program Files\ImpotRapide\ImpotRapide 2008\ic2008pp.dll
O18 - Protocol: intu-ir2009 - {E4616804-F2F8-4839-B728-5305004DA6A7} - C:\Program Files\ImpotRapide\ImpotRapide 2009\ic2009pp.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZONELABS\vsmon.exe

moment de grace · Answer

une infection bagle

supprimes le fichier qui ta provoqué ca (surement un  crack)

 Téléchargez MalwareByte's Anti-Malware

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
 
. Enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation. 
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen complet (examen assez long)
. Cliques sur Rechercher
. Le scan démarre. 
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés. 
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur  Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine. . Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse. 
. Rends toi dans l'onglet rapport/log 
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous 
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller 


Si tu as besoin d'aide regarde ces tutoriels : 
 Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
 http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

aimedjie · Answer

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3731
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2010-02-12 18:35:45
mbam-log-2010-02-12 (18-35-45).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|)
Eléments examinés: 257079
Temps écoulé: 41 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 17
Valeur(s) du Registre infectée(s): 4
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 7
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8fcdf9d9-a28b-480f-8c3d-581f119a8ab8} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{52fe5233-367c-4efb-bdd7-0be4d212c107} (Adware.Begin2Search) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{10e42047-deb9-4535-a118-b3f6ec39b807} (Adware.ISTBar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{42f2c9ba-614f-47c0-b3e3-ecfd34eed658} (Adware.ISTBar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1e5f0d38-214b-4085-ad2a-d2290e6a2d2c} (Adware.MediaAccess) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a21-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000010-6f7d-442c-93e3-4a4827c2e4c8} (Adware.NetOptimizer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ca356d79-679b-4b4c-8e49-5af97014f4c1} (Adware.Starware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a3fdd654-a057-4971-9844-4ed8e67dbbb8} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f919fbd3-a96b-4679-af26-f551439bb5fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{10e42047-deb9-4535-a118-b3f6ec39b807} (Adware.ISTBar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{37b85a2b-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt (Adware.NetOptimizer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt (Adware.NetOptimizer) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sp2 connection patcher (Trojan.Swizzor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winshost.exe (Trojan.Tooso) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\MyGlobalSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\28463 (Keylogger.Ardamax) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\1.bin\M9FFXTBR.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\1.bin\M9NTSTBR.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Cache\011AB097 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Cache\011ACFD7 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Cache\011AD18C.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Cache\011AD371.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Cache\011AD565.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Cache\011AD64F.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\28463\POLG.001 (Keylogger.Ardamax) -> Quarantined and deleted successfully.

moment de grace · Answer

tu peux vider la quarantaine

comment va le pc ?

Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection) 

&#9654; Télécharge et installe List&Kill'em et enregistre le sur ton bureau 
http://sd-1.archive-host.com/membres/up/829108531491024/List_Killem_Install.exe 

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation 

coche la case "creer une icone sur le bureau" 

une fois terminée , clic sur "terminer" et le programme se lancer seul 

choisis la langue puis choisis l'option 1 = Mode Recherche 

&#9654; laisse travailler l'outil 

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué. 

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini. 

&#9654; Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED" 

tu peux supprimer le rapport catchme.log de ton bureau maintenant.

aimedjie · Answer

List'em by g3n-h@ckm@n 1.2.5.0 User : Michel (Administrateurs) Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30 Start at: 18:04:12 | 2010-02-13 Contact : https://forums.commentcamarche.net/forum/virus-securite-7 Intel(R) Pentium(R) 4 CPU 2.40GHz Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3 Internet Explorer 8.0.6001.18702 Windows Firewall Status : Enabled AV : Kaspersky Anti-Virus 9.0.0.736 [ (!) Disabled | Updated ] A:\ -> Lecteur de disquettes 3 ½ pouces C:\ -> Disque fixe local | 114,46 Go (33,11 Go free) | FAT32 D:\ -> Disque CD-ROM E:\ -> Disque CD-ROM F:\ -> Disque CD-ROM ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\WINDOWS\System32 vsvc32.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\alg.exe C:\Program Files\List_Kill'em\List_Kill'em.scr C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Documents and Settings\Michel\Local Settings\Temp\8.tmp\pv.exe ====================== Keys "Run" ====================== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] MsnMsgr REG_SZ "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe swg REG_SZ "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" BearSharePersonalization REG_SZ "C:\Program Files\BearShare Applications\Personalization\BearSharePersonalization.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe Adobe Photo Downloader REG_SZ "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" Symantec PIF AlertEng REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe" Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" Adobe ARM REG_SZ "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" AVP REG_SZ "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] ===================== Other Keys ===================== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] dontdisplaylastusername REG_DWORD 0 (0x0) legalnoticecaption REG_SZ legalnoticetext REG_SZ shutdownwithoutlogon REG_DWORD 1 (0x1) undockwithoutlogon REG_DWORD 1 (0x1) =============== [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] NoDriveTypeAutoRun REG_DWORD 145 (0x91) =============== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] HonorAutoRunSetting REG_DWORD 1 (0x1) =============== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLS REG_SZ C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll =============== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] AutoRestartShell REG_DWORD 1 (0x1) DefaultDomainName REG_SZ N-219A6ZIGBCH7V DefaultUserName REG_SZ Michel LegalNoticeCaption REG_SZ LegalNoticeText REG_SZ PowerdownAfterShutdown REG_SZ 0 ReportBootOk REG_SZ 1 Shell REG_SZ Explorer.exe ShutdownWithoutLogon REG_SZ 0 System REG_SZ Userinit REG_SZ C:\WINDOWS\system32\userinit.exe, VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl" SfcQuota REG_DWORD -1 (0xffffffff) allocatecdroms REG_SZ 0 allocatedasd REG_SZ 0 allocatefloppies REG_SZ 0 cachedlogonscount REG_SZ 10 forceunlocklogon REG_DWORD 0 (0x0) passwordexpirywarning REG_DWORD 14 (0xe) scremoveoption REG_SZ 0 AllowMultipleTSSessions REG_DWORD 1 (0x1) UIHost REG_EXPAND_SZ logonui.exe LogonType REG_DWORD 1 (0x1) Background REG_SZ 0 0 0 DebugServerCommand REG_SZ no SFCDisable REG_DWORD 0 (0x0) WinStationsDisabled REG_SZ 0 HibernationPreviouslyEnabled REG_DWORD 1 (0x1) ShowLogonOptions REG_DWORD 0 (0x0) AltDefaultUserName REG_SZ Michel AltDefaultDomainName REG_SZ N-219A6ZIGBCH7V ChangePasswordUseKerberos REG_DWORD 1 (0x1) =============== [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\crypt32chain] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cryptnet] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cscdll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\dimsntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\klogon] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ScCertProp] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\Schedule] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\sclgntfy] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\SensLogn] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify ermsrv] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\WgaLogon] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\wlballoon] =============== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ =============== [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 C:\Program Files\WinMX\WinMX.exe REG_SZ C:\Program Files\WinMX\WinMX.exe:*:Disabled:WinMX Application C:\Program Files\Internet Explorer\iexplore.exe REG_SZ C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer C:\Program Files\Real\RealOne Player\REALPLAY.EXE REG_SZ C:\Program Files\Real\RealOne Player\REALPLAY.EXE:*:Enabled:RealOne Player C:\Program Files\mIRC\mirc.exe REG_SZ C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC C:\Program Files\Messenger\MSMSGS.EXE REG_SZ C:\Program Files\Messenger\MSMSGS.EXE:*:Enabled:Windows Messenger C:\Program Files\NetMeeting\conf.exe REG_SZ C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting® C:\Program Files\BearShare\BearShare.exe REG_SZ C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare C:\WINDOWS\System32\ZoneLabs\vsmon.exe REG_SZ C:\WINDOWS\System32\ZoneLabs\vsmon.exe:*:Disabled:TrueVector Service C:\Jeux\TruePoker\Client.exe REG_SZ C:\Jeux\TruePoker\Client.exe:*:Enabled:TruePoker Client Application C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes C:\Program Files\BitTorrent\bittorrent.exe REG_SZ C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent C:\Program Files\TruePoker\Client.exe REG_SZ C:\Program Files\TruePoker\Client.exe:*:Enabled:TruePoker Client Application %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\MSN Messenger\msnmsgr.exe REG_SZ C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 C:\Program Files\MSN Messenger\msnmsgr.exe REG_SZ C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5 =============== ActivX controls =============== HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\Microsoft XML Parser for Java HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{166B1BCA-3F9C-11CF-8075-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{17492023-C23A-453E-A040-C7C580BBF700} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1B9935E4-8A50-4DD8-BD09-A7518723BF97} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{1C11B948-582A-433F-A98D-A8C4D5CC64F2} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{3BFFE033-BF43-11D5-A271-00A024A51325} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{56336BCB-3D8A-11D6-A00B-0050DA18DE71} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{9522B3FB-7A2B-4646-8AF6-36E7F593073C} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{A796D216-2DE1-4EA8-BABB-FE6E7C959098} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{B38870E4-7ECB-40DA-8C6A-595F0A5519FF} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{EFD1E13D-1CB3-4545-B754-CA410FE7734F} HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} =============== HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{CB58DED6-4AF3-4080-9DF1-DEE72075169F} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{057997dd-71e4-43cc-b161-3f8180691a9e} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2298d453-bcae-4519-bf33-1cbf3faf1524} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2cc9d512-6db6-4f1c-8979-9a41fae88de0} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{377483c2-e4b4-4ee8-b577-9aed264c8735} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5f3c70b3-ac2f-432c-8f9c-1624df61f54f} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{72AD53CC-CCC0-3757-8480-9EE176866A7C} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{795d0712-722c-43ec-906a-fc5e678eada9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{96543d59-497a-4801-a1f3-5936aacaf7b1} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{eddbec60-89cb-44ef-8291-0850fd28ff6a} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f5173cf0-1dfb-4978-8e50-a90169ee7ca9} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F5776D81-AE53-4935-8E84-B0B283D8BCEF} HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{f5de1b93-9d38-416b-b09e-aa85a8e84309} ============== BHO : ====== [ REG_SZ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E33CF602-D945-461A-83F0-819F76A199F8}] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] ================ Internet Explorer : ================ [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] Start Page REG_SZ http://www.navigationplus.com/e404.php ======== Services ======== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] Ndisuio : 0x3 ( OK = 3 ) EapHost : 0x2 ( OK = 2 ) SharedAccess : 0x2 ( OK = 2 ) wuauserv : 0x2 ( OK = 2 ) ========= Atapi.sys ========= %%%% HASHDEEP-1.0 %%%% size,md5,sha256,filename ## Invoked from: C:\Documents and Settings\Michel\Local Settings\Temp\8.tmp ## C:\> hashdeep C:\WINDOWS\System32\Drivers\atapi.sys ## 96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\System32\Drivers\atapi.sys Sources ======= C:\WINDOWS\system32\drivers\atapi.sys C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys C:\WINDOWS\ServicePackFiles\i386\atapi.sys C:\WINDOWS\$NtServicePackUninstall$\atapi.sys Référence : ========== Win XP_32b : a64013e98426e1877cb653685c5c0009 Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51 Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674 Vista_32b : e03e8c99d15d0381e02743c36afc7c6f Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9 Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4 Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C ======= Drive : ======= D‚fragmenteur de disque Windows Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc. ¤¤¤¤¤¤¤¤¤¤ Files/folders : Present !! : C:\Documents and Settings\All Users\Application Data\.zreglib Present !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache Present !! : C:\Program Files\AltNet Present !! : C:\Program Files\INSTALL.LOG Present !! : C:\WINDOWS\002732_.tmp Present !! : C:\WINDOWS\003431_.tmp Present !! : C:\WINDOWS\System32\*_.dll Present !! : C:\WINDOWS\System32\dllcache\win32\csrss.exe Present !! : C:\WINDOWS\System32\dllcache\win32\winlogon.exe Present !! : C:\WINDOWS\System32 naph.dll Present !! : C:\WINDOWS\System32\SET*.tmp Present !! : C:\WINDOWS\winampa.ini Present !! : C:\WINDOWS\xobglu16.dll Present !! : C:\WINDOWS\xobglu32.dll Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\dw.log Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\1.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\4.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\5.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\6.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\1B.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\7.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\15.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\18.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\21.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\2C.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\2F.tmp Present !! : C:\Documents and Settings\Michel\Local Settings\Temp\30.tmp Present !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp\vsdrinst.exe Present !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp\Perflib_Perfdata_d98.dat Present !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp\inres6_fr.dll Present !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp\catchme.dll Present !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp mp7.tmp Present !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp mp1B.tmp ¤¤¤¤¤¤¤¤¤¤ Keys : Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383} Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe" Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe" Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d} Present !! : HKLM\SOFTWARE\MyWay ============ catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-13 19:13:59 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS kernel: MBR read successfully user & kernel MBR OK ========== Programs ========== Fichiers communs Windows NT MSN Gaming Zone MSN SmartDraw 7 Services en ligne WindowsUpdate ComPlus Applications Internet Explorer Outlook Express NetMeeting Windows Media Player Movie Maker microsoft frontpage xerox Uninstall Information CCH InstallShield Installation Information Intel Analog Devices Ahead CyberLink Lexmark X74-X75 FaxTools ABBYY FineReader 5.0 Sprint Adobe Nero INSTALL.LOG WinMX QuickTax Tracker Symantec Google DivX WIBUKEY Common Files BearShare Messenger WinRAR Microsoft Office Windows Messaging BitTorrent QuickTime setuplog.txt Real play2p TLC-Edusoft Winamp Mtrgic Internet Optimizer Canon iTunes iPod Malwarebytes' Anti-Malware EA SPORTS Winsim Java Saitek BearShare Applications Graphisoft MFInstall Windows Media Connect 2 Kaspersky Lab WIBU-SYSTEMS Altnet thriXXX AC3Filter mIRC Seagate Software MapInfo MapX Real Alternative Media Player Classic Virtual Earth 3D TruePoker Boonty ffdshow QuickTime Alternative BoontyGames Mes Jeux T‚l‚charg‚s SP2 Connection Patcher DT Max PokerStars.NET MSXML 4.0 MSN Messenger PokerStars Zone Labs DesignWorkshop Lite ImpotRapide ART Inc Intuit Canada Limited Reference Assemblies MSBuild docXConverter3 InstallJammer Registry xlsgen style reduction SlySoft DVD Shrink SopCast FLV Player PlayFLV List_Kill'em Brother's Keeper 6 Microsoft.NET OfficeUpdate11 Folder Comparison Taxprep ============ Drive C: ============ pagefile.sys WINDOWS ntldr rsit Bootfont.bin NTDETECT.COM boot.ini Documents and Settings Program Files CONFIG.SYS AUTOEXEC.BAT IO.SYS MSDOS.SYS System Volume Information HSF debug.ini Mes t‚l‚chargements XES4.tmp GS-SW WUTemp ADOBEAPP Temp Lop SD BK6 APPDIR lopR.txt Drivers spoolerlogs testwma.raw MSOCache FyK MSSoap hWaitEventRetryInstall DECCHECK divx.log video.pass finfos.txt Binaries FyK.txt FindyKill_Upload_Me_N-219A6ZIGBCH7V.zip c31fda2fcc7881beb42393f9 Kill'em List'em.txt Recycled WINDOWSdun.bat Jeux GRAVIS My Downloads ¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ End of scan : 19:21:29,75

moment de grace · Answer

&#9654; Relance List&Kill'em avec le raccourci sur ton bureau , 

mais cette fois-ci : 

&#9654; choisis l'option 2 = Mode Suppression 

laisse travailler l'outil. 

en fin de scan un rapport s'ouvre 

&#9654; colle le contenu dans ta reponse

Tu peux le désinstaller ensuite


.................

ensuite relances RSIT et postes le rapport log stp

aimedjie · Answer

Kill'em by g3n-h@ckm@n 1.2.5.0 
 
User : Michel (Administrateurs) 
Update on 08/02/2010 by g3n-h@ckm@n ::::: 15.30 
Start at: 21:08:01 | 2010-02-13
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

              Intel(R) Pentium(R) 4 CPU 2.40GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Enabled
AV : Kaspersky Anti-Virus 9.0.0.736 [ Enabled | Updated ]

A:\ -> Lecteur de disquettes 3 ½ pouces
C:\ -> Disque fixe local | 114,46 Go (32,97 Go free) | FAT32
D:\ -> Disque CD-ROM
E:\ -> Disque CD-ROM
F:\ -> Disque CD-ROM
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Michel\Local Settings\Temp\13.tmp\pv.exe
 
Detections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\.zreglib 
Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache 
Quarantined & Deleted !! : C:\Program Files\AltNet 
Quarantined & Deleted !! : C:\Program Files\INSTALL.LOG 
Quarantined & Deleted !! : C:\WINDOWS\002732_.tmp 
Quarantined & Deleted !! : C:\WINDOWS\003431_.tmp 
 
Quarantined & Deleted !! : C:\WINDOWS\System32\intain_.dll 
Quarantined & Deleted !! : C:\WINDOWS\System32\dllcache\win32\csrss.exe 
Quarantined & Deleted !! : C:\WINDOWS\System32\dllcache\win32\winlogon.exe 
Quarantined & Deleted !! : C:\WINDOWS\system32naph.dll 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET70.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET71.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET72.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET75.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET76.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET77.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET78.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET79.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET80.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET81.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET82.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET83.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET84.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET85.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET86.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET87.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET88.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET89.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET90.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET91.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET92.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET93.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET94.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET95.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET97.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET98.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET99.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\winampa.ini 
Quarantined & Deleted !! : C:\WINDOWS\xobglu16.dll 
Quarantined & Deleted !! : C:\WINDOWS\xobglu32.dll 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\dw.log 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\1.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\4.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\5.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\6.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\1B.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\7.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\15.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\18.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\21.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\2C.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\2F.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\Local Settings\Temp\30.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp\vsdrinst.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp\Perflib_Perfdata_d98.dat 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp\inres6_fr.dll 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp	mp7.tmp 
Quarantined & Deleted !! : C:\Documents and Settings\Michel\LOCAL Settings\Temp	mp1B.tmp 
 
==============
host file OK !
==============

========
Registry
========

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
Deleted : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}  
Deleted : HKLM\SOFTWARE\MyWay  
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Ip6Fw : Start = 2   
 SharedAccess : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

aimedjie · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Michel at 2010-02-14 00:15:04
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 34 GB (29%) free of 117 GB
Total RAM: 511 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:15:21, on 2010-02-14
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
C:\Documents and Settings\Michel\Bureau\RSIT.exe
C:\Documents and Settings\Michel\Bureau\Michel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.navigationplus.com/e404.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare\BearShareIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [BearSharePersonalization] "C:\Program Files\BearShare Applications\Personalization\BearSharePersonalization.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Jeux\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Jeux\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (Talisma NetAgent Customer ActiveX Control version 3) - https://intuitcanada.ehosts.net/netagent/objects/custappx3.cab
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 3D Viewer) - http://design-concept.ca/Core/Player/2020PlayerAX_Win32.cab
O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://qsindoc1.csst.qc.ca/iNotes6W.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04b8ba931923e51d0902/netzip/RdxIE601_fr.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - https://www.costcophotocentre.ca/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://geo.ville.quebec.qc.ca/carte_int/acgm.cab
O18 - Protocol: intu-ir2007 - {52BAEC6B-9405-46F9-A131-6D50720A3CC4} - C:\Program Files\ImpotRapide\ImpotRapide 2007\ic2007pp.dll
O18 - Protocol: intu-ir2008 - {729D3592-92E7-4CBC-8E44-3C22B3F457B3} - C:\Program Files\ImpotRapide\ImpotRapide 2008\ic2008pp.dll
O18 - Protocol: intu-ir2009 - {E4616804-F2F8-4839-B728-5305004DA6A7} - C:\Program Files\ImpotRapide\ImpotRapide 2009\ic2009pp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

aimedjie · Answer

Bonjour Moment de grâce,

Je te remercie beaucoup pour tout l'aide que tu me donnes, mais çaa ne fonctionne toujours pas. Mais cette fois, plutôt que d'être inscrit en lettres majuscules (IEXPLORE.EXE), le nom est inscrit en lettre minuscule (iexplore.exe).

J'ai lu sur un autre forum que l'installation d'une imprimante HP pouvait créer ce genre de problème. J'avais débuté l'installation d'une imprimante HP, mais je ne l'ai pas complétée et je ne trouve pas les fichiers qui auraient pu être installés et causer ce problème. Je ne sais pas si cette information peut être utile.

Merci beaucoup de m'aider.

moment de grace · Answer

ton dernier RSIT et les rapports killem montrent que ce n'est pas fini

tu étais bien infecté

deux choses

1)

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : C:\Jeux\TruePoker\Client.exe


Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers : 

Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK

...........................

2)

Télécharge ZHPDiag ( de&#61656; Nicolas coolman ). 
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html 

 Double clique sur le fichier d'installation, puis installe le avec les&#61656; paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )
 
Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin ( vista ) 

Clique sur la loupe&#61656; en haut à gauche, puis laisse l'outil scanner. 

Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau. 

Rend toi sur Cjoint :&#61656; http://www.cijoint.fr/ 

Clique sur "Parcourir " dans la partie " Joindre un fichier[...] " 

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau 

Clique ensuite sur "Créer le lien cjoint " et copie/colle le dans ton prochain message

aimedjie · Answer

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.50 2010.02.14 - 
AhnLab-V3 5.0.0.2 2010.02.13 - 
AntiVir 7.9.1.160 2010.02.12 - 
Antiy-AVL 2.0.3.7 2010.02.14 - 
Authentium 5.2.0.5 2010.02.13 - 
Avast 4.8.1351.0 2010.02.13 - 
AVG 9.0.0.730 2010.02.13 - 
BitDefender 7.2 2010.02.14 - 
CAT-QuickHeal 10.00 2010.02.13 - 
ClamAV 0.96.0.0-git 2010.02.13 - 
Comodo 3931 2010.02.14 - 
DrWeb 5.0.1.12222 2010.02.14 - 
eSafe 7.0.17.0 2010.02.11 - 
eTrust-Vet 35.2.7300 2010.02.12 - 
F-Prot 4.5.1.85 2010.02.13 - 
F-Secure 9.0.15370.0 2010.02.13 - 
Fortinet 4.0.14.0 2010.02.14 - 
GData 19 2010.02.14 - 
Ikarus T3.1.1.80.0 2010.02.14 - 
Jiangmin 13.0.900 2010.02.14 - 
K7AntiVirus 7.10.972 2010.02.12 - 
Kaspersky 7.0.0.125 2010.02.14 - 
McAfee 5891 2010.02.13 - 
McAfee+Artemis 5891 2010.02.13 - 
McAfee-GW-Edition 6.8.5 2010.02.14 - 
Microsoft 1.5406 2010.02.14 - 
NOD32 4864 2010.02.13 - 
Norman 6.04.08 2010.02.13 - 
nProtect 2009.1.8.0 2010.02.13 - 
Panda 10.0.2.2 2010.02.13 - 
PCTools 7.0.3.5 2010.02.14 - 
Prevx 3.0 2010.02.14 - 
Rising 22.34.01.03 2010.02.11 - 
Sophos 4.50.0 2010.02.14 - 
Sunbelt 5676 2010.02.13 - 
Symantec 20091.2.0.41 2010.02.14 - 
TheHacker 6.5.1.4.193 2010.02.14 - 
TrendMicro 9.120.0.1004 2010.02.14 - 
VBA32 3.12.12.2 2010.02.14 - 
ViRobot 2010.2.13.2186 2010.02.13 - 
VirusBuster 5.0.21.0 2010.02.13 - 
Information additionnelle 
File size: 1261568 bytes 
MD5...: 30c5435e6422b28b5528ac7a0ba45b46 
SHA1..: 92defdda3480d0a8fe7902aa4000a76423100231 
SHA256: 4ddf9b270d0676d12e527bd10d96de83aed3075267867a1623e6a26fe62d2549 
ssdeep: 24576:AAWCLU985IXi5OvGKY+hxGCetXSmEmJu+s4u1:/+0+hACZmJuDN1
 
PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xc9e54
timedatestamp.....: 0x43a17dd7 (Thu Dec 15 14:29:43 2005)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xdac2a 0xdb000 6.43 e62459754892c8ebb69062a6d0a6d5a4
.rdata 0xdc000 0x215e4 0x22000 4.75 4ea024c5406285708dcbe722e9d73618
.data 0xfe000 0xba88c 0x1c000 5.17 d3d76a195c7d4b15e10c01c6d82da309
.rsrc 0x1b9000 0x191b8 0x1a000 3.79 e41bb97aacb416b31f48ce10eaea02c3

( 19 imports ) 
> WINMM.dll: timeGetTime, waveOutOpen, waveOutGetDevCapsA, timeSetEvent, timeGetDevCaps, timeKillEvent, timeEndPeriod, waveOutPrepareHeader, waveOutWrite, waveOutReset, waveOutUnprepareHeader, waveOutClose, timeBeginPeriod
> WININET.dll: InternetGetCookieA
> amp.dll: -, -, -, -
> binkw32.dll: _BinkCopyToBuffer@28, _BinkDoFrame@4, _BinkGoto@12, _BinkClose@4, _BinkNextFrame@4, _BinkOpen@8
> LIBEAY32.dll: -, -
> SSLEAY32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> VIC32.DLL: jpeginfofrombuffer, loadjpgfrombuffer
> MFC42.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCRT.dll: __dllonexit, _terminate@@YAXXZ, printf, strrchr, strchr, isprint, _CIacos, fgetc, strncmp, ceil, _CIfmod, fseek, _stricmp, _beginthreadex, memmove, isalpha, ispunct, localtime, swprintf, wcslen, mktime, srand, rand, strstr, atol, fflush, strncpy, _open, _onexit, _close, fwrite, strtok, fgets, isdigit, sprintf, atof, atoi, isalnum, toupper, sscanf, realloc, malloc, free, fread, _CIasin, isspace, fopen, fputc, fprintf, fclose, _CIpow, _ftol, _except_handler3, __CxxFrameHandler, _CxxThrowException, _strlwr, _itoa, __1type_info@@UAE@XZ, _exit, _XcptFilter, exit, _acmdln, __getmainargs, _initterm, _controlfp, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, _filelength, __setusermatherr, _setmbcp
> KERNEL32.dll: CloseHandle, CreateMutexA, LocalFree, SetEvent, TerminateThread, WaitForSingleObject, CreateEventA, FindClose, FindNextFileA, FindFirstFileA, GetCurrentDirectoryA, Sleep, SetCurrentDirectoryA, Beep, MoveFileA, GetVolumeInformationA, GetWindowsDirectoryA, GetTimeZoneInformation, GetTickCount, InitializeCriticalSection, DeleteCriticalSection, WideCharToMultiByte, DeleteFileA, lstrlenA, MultiByteToWideChar, ResumeThread, DuplicateHandle, GetCurrentProcess, SetFileAttributesA, CopyFileA, TerminateProcess, InterlockedDecrement, InterlockedIncrement, InterlockedExchange, GetLastError, lstrcpyA, MulDiv, CreateDirectoryA, GlobalMemoryStatus, GetVersionExA, GetSystemInfo, OpenMutexA, LeaveCriticalSection, EnterCriticalSection, GetProcAddress, GetModuleHandleA, OpenProcess, PulseEvent, GetCurrentThreadId, ReleaseMutex, WaitForMultipleObjects, CreateFileA, DeviceIoControl, GetModuleFileNameA, SetLastError, GlobalAlloc, GlobalFree, RemoveDirectoryA, LoadLibraryA, CreateProcessA, GetStartupInfoA, GetExitCodeThread
> USER32.dll: IsChild, WindowFromPoint, SetWindowRgn, ReleaseCapture, SetCapture, GetActiveWindow, PeekMessageA, SetWindowPos, SetForegroundWindow, GetDlgCtrlID, GetClassNameA, EnumChildWindows, AppendMenuA, KillTimer, SetWindowLongA, GetWindowThreadProcessId, GetWindowTextA, ShowOwnedPopups, PostQuitMessage, GetSystemMetrics, SystemParametersInfoA, CreatePopupMenu, RegisterHotKey, LoadIconA, TranslateAcceleratorA, LoadAcceleratorsA, LoadBitmapA, CreateIconIndirect, LoadCursorA, FlashWindow, GetFocus, DrawTextA, GetWindowLongA, EnumWindows, PtInRect, UpdateWindow, CallWindowProcA, SetRect, MessageBoxA, GetMessageExtraInfo, keybd_event, GetParent, DrawEdge, GetWindow, SendMessageA, ScreenToClient, SetTimer, InflateRect, CopyRect, OffsetRect, DrawFocusRect, InvalidateRect, GetSysColor, ClientToScreen, GetClientRect, FillRect, GetDC, ReleaseDC, SetActiveWindow, GetDesktopWindow, IsIconic, SetFocus, GetMenuStringA, IsWindowVisible, GetWindowRect, IsWindow, PostMessageA, EnableWindow, SetCursor
> GDI32.dll: CombineRgn, DeleteObject, CreatePolygonRgn, GetRegionData, CreatePalette, CreateDIBSection, Rectangle, SelectObject, Polygon, CreateCompatibleDC, GetCurrentObject, BitBlt, GetObjectA, CreateRoundRectRgn, CreateEllipticRgn, CreateRectRgn, StretchDIBits, ExcludeClipRect, OffsetClipRgn, PaintRgn, FrameRgn, GetTextExtentPoint32A, GetDeviceCaps, CreateFontIndirectA, StartDocA, StartPage, EndPage, AbortDoc, EndDoc, CreateFontA, GetTextMetricsA, CreatePen, CreateSolidBrush, GetStockObject, GetRgnBox, SelectClipRgn
> ADVAPI32.dll: RegEnumKeyA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA, RegCreateKeyExA, RegOpenKeyA, RegCloseKey, RegDeleteKeyA
> SHELL32.dll: SHBrowseForFolderA, SHGetPathFromIDListA, SHAppBarMessage, ShellExecuteA
> COMCTL32.dll: ImageList_Add
> ole32.dll: OleRun, CoCreateInstance, CoInitialize, CoUninitialize
> OLEAUT32.dll: -, -, -, -, -, -, -, -
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCP60.dll: __Xran@std@@YAXXZ, __Grow@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAE_NI_N@Z, __Eos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXI@Z, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __0_Lockit@std@@QAE@XZ, __1_Lockit@std@@QAE@XZ, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@ABV01@@Z, _erase@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@II@Z, __Mstd@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@0@Z, __Split@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEXXZ

( 0 exports ) 
 
RDS...: NSRL Reference Data Set
- 
pdfid.: - 
trid..: Win32 Executable MS Visual C++ (generic) (75.0%)
Win32 Executable Generic (16.9%)
Generic Win/DOS Executable (3.9%)
DOS Executable Generic (3.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
sigcheck:
publisher....: Yatahay Ltd.
copyright....: Copyright (C) 2000-2004 Yatahay Ltd.
product......: TruePoker
description..: TruePoker Client Application
original name: Client.exe
internal name: 
file version.: 1, 2, 4, 2
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

moment de grace · Answer

vu

==> ZHPDiag

aimedjie · Answer

http://www.cijoint.fr/cjlink.php?file=cj201002/cijCatUgbI.txt

moment de grace · Answer

Relance ZHPDiag ( Clic droit " Executer en tant qu'administrateur " sous vista ) , fais un scan puis cette fois-ci cliques sur l'icone en forme d'écusson vert " ZHPFix ". 

ZHPFix se lancera, clique maintenant sur le " H " bleu ( coller les lignes helper ) puis copie/colle ces lignes 

O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} 
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} () - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab
O59 - HSMI:Heuristic Search MagicControl Infection - C:\WINDOWS\system32\CSRSS.EX_

Clique sur " Ok " , puis " Tous " et enfin " Nettoyer ". 

Copie/Colle le rapport à l'écran dans ton prochain message

aimedjie · Answer

ZHPFix v1.12.302  by Nicolas Coolman - Rapport de suppression du 2010-02-14 12:54:25
Fichier d'export Registre : C:\ZHPExportRegistry-2010-02-14-12-54-25.txt
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html


Processus mémoire :
(Néant)

Module mémoire :
(Néant)

Clé du Registre :
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} () - <http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab> 
  => Clé supprimée avec succès

Valeur du Registre :
O3 - Toolbar: (no name) - {1E796980-9CC5-11D1-A83F-00C04FC99D61} 
  => Valeur supprimée avec succès

Elément de données du Registre :
(Néant)

Dossier :
(Néant)

Fichier :
(Néant)

Logiciel :
(Néant)

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 1
Valeur du Registre : 1
Elément de données du Registre : 0
Dossier : 0
Fichier : 0
Logiciel : 0
Autre : 0


End of the scan

moment de grace · Answer

peux tu refaire la même opération
mais avec ce texte là en gras


C:\WINDOWS\system32\CSRSS.EX

aimedjie · Answer

ZHPFix v1.12.302  by Nicolas Coolman - Rapport de suppression du 2010-02-14 15:30:43
Fichier d'export Registre : 
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html


Processus mémoire :
C:\WINDOWS\system32\CSRSS.EX  => Fichier absent

Module mémoire :
(Néant)

Clé du Registre :
(Néant)

Valeur du Registre :
(Néant)

Elément de données du Registre :
(Néant)

Dossier :
(Néant)

Fichier :
(Néant)

Logiciel :
(Néant)

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 1
Module mémoire : 0
Clé du Registre : 0
Valeur du Registre : 0
Elément de données du Registre : 0
Dossier : 0
Fichier : 0
Logiciel : 0
Autre : 0


End of the scan

aimedjie · Answer

Cette fois, le nom s'inscrit de nouveau en lettres majuscules.

moment de grace · Answer

ok

il faudrait télécharge navilog1 sur le bureau : 
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

 Certaines infections bloquent les téléchargements d' outils de désinfection utilisez ce lien alternatif:
 http://ww38.toofiles.com/fr/oip/documents/exe/yop3.html 


1°Double-clique sur navilog1.exe présent sur ton bureau 
2°Sélectionnez la langue désirée dans le menu puis valide le choix par la touche « entrer » 
3°Petit message d’avertissement, appuyez sur une touche pour passe à la suite 
4°un nouveau avertissement, appuie sur une touche pour suivre 
5°Vérification de l’installation de Navilog1 : si tout est bon, appuyez sur une touche pour continuer 
6°Choisir option 1 : recherche/désinfection automatique 
7°La recherche va se lancer automatiquement et peut durée quelques minutes, patientez 
8°Une fois l’analyse terminé, fermez et enregistrez votre travail en cours, puis appuiez sur une touche pour que votre pc puisse démarrer 
9°Au redémarrage du pc, Navilog va supprimer ce qu’il a trouvé, patientez quelques instants. 

Un rapport est gèneré par l'outil. Il se trouve à cette emplacement : 
XP : demarrer/poste de travail/c:/cleannavi.txt 
Vista : logo « demarrer »/ordinateur/c:/ cleannavi.txt

aimedjie · Answer

Fix Navipromo version 4.0.6 commencé le 2010-02-14 22:50:19,89

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 03.01.2010 à 11h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.40GHz )
BIOS : Award Modular BIOS v6.0
USER : Michel ( Administrator )
BOOT : Normal boot

Antivirus : Kaspersky Anti-Virus 9.0.0.736 (Activated)


A:\ (USB)
C:\ (Local Disk) - FAT32 - Total:114 Go (Free:32 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (CD or DVD)


Recherche executée en mode normal 


[b]Aucune Infection Navipromo/Egdaccess trouvée[/b]



*** Scan terminé 2010-02-14 22:51:12,84 ***

moment de grace · Answer

grrrrrrr

vois si tu trouves ceci


C:\WINDOWS\system32\CSRSS.EX 

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers : 

Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK

aimedjie · Answer

J'ai CSRSS.ex_ et csrss.exe. Que fais-je?

moment de grace · Answer

Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\CSRSS.EX_ 

même opération pour l'autre


Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

aimedjie · Answer

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.50 2010.02.15 - 
AhnLab-V3 5.0.0.2 2010.02.14 - 
AntiVir 7.9.1.170 2010.02.14 - 
Antiy-AVL 2.0.3.7 2010.02.14 - 
Authentium 5.2.0.5 2010.02.15 - 
Avast 4.8.1351.0 2010.02.14 - 
AVG 9.0.0.730 2010.02.14 - 
BitDefender 7.2 2010.02.15 - 
CAT-QuickHeal 10.00 2010.02.15 - 
ClamAV 0.96.0.0-git 2010.02.15 - 
Comodo 3939 2010.02.15 - 
DrWeb 5.0.1.12222 2010.02.15 - 
eSafe 7.0.17.0 2010.02.14 - 
eTrust-Vet 35.2.7300 2010.02.12 - 
F-Prot 4.5.1.85 2010.02.15 - 
F-Secure 9.0.15370.0 2010.02.15 - 
Fortinet 4.0.14.0 2010.02.15 - 
GData 19 2010.02.15 - 
Ikarus T3.1.1.80.0 2010.02.15 - 
Jiangmin 13.0.900 2010.02.14 - 
K7AntiVirus 7.10.972 2010.02.12 - 
Kaspersky 7.0.0.125 2010.02.15 - 
McAfee 5892 2010.02.14 - 
McAfee+Artemis 5892 2010.02.14 - 
McAfee-GW-Edition 6.8.5 2010.02.15 - 
Microsoft 1.5406 2010.02.14 - 
NOD32 4866 2010.02.14 - 
Norman 6.04.08 2010.02.14 - 
nProtect 2009.1.8.0 2010.02.14 - 
Panda 10.0.2.2 2010.02.14 - 
PCTools 7.0.3.5 2010.02.14 - 
Prevx 3.0 2010.02.15 - 
Rising 22.34.01.03 2010.02.11 - 
Sophos 4.50.0 2010.02.15 - 
Sunbelt 5678 2010.02.15 - 
Symantec 20091.2.0.41 2010.02.15 - 
TheHacker 6.5.1.4.194 2010.02.15 - 
TrendMicro 9.120.0.1004 2010.02.15 - 
VBA32 3.12.12.2 2010.02.14 - 
ViRobot 2010.2.13.2186 2010.02.13 - 
VirusBuster 5.0.21.0 2010.02.14 - 
Information additionnelle 
File size: 1714 bytes 
MD5...: feb6afc5fe48b237394bcae72715243f 
SHA1..: c0c3092326bf72a79caa1a243d1f1057634e9bf8 
SHA256: 793321da1cfc5d81c3efc0e8a8250ecb35fdd7bcea428d179296344744a97fae 
ssdeep: 48:+JXzzg/9kJquZqMLPy3OjhR3CrOaW+Zm9aiz3:+JXnW2sYqQycR4cBaC3
 
PEiD..: - 
PEInfo: - 
RDS...: NSRL Reference Data Set
- 
pdfid.: - 
trid..: Microsoft Cabinet Archive (99.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

aimedjie · Answer

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.50 2010.02.15 - 
AhnLab-V3 5.0.0.2 2010.02.14 - 
AntiVir 7.9.1.170 2010.02.14 - 
Antiy-AVL 2.0.3.7 2010.02.14 - 
Authentium 5.2.0.5 2010.02.15 - 
Avast 4.8.1351.0 2010.02.14 - 
AVG 9.0.0.730 2010.02.14 - 
BitDefender 7.2 2010.02.15 - 
CAT-QuickHeal 10.00 2010.02.15 - 
ClamAV 0.96.0.0-git 2010.02.15 - 
Comodo 3939 2010.02.15 - 
DrWeb 5.0.1.12222 2010.02.15 - 
eSafe 7.0.17.0 2010.02.14 - 
eTrust-Vet 35.2.7300 2010.02.12 - 
F-Prot 4.5.1.85 2010.02.15 - 
F-Secure 9.0.15370.0 2010.02.15 - 
Fortinet 4.0.14.0 2010.02.15 - 
GData 19 2010.02.15 - 
Ikarus T3.1.1.80.0 2010.02.15 - 
Jiangmin 13.0.900 2010.02.14 - 
K7AntiVirus 7.10.972 2010.02.12 - 
Kaspersky 7.0.0.125 2010.02.15 - 
McAfee 5892 2010.02.14 - 
McAfee+Artemis 5892 2010.02.14 - 
McAfee-GW-Edition 6.8.5 2010.02.15 - 
Microsoft 1.5406 2010.02.14 - 
NOD32 4866 2010.02.14 - 
Norman 6.04.08 2010.02.14 - 
nProtect 2009.1.8.0 2010.02.14 - 
Panda 10.0.2.2 2010.02.14 - 
PCTools 7.0.3.5 2010.02.14 - 
Prevx 3.0 2010.02.15 - 
Rising 22.34.01.03 2010.02.11 - 
Sophos 4.50.0 2010.02.15 - 
Sunbelt 5678 2010.02.15 - 
Symantec 20091.2.0.41 2010.02.15 - 
TheHacker 6.5.1.4.194 2010.02.15 - 
TrendMicro 9.120.0.1004 2010.02.15 - 
VBA32 3.12.12.2 2010.02.14 - 
ViRobot 2010.2.13.2186 2010.02.13 - 
VirusBuster 5.0.21.0 2010.02.14 - 
Information additionnelle 
File size: 6144 bytes 
MD5...: e0e8a531cfce1c2e5d79f683282c10c3 
SHA1..: 6db829fd9d83a97ee8cf993338b63b2967455ba0 
SHA256: de1896fe6096f3fb046b943b1f58590aea850aea7843b55796446d1cbf40fbfd 
ssdeep: 96:1JXAN1CnotgbZm4vU/93SqYs5lEW5RtnWwG:1JXANooygp/ZSq/5+W5RtnW
 
PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x11a3
timedatestamp.....: 0x48025221 (Sun Apr 13 18:34:09 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xaa0 0xc00 5.98 44c941c5e503fc57412d62dca644b186
.data 0x2000 0x6c 0x200 0.20 86a789a893c60d5e207d053188cdc250
.rsrc 0x3000 0x3f0 0x400 3.38 a1b1210d4202f9f8ec0ef222a75ef0d8
.reloc 0x4000 0x94 0x200 1.57 a631a49183888ee1140addc408980653

( 2 imports ) 
> ntdll.dll: NtTerminateProcess, NtRaiseHardError, NtTerminateThread, RtlUnwind, NtQueryVirtualMemory, RtlSetProcessIsCritical, NtSetInformationProcess, DbgBreakPoint, RtlAllocateHeap, RtlUnicodeStringToAnsiString, RtlNormalizeProcessParams
> CSRSRV.dll: CsrServerInitialization

( 0 exports ) 
 
RDS...: NSRL Reference Data Set
- 
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 
pdfid.: - 
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Client Server Runtime Process
original name: CSRSS.Exe
internal name: CSRSS.Exe
file version.: 5.1.2600.5512 (xpsp.080413-2111)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

moment de grace · Answer

les deux sont bons !?

comment va le pc et tes soucis de départ ?

aimedjie · Answer

Idem le problème n'est toujours pas résolu. J'ai également un processus inactif qui ne veut pas se fermer et lorsque j'affiche le gestionnaire des tâches, je n'ai plus l'entête de la fenêtre avec les onglet pour les programmes, les processus et l'unité centrale.

moment de grace · Answer

il reste un programme infectieux (si apres ca, pas d'évolution notable, on fera plus gros) 

Relance ZHPDiag ( Clic droit " Executer en tant qu'administrateur " sous vista ) , fais un scan puis cette fois-ci cliques sur l'icone en forme d'écusson vert " ZHPFix ". 

ZHPFix se lancera, clique maintenant sur le " H " bleu ( coller les lignes helper ) puis copie/colle ces lignes 

C:\Program Files\Internet Optimizer

Clique sur " Ok " , puis " Tous " et enfin " Nettoyer ". 

Copie/Colle le rapport à l'écran dans ton prochain message

aimedjie · Answer

ZHPFix v1.12.302  by Nicolas Coolman - Rapport de suppression du 2010-02-14 23:42:32
Fichier d'export Registre : 
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html


Processus mémoire :
C:\Program Files\Internet Optimizer 
  => Fichier absent

Module mémoire :
(Néant)

Clé du Registre :
(Néant)

Valeur du Registre :
(Néant)

Elément de données du Registre :
(Néant)

Dossier :
(Néant)

Fichier :
(Néant)

Logiciel :
(Néant)

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 1
Module mémoire : 0
Clé du Registre : 0
Valeur du Registre : 0
Elément de données du Registre : 0
Dossier : 0
Fichier : 0
Logiciel : 0
Autre : 0


End of the scan

moment de grace · Answer

c'est pénible...


Attention, avant de commencer, lit attentivement la procédure, et imprime la 

Aide à l’utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


Télécharge ComboFix de sUBs  sur ton Bureau : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

/!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\ 

---> Double-clique sur ComboFix.exe 
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter 

SURTOUT INSTALLES LA CONSOLE DE RECUPERATION 
(si il te propose de l’installer remets provisoirement internet)

---> Mets-le en langue française F 
Tape sur la touche 1 (Yes) pour démarrer le scan. 

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC 

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire. 

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu 

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\ 

Note : Le rapport se trouve également là : C:\ComboFix.txt

aimedjie · Answer

ComboFix 10-02-12.01 - Michel 2010-02-15   0:11.1.1 - FAT32x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.2.1036.18.511.273 [GMT -5:00]
Lancé depuis: c:\documents and settings\Michel\Bureau\Bogue\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\SET4F.tmp
c:\program files\Internet Explorer\SET53.tmp
c:\program files\Internet Explorer\SET54.tmp
c:\program files\internet optimizer
c:\windows\Downloaded Program Files\RdxIE.dll
C:\XES4.tmp

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-01-15 au 2010-02-15  ))))))))))))))))))))))))))))))))))))
.

2010-02-15 05:01 . 2010-02-15 05:01	--------	d-----w-	C:\FOUND.000
2010-02-15 03:49 . 2010-02-15 03:49	--------	d-----w-	c:\program files\Navilog1
2010-02-14 08:05 . 2010-02-14 08:05	--------	d-----w-	c:\program files\ZHPDiag
2010-02-14 02:07 . 2010-02-14 02:07	--------	d-----w-	C:\Kill'em
2010-02-13 15:54 . 2010-02-13 15:54	--------	d-----w-	c:\program files\List_Kill'em
2010-02-13 00:47 . 2010-02-13 00:47	80400	----a-w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Filesollback\patch\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-02-13 00:47 . 2010-02-13 00:47	80400	----a-w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab\AVP9\Data\Updater\Temporary Files	emporaryFolder\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-02-13 00:23 . 2010-02-13 00:23	95259	----a-w-	c:\windows\system32\drivers\klick.dat
2010-02-13 00:23 . 2010-02-13 00:23	108059	----a-w-	c:\windows\system32\drivers\klin.dat
2010-02-13 00:22 . 2010-02-13 00:22	--------	d-----w-	c:\program files\Kaspersky Lab
2010-02-13 00:22 . 2010-02-13 00:22	--------	d-----w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-02-13 00:15 . 2010-02-13 00:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2010-02-12 22:30 . 2010-02-12 22:30	--------	d-----w-	c:\documents and settings\Michel\Application Data\Malwarebytes
2010-02-12 22:29 . 2010-01-07 21:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-12 22:29 . 2010-02-12 22:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-12 22:29 . 2010-02-12 22:29	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-02-12 22:29 . 2010-01-07 21:07	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-02-12 05:49 . 2010-02-12 05:49	--------	d-----w-	C:sit
2010-02-12 05:46 . 2010-02-12 05:46	1214	----a-w-	C:\FindyKill_Upload_Me_N-219A6ZIGBCH7V.zip
2010-02-11 06:39 . 2010-02-11 06:39	--------	d-----w-	C:\FyK
2010-02-10 01:00 . 2010-02-10 01:00	--------	d-----w-	C:\Lop SD
2010-01-17 01:20 . 2008-05-17 00:50	258352	----a-w-	c:\windows\system32\unicows.dll

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-25 21:05 . 2006-04-11 14:12	40237252	------w-	c:\windows\Internet Logs	vDebug.zip
2010-01-20 20:51 . 2005-02-24 22:22	4212	---ha-w-	c:\windows\system32\zllictbl.dat
2010-01-18 04:53 . 2003-12-01 14:47	50272	----a-w-	c:\documents and settings\Michel\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-31 16:50 . 2001-08-28 17:00	353792	----a-w-	c:\windows\system32\drivers\srv.sys
2009-12-26 05:26 . 2001-08-28 17:00	81386	----a-w-	c:\windows\system32\perfc00C.dat
2009-12-26 05:26 . 2001-08-28 17:00	503238	----a-w-	c:\windows\system32\perfh00C.dat
2009-12-21 19:07 . 2004-07-07 23:59	916480	----a-w-	c:\windows\system32\wininet.dll
2009-12-17 07:41 . 2003-07-02 16:01	347648	----a-w-	c:\windows\system32\mspaint.exe
2009-12-14 07:09 . 2001-08-28 17:00	33280	----a-w-	c:\windows\system32\csrsrv.dll
2009-12-09 10:09 . 2001-08-23 22:12	2068096	----a-w-	c:\windows\system32
tkrnlpa.exe
2009-12-09 10:09 . 2001-08-28 17:00	2191232	----a-w-	c:\windows\system32
toskrnl.exe
2009-12-04 18:22 . 2001-08-28 17:00	455424	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2009-11-29 12:09 . 2009-11-29 12:09	79379	------w-	c:\windows\Internet Logs\vsmon_2nd_2009_11_29_00_51_10_small.dmp.zip
2009-11-27 17:13 . 2003-07-02 16:08	17920	----a-w-	c:\windows\system32\msyuv.dll
2009-11-27 17:13 . 2003-05-30 14:00	1297920	----a-w-	c:\windows\system32\quartz.dll
2009-11-27 16:08 . 2003-07-02 16:01	85504	----a-w-	c:\windows\system32\avifil32.dll
2009-11-27 16:08 . 2003-07-02 16:01	11264	----a-w-	c:\windows\system32\msrle32.dll
2009-11-27 16:08 . 2001-08-28 17:00	28672	----a-w-	c:\windows\system32\msvidc32.dll
2009-11-27 16:08 . 2001-08-23 22:47	8704	----a-w-	c:\windows\system32	sbyuv.dll
2009-11-27 16:08 . 2001-08-23 22:47	48128	----a-w-	c:\windows\system32\iyuv_32.dll
2009-11-21 15:58 . 2003-07-02 16:02	471552	----a-w-	c:\windows\AppPatch\aclayers.dll
2007-02-25 03:33 . 2007-02-25 03:30	185942	----a-w-	c:\program files\setuplog.txt
2005-12-28 17:13 . 2005-12-27 22:05	10022	--sha-w-	c:\windows\system32\KGyGaAvL.sys
2005-12-28 17:13 . 2005-12-27 22:05	56	--sh--r-	c:\windows\system32\351D13DFF2.sys
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}]
2009-05-04 11:56	398776	----a-w-	c:\program files\BearShare Applications\BearShare\BearShareIEHelper.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2005-12-14 7094272]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-17 139264]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe" [2007-03-16 63712]
"Symantec PIF AlertEng"="c:\program files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2009-10-21 340456]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe [2005-7-19 43520]
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-4 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2003-03-26 06:15	4595712	----a-w-	c:\windows\system32
vcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2003-03-26 06:15	49152	----a-w-	c:\windows\system32
vmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg
wiz]
2003-03-26 06:15	323584	----a-w-	c:\windows\system32
wiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
2002-06-26 22:36	90112	----a-w-	c:\program files\Analog Devices\SoundMAX\SMTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\WinMX\WinMX.exe"=
"c:\Program Files\mIRC\mirc.exe"=
"c:\Program Files\Messenger\MSMSGS.EXE"=
"c:\Program Files\NetMeeting\conf.exe"=
"c:\Program Files\BearShare\BearShare.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\Program Files\BitTorrent\bittorrent.exe"=
"c:\Program Files\TruePoker\Client.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"c:\Program Files\MSN Messenger\msnmsgr.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-09-14 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-02 19472]
.
Contenu du dossier 'Tâches planifiées'

2010-02-15 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-23 21:04]

2010-02-15 c:\windows\Tasks\User_Feed_Synchronization-{C9957365-D3E4-405A-B590-42210F838BB0}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]

2010-02-15 c:\windows\Tasks\SDMsgUpdate (SmartDrawTrial).job
- c:\progra~1\SMARTD~1\MESSAGES\SDNotify.exe [2006-03-14 15:09]

2010-02-15 c:\windows\Tasks\User_Feed_Synchronization-{76C5FCE4-20B2-472F-BB68-EFEB2C70920C}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.navigationplus.com/menu/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = 
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
Handler: intu-ir2008 - {729D3592-92E7-4cbc-8E44-3C22B3F457B3} - c:\program files\ImpotRapide\ImpotRapide 2008\ic2008pp.dll
Handler: intu-ir2009 - {E4616804-F2F8-4839-B728-5305004DA6A7} - c:\program files\ImpotRapide\ImpotRapide 2009\ic2009pp.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxp://design-concept.ca/Core/Player/2020PlayerAX_Win32.cab
DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - hxxp://software-dl.real.com/04b8ba931923e51d0902/netzip/RdxIE601_fr.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-BearSharePersonalization - c:\program files\BearShare Applications\Personalization\BearSharePersonalization.exe
MSConfigStartUp-NeroCheck - c:\windows\System32\NeroCheck.exe
AddRemove-HaaliMkx - c:\program files\Matroska Pack\haali\uninstall.exe
AddRemove-HijackThis - c:\documents and settings\Michel\Local Settings\Temporary Internet Files\Content.IE5\N7UPRMM0\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-15 00:28
Windows 5.1.2600 Service Pack 3 FAT NTAPI

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,db,a3,87,a8,96,c3,c2,43,87,e6,55,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,db,a3,87,a8,96,c3,c2,43,87,e6,55,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\WINDOWS\system32\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(2744)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32
vsvc32.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2010-02-15  00:34:42 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-02-15 05:34

Avant-CF: 35 387 310 080 octets libres
Après-CF: 36 008 099 840 octets libres

- - End Of File - - 6CCA9D24E4341C2D69EF73064A00DC8D

moment de grace · Answer

ok


Télécharge Superantispyware (SAS) 

https://www.superantispyware.com/superantispywarefreevspro.html

Choisis "enregistrer" et enregistre-le sur ton bureau. 

Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions. 

 Créé une icône sur le bureau. 

 Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer. 

 Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes. 

 Sous Configuration and Preferences, clique sur le bouton "Preferences" 

 Clique sur l'onglet "Scanning Control " 
 Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée : 

* Close browsers before scanning 
* Scan for tracking cookies 
* Terminate memory threats before quarantining 

 Laisse les autres lignes décochées. 

Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle. 

Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer". 

Dans la colonne de gauche, coche C:\Fixed Drive. 

Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan" 

 Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan. 

A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK. 

Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next". 

Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes. 

Pour recopier les informations sur le forum, fais ceci : 

 - après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS. 
 - Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ". 
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log. 

 - Le rapport va s'ouvrir dans ton éditeur de texte par défaut. 

 - Copie son contenu dans ta réponse. 


tutoriel en image :

 https://www.malekal.com/?s=SUPERAntiSpyware

aimedjie · Answer

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 02/15/2010 at 02:35 AM

Application Version : 4.33.1000

Core Rules Database Version : 4584
Trace Rules Database Version: 2396

Scan type       : Complete Scan
Total Scan Time : 01:22:04

Memory items scanned      : 464
Memory threats detected   : 0
Registry items scanned    : 6864
Registry threats detected : 4
File items scanned        : 26342
File threats detected     : 250

Trojan.NewDotNet
	HKU\S-1-5-21-725345543-796845957-2147175445-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
	HKU\.DEFAULT\Software\New.net
	HKU\S-1-5-18\Software\New.net

Browser Hijacker.Begin2Search
	HKU\S-1-5-21-725345543-796845957-2147175445-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4D568F0F-8AC9-40AB-88B7-415134C78777}

Adware.Tracking Cookie
	C:\Documents and Settings\Michel\Cookies\michel@stats.skisrossignol[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@atdmt[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@wysistat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@tribalfusion[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@xiti[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-bestbuy.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@247realmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@adbrite[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickbank[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@microsoftinternetexplorer.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.meteomedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@partyaccount[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@citi.bridgetrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@aimfar.solution.weborama[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@rts.pgmediaserve[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads-dev.youporn[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@pointroll[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@track.webtrekk[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@hitbox[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@estat[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@rwtrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.us.e-planning[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@apmebf[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserver.adtechus[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@bs.serving-sys[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@statcounter[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@advertstream[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@trafficmp[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@canadapost.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.at.atwola[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@partypoker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@track.effiliation[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@media6degrees[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@serving-sys[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@tracking.fastbooking[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@salomon.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@consolidationwindowsfrie8.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@advertising[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.tagtele[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@db.rwtrack[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@at.atwola[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@t.bbtrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@click.payserve[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@cetelem.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.o2websolutions[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@showroomprive.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@interclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.canalblog[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@invitemedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickbank[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@canoe.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@statse.webtrendslive[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@click.tvprocessing[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexe-info[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@specificclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@xxxdex[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@nhl.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@analytics.rogersmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@secure.partyaccount[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.livesport[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@zedo[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@cnam.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.pointroll[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@casalemedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@counter3.sextracker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[9].txt
	C:\Documents and Settings\Michel\Cookies\michel@rotator.adjuggler[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@smartadserver[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@pornravage[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bubblestat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@rogersmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@myroitracking[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[8].txt
	C:\Documents and Settings\Michel\Cookies\michel@paypal.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporn[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.ifactostat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-salomon.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@question.goorou[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@stats.paypal[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ad.yieldmanager[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@searsca.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@imrworldwide[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.partypoker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@videoegg.adbureau[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www8.addfreestats[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bellcan.adbureau[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@clubmed.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@doubleclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ie8audience.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@clicksor[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.sexeautop[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads1.adultadvertising[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexeautop[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@data.coremetrics[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@e-2dj6wnl4apcpsap.stats.esomniture[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@microsoftmachinetranslation.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adtech[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@intermarche2009.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@sextracker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@you-pornz[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@2o7[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@bluestreak[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@teleastral.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youpornos[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@e-2dj6wnmiggdzoko.stats.esomniture[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@mysexykittens[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@mediaplex[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@chitika[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ero-advertising[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@lagarderefrance.solution.weborama[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@adviva[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fastclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@burstnet[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.xxxdex[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sega.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.sitestat[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tacoda[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserverpremium[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.linktrack66[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@sympatico.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@cdn5.specificclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@dekio.solution.weborama[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@fl01.ct2.comclick[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@stats.searchtrack[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.ad4game[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adultadworld[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexlist[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@batiwebgroupe.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-nexusmedia.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tradedoubler[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporns[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@realmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.you-pornz[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@CACVFMWO.txt
	C:\Documents and Settings\Michel\Cookies\michel@vip2.clickzs[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@click2go[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[7].txt
	C:\Documents and Settings\Michel\Cookies\michel@bouyguestelecom.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@meteomedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@smartadserver[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fl01.ct2.comclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@weborama[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.pornoise[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ad.zanox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@hornymatches[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@roiservice[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.adgoto[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.crakmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexsearchcom[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@mypornmotion[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.gtsads[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adultadworld[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@tour.sexsearchcom[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@eas.apm.emediate[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@247realmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@tacoda[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@hitbox[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[11].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserver.aol[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@lagarderefrance.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@statse.webtrendslive[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[7].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[10].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads-dev.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[8].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[7].txt
	C:\Documents and Settings\Michel\Cookies\michel@tradedoubler[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[9].txt
	C:\Documents and Settings\Michel\Cookies\michel@adviva[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@precisionclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@revsci[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ad.yieldmanager[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@specificmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@kontera[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserver.tqs[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.adap[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adbrite[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@exoclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserver.adtechus[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickintext[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@aimfar.solution.weborama[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@media.expedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@trafficholder[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.meteomedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@630.stats.misstrends[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@pornminded[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@2328.stats.misstrends[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@toplist[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@vip2.clickzs[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@xxxpornz[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.sexvideonews[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.sexvideonews[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.canalblog[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[11].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[10].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[3].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@advertstream[3].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@advertstream[1].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@adultfriendfinder[1].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@advertising[2].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@ero-advertising[3].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@advertising[1].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@ero-advertising[1].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@adopt.euroclick[1].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@partypoker[1].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@www.partypoker[1].txt
	C:\Lop SD\Backup-Lop\DOCUME~1\Michel\Cookies\michel@partypoker[2].txt

Rogue.Agent/Gen-Nullo[DLL]
	C:\WINDOWS\SYSTEM32\YHINTAL.DLL

BearShare File Sharing Client
	C:\PROGRAM FILES\BEARSHARE\BEARSHARE.EXE
	C:\PROGRAM FILES\BEARSHARE APPLICATIONS\BEARSHARE\BEARSHARE.EXE

Trojan.Agent/Gen-Nullo[Short]
	C:\SYSTEM VOLUME INFORMATION\_RESTORE{F849FD65-151D-4015-8CCA-4CE5AAAEB9EE}\RP1478\A0274680.EXE

aimedjie · Answer

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 02/15/2010 at 07:20 PM

Application Version : 4.33.1000

Core Rules Database Version : 4584
Trace Rules Database Version: 2396

Scan type       : Complete Scan
Total Scan Time : 01:15:31

Memory items scanned      : 449
Memory threats detected   : 0
Registry items scanned    : 6863
Registry threats detected : 0
File items scanned        : 26394
File threats detected     : 158

Adware.Tracking Cookie
	C:\Documents and Settings\Michel\Cookies\michel@stats.skisrossignol[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@atdmt[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@wysistat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@tribalfusion[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@xiti[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-bestbuy.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@247realmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@adbrite[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickbank[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@microsoftinternetexplorer.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.meteomedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@partyaccount[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@citi.bridgetrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@aimfar.solution.weborama[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@rts.pgmediaserve[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads-dev.youporn[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@pointroll[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@track.webtrekk[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@hitbox[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@estat[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@rwtrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.us.e-planning[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@apmebf[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserver.adtechus[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@bs.serving-sys[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@statcounter[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@advertstream[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@trafficmp[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@canadapost.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.at.atwola[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@partypoker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@track.effiliation[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@media6degrees[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@serving-sys[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tracking.fastbooking[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@salomon.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@consolidationwindowsfrie8.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@advertising[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.tagtele[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@db.rwtrack[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@at.atwola[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@t.bbtrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@click.payserve[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@cetelem.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.o2websolutions[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@showroomprive.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@interclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.canalblog[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@invitemedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickbank[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@canoe.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@statse.webtrendslive[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@click.tvprocessing[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexe-info[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@specificclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@xxxdex[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@nhl.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@analytics.rogersmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@secure.partyaccount[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.livesport[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@zedo[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@cnam.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.pointroll[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@casalemedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@counter3.sextracker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[9].txt
	C:\Documents and Settings\Michel\Cookies\michel@rotator.adjuggler[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@smartadserver[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@pornravage[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bubblestat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@rogersmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@myroitracking[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@paypal.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporn[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.ifactostat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-salomon.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@question.goorou[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@stats.paypal[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ad.yieldmanager[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@searsca.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@imrworldwide[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.partypoker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@videoegg.adbureau[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www8.addfreestats[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bellcan.adbureau[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@clubmed.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@doubleclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ie8audience.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@clicksor[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.sexeautop[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads1.adultadvertising[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexeautop[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@data.coremetrics[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@e-2dj6wnl4apcpsap.stats.esomniture[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@microsoftmachinetranslation.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adtech[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@intermarche2009.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@sextracker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@you-pornz[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@2o7[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@bluestreak[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@teleastral.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youpornos[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@e-2dj6wnmiggdzoko.stats.esomniture[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@mysexykittens[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@mediaplex[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@chitika[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ero-advertising[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@lagarderefrance.solution.weborama[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adviva[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fastclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@burstnet[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.xxxdex[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sega.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.sitestat[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tacoda[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserverpremium[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.linktrack66[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@sympatico.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@cdn5.specificclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@dekio.solution.weborama[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@fl01.ct2.comclick[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@stats.searchtrack[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.ad4game[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adultadworld[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexlist[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@batiwebgroupe.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-nexusmedia.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tradedoubler[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporns[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@realmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.you-pornz[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@CACVFMWO.txt
	C:\Documents and Settings\Michel\Cookies\michel@vip2.clickzs[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@click2go[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[7].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bouyguestelecom.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@meteomedia[2].txt

moment de grace · Answer

ok

où en sont tes soucis de départ maintenant ?

aimedjie · Answer

Toujours les mêmes soucis, mais cette-fois IEXPLOR.EXE est inscrit en lettres majuscules. J'ai refait deux autres fois SUPERAntiSpyware Scan Log :



SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 02/15/2010 at 07:20 PM

Application Version : 4.33.1000

Core Rules Database Version : 4584
Trace Rules Database Version: 2396

Scan type       : Complete Scan
Total Scan Time : 01:15:31

Memory items scanned      : 449
Memory threats detected   : 0
Registry items scanned    : 6863
Registry threats detected : 0
File items scanned        : 26394
File threats detected     : 158

Adware.Tracking Cookie
	C:\Documents and Settings\Michel\Cookies\michel@stats.skisrossignol[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@atdmt[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@wysistat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@tribalfusion[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@xiti[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-bestbuy.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@247realmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@adbrite[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickbank[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@microsoftinternetexplorer.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.meteomedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@partyaccount[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@citi.bridgetrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@aimfar.solution.weborama[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@rts.pgmediaserve[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads-dev.youporn[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@pointroll[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@track.webtrekk[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@hitbox[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@estat[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@rwtrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.us.e-planning[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@apmebf[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserver.adtechus[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@bs.serving-sys[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@statcounter[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@advertstream[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@trafficmp[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@canadapost.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.at.atwola[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@partypoker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@track.effiliation[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@media6degrees[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@serving-sys[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tracking.fastbooking[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@salomon.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@consolidationwindowsfrie8.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@advertising[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.tagtele[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@db.rwtrack[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@at.atwola[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@t.bbtrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@click.payserve[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@cetelem.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.o2websolutions[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@showroomprive.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@interclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.canalblog[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@invitemedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickbank[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@canoe.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@statse.webtrendslive[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@click.tvprocessing[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexe-info[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@specificclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@xxxdex[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@nhl.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@analytics.rogersmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@secure.partyaccount[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.livesport[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@zedo[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@cnam.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.pointroll[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@casalemedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@counter3.sextracker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[9].txt
	C:\Documents and Settings\Michel\Cookies\michel@rotator.adjuggler[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@smartadserver[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@pornravage[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bubblestat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@rogersmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@myroitracking[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@paypal.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporn[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.ifactostat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-salomon.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@question.goorou[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@stats.paypal[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ad.yieldmanager[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@searsca.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@imrworldwide[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.partypoker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@videoegg.adbureau[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www8.addfreestats[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bellcan.adbureau[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@clubmed.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@doubleclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ie8audience.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@clicksor[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.sexeautop[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads1.adultadvertising[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexeautop[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@data.coremetrics[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@e-2dj6wnl4apcpsap.stats.esomniture[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@microsoftmachinetranslation.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adtech[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@intermarche2009.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@sextracker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@you-pornz[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@2o7[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@bluestreak[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@teleastral.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youpornos[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@e-2dj6wnmiggdzoko.stats.esomniture[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@mysexykittens[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@mediaplex[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@chitika[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ero-advertising[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@lagarderefrance.solution.weborama[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adviva[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fastclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@burstnet[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.xxxdex[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sega.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.sitestat[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tacoda[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserverpremium[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.linktrack66[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@sympatico.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@cdn5.specificclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@dekio.solution.weborama[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@fl01.ct2.comclick[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@stats.searchtrack[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.ad4game[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adultadworld[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexlist[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@batiwebgroupe.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-nexusmedia.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tradedoubler[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporns[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@realmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.you-pornz[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@CACVFMWO.txt
	C:\Documents and Settings\Michel\Cookies\michel@vip2.clickzs[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@click2go[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[7].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bouyguestelecom.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@meteomedia[2].txt




SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 02/15/2010 at 07:20 PM

Application Version : 4.33.1000

Core Rules Database Version : 4584
Trace Rules Database Version: 2396

Scan type       : Complete Scan
Total Scan Time : 01:15:31

Memory items scanned      : 449
Memory threats detected   : 0
Registry items scanned    : 6863
Registry threats detected : 0
File items scanned        : 26394
File threats detected     : 158

Adware.Tracking Cookie
	C:\Documents and Settings\Michel\Cookies\michel@stats.skisrossignol[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@atdmt[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@wysistat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@tribalfusion[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@xiti[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-bestbuy.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@247realmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@adbrite[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickbank[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@microsoftinternetexplorer.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.meteomedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@partyaccount[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@citi.bridgetrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@aimfar.solution.weborama[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@rts.pgmediaserve[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads-dev.youporn[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@pointroll[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@track.webtrekk[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@hitbox[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@estat[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@rwtrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.us.e-planning[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@apmebf[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserver.adtechus[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@bs.serving-sys[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@statcounter[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@advertstream[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@trafficmp[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@canadapost.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.at.atwola[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@partypoker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@track.effiliation[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@media6degrees[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@serving-sys[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tracking.fastbooking[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@salomon.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@consolidationwindowsfrie8.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@advertising[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.tagtele[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@db.rwtrack[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@at.atwola[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@t.bbtrack[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@click.payserve[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@cetelem.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.o2websolutions[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@showroomprive.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@interclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.canalblog[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@invitemedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@clickbank[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@canoe.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@statse.webtrendslive[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@click.tvprocessing[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexe-info[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@specificclick[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@xxxdex[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@nhl.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@analytics.rogersmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@secure.partyaccount[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.livesport[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@zedo[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@cnam.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.pointroll[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@casalemedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@counter3.sextracker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[9].txt
	C:\Documents and Settings\Michel\Cookies\michel@rotator.adjuggler[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@smartadserver[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@pornravage[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bubblestat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@rogersmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@myroitracking[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@paypal.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporn[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.ifactostat[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-salomon.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@question.goorou[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@stats.paypal[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ad.yieldmanager[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@searsca.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@imrworldwide[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.partypoker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@videoegg.adbureau[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www8.addfreestats[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bellcan.adbureau[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@clubmed.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@doubleclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ie8audience.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@clicksor[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.sexeautop[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads1.adultadvertising[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@adcentriconline[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexeautop[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@data.coremetrics[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@e-2dj6wnl4apcpsap.stats.esomniture[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@microsoftmachinetranslation.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.youporn[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adtech[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@intermarche2009.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@sextracker[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@you-pornz[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@2o7[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@bluestreak[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@teleastral.122.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youpornos[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@e-2dj6wnmiggdzoko.stats.esomniture[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@mysexykittens[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@mediaplex[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@chitika[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@ero-advertising[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@lagarderefrance.solution.weborama[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@content.yieldmanager[5].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[4].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adviva[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fastclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@burstnet[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.xxxdex[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@sega.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@fr.sitestat[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tacoda[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@adserverpremium[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.linktrack66[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@sympatico.112.2o7[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.googleadservices[6].txt
	C:\Documents and Settings\Michel\Cookies\michel@cdn5.specificclick[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@dekio.solution.weborama[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@fl01.ct2.comclick[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@stats.searchtrack[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ads.ad4game[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@adultadworld[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@sexlist[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@batiwebgroupe.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@ehg-nexusmedia.hitbox[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@tradedoubler[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@youporns[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@realmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@www.you-pornz[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@CACVFMWO.txt
	C:\Documents and Settings\Michel\Cookies\michel@vip2.clickzs[3].txt
	C:\Documents and Settings\Michel\Cookies\michel@click2go[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@server.iad.liveperson[7].txt
	C:\Documents and Settings\Michel\Cookies\michel@vitamine.networldmedia[1].txt
	C:\Documents and Settings\Michel\Cookies\michel@bouyguestelecom.solution.weborama[2].txt
	C:\Documents and Settings\Michel\Cookies\michel@meteomedia[2].txt

moment de grace · Answer

ok 

plusieurs choses qui collent pas dans ton dernier rapport cobo, je vois avec un ami pour résoudre ca

je te tiens au courant

en attendant


Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : 

 c:\windows\Internet Logs\vsmon_2nd_2009_11_29_00_51_10_small.dmp.zip
C?\WINDOWS\system32\FM20ENU.DLL

Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers : 

Pour cela : 
Clique sur démarrer/panneau de configuration/option des dossiers/affichage 

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" 

Décocher masquer les extensions dont le type est connu 

Puis fais «appliquer» pour valider les changements. 

Et OK

aimedjie · Answer

Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.50 2010.02.16 - 
AhnLab-V3 5.0.0.2 2010.02.16 - 
AntiVir 8.2.1.170 2010.02.16 - 
Antiy-AVL 2.0.3.7 2010.02.16 - 
Authentium 5.2.0.5 2010.02.16 - 
Avast 4.8.1351.0 2010.02.16 - 
AVG 9.0.0.730 2010.02.16 - 
BitDefender 7.2 2010.02.17 - 
CAT-QuickHeal 10.00 2010.02.16 - 
ClamAV 0.96.0.0-git 2010.02.16 - 
Comodo 3962 2010.02.17 - 
DrWeb 5.0.1.12222 2010.02.16 - 
eSafe 7.0.17.0 2010.02.16 - 
eTrust-Vet 35.2.7307 2010.02.16 - 
F-Prot 4.5.1.85 2010.02.16 - 
F-Secure 9.0.15370.0 2010.02.17 - 
Fortinet 4.0.14.0 2010.02.15 - 
GData 19 2010.02.17 - 
Ikarus T3.1.1.80.0 2010.02.16 - 
Jiangmin 13.0.900 2010.02.16 - 
K7AntiVirus 7.10.974 2010.02.15 - 
Kaspersky 7.0.0.125 2010.02.17 - 
McAfee 5894 2010.02.16 - 
McAfee+Artemis 5894 2010.02.16 - 
Microsoft 1.5406 2010.02.17 - 
NOD32 4872 2010.02.16 - 
Norman 6.04.08 2010.02.16 - 
nProtect 2009.1.8.0 2010.02.16 - 
Panda 10.0.2.2 2010.02.16 - 
PCTools 7.0.3.5 2010.02.16 - 
Prevx 3.0 2010.02.17 - 
Rising 22.34.01.03 2010.02.11 - 
Sophos 4.50.0 2010.02.16 - 
Sunbelt 5681 2010.02.16 - 
Symantec 20091.2.0.41 2010.02.17 - 
TheHacker 6.5.1.4.197 2010.02.17 - 
TrendMicro 9.120.0.1004 2010.02.16 - 
VBA32 3.12.12.2 2010.02.16 - 
ViRobot 2010.2.16.2188 2010.02.16 - 
VirusBuster 5.0.21.0 2010.02.16 - 
Information additionnelle 
File size: 79379 bytes 
MD5...: ebf9c3cd5791f1e64c7e858f09e26e1d 
SHA1..: 95467a9874bc17626524599ed4603c425d725aed 
SHA256: e3d7aa5867b57b476e040b4eb16d506f2ceeba5435d222632807b1050db78225 
ssdeep: 1536:Ac9+ajJ3Q7cbOaymixCbbMrDFGLnl76uRA6P99Fv0jmbY3/aNBlpnmrV:3y
7hmixCbbMrDFGLnl+IPJv0u2YBDmrV
 
PEiD..: - 
PEInfo: - 
RDS...: NSRL Reference Data Set
- 
pdfid.: - 
trid..: ZIP compressed archive (100.0%) 
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

aimedjie · Answer

Je n'ai pas de fichier FM20ENU.DLL, mais j'ai un FM20FRA.DLL


Antivirus Version Dernière mise à jour Résultat 
a-squared 4.5.0.50 2010.02.16 - 
AhnLab-V3 5.0.0.2 2010.02.16 - 
AntiVir 8.2.1.170 2010.02.16 - 
Antiy-AVL 2.0.3.7 2010.02.16 - 
Authentium 5.2.0.5 2010.02.16 - 
Avast 4.8.1351.0 2010.02.16 - 
AVG 9.0.0.730 2010.02.16 - 
BitDefender 7.2 2010.02.17 - 
CAT-QuickHeal 10.00 2010.02.16 - 
ClamAV 0.96.0.0-git 2010.02.16 - 
Comodo 3962 2010.02.17 - 
DrWeb 5.0.1.12222 2010.02.16 - 
eSafe 7.0.17.0 2010.02.16 - 
eTrust-Vet 35.2.7307 2010.02.16 - 
F-Prot 4.5.1.85 2010.02.16 - 
F-Secure 9.0.15370.0 2010.02.17 - 
Fortinet 4.0.14.0 2010.02.15 - 
GData 19 2010.02.17 - 
Ikarus T3.1.1.80.0 2010.02.16 - 
Jiangmin 13.0.900 2010.02.16 - 
K7AntiVirus 7.10.974 2010.02.15 - 
Kaspersky 7.0.0.125 2010.02.17 - 
McAfee 5894 2010.02.16 - 
McAfee+Artemis 5894 2010.02.16 - 
Microsoft 1.5406 2010.02.17 - 
NOD32 4872 2010.02.16 - 
Norman 6.04.08 2010.02.16 - 
nProtect 2009.1.8.0 2010.02.16 - 
Panda 10.0.2.2 2010.02.16 - 
PCTools 7.0.3.5 2010.02.16 - 
Rising 22.34.01.03 2010.02.11 - 
Sophos 4.50.0 2010.02.16 - 
Sunbelt 5681 2010.02.16 - 
Symantec 20091.2.0.41 2010.02.17 - 
TheHacker 6.5.1.4.197 2010.02.17 - 
TrendMicro 9.120.0.1004 2010.02.16 - 
VBA32 3.12.12.2 2010.02.16 - 
ViRobot 2010.2.16.2188 2010.02.16 - 
VirusBuster 5.0.21.0 2010.02.16 - 
Information additionnelle 
File size: 42128 bytes 
MD5...: 9a45a2e7841acae5c2232f2aaa46698f 
SHA1..: 7944f2aa24fb36f37ce0397bd959f7b6eefdac46 
SHA256: 8d66b6cc072f3a683fe6f0bff10a426a40b688f0265574f8d56d8bfe3e39a19e 
ssdeep: 768:kdwQZnu4X5HOmvYeQqsKDoRfuPERnrJnC:kdwQZnJX1lbgrJC
 
PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x0
timedatestamp.....: 0x3f0fd024 (Sat Jul 12 09:08:52 2003)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.rdata 0x1000 0x70 0x200 0.44 6ecabe76f9fa01133874da91519b8202
.rsrc 0x2000 0x7000 0x6800 3.77 858b182419894b723a2c255cc7b33a31
.reloc 0x9000 0xc 0x200 0.02 2c38765194d27b75f56d0565088a53ee

( 0 imports ) 

( 0 exports ) 
 
RDS...: NSRL Reference Data Set
- 
pdfid.: - 
trid..: Win16/32 Executable Delphi generic (33.9%)
Generic Win/DOS Executable (32.7%)
DOS Executable Generic (32.7%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) 
sigcheck:
publisher....: Microsoft Corporation
copyright....: Copyright(c) Microsoft Corp. 1993-2003
product......: Microsoft_ Forms
description..: Microsoft_ Forms International DLL
original name: fm20fra.DLL
internal name: fm20fra
file version.: 11.0.5510
comments.....: n/a
signers......: Microsoft Corporation
Microsoft Code Signing PCA
Microsoft Root Authority
signing date.: 7:46 PM 7/31/2003
verified.....: -

moment de grace · Answer

ok relances RSIT et postes le rapport log stp

aimedjie · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Michel at 2010-02-16 20:28:41
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 34 GB (29%) free of 117 GB
Total RAM: 511 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:29:10, on 2010-02-16
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
C:\Documents and Settings\Michel\Bureau\Bogue\RSIT.exe
C:\Documents and Settings\Michel\Bureau\Michel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.navigationplus.com/menu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare\BearShareIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Jeux\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Jeux\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (Talisma NetAgent Customer ActiveX Control version 3) - https://intuitcanada.ehosts.net/netagent/objects/custappx3.cab
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 3D Viewer) - http://design-concept.ca/Core/Player/2020PlayerAX_Win32.cab
O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://qsindoc1.csst.qc.ca/iNotes6W.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04b8ba931923e51d0902/netzip/RdxIE601_fr.cab
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - http://costco.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://geo.ville.quebec.qc.ca/carte_int/acgm.cab
O18 - Protocol: intu-ir2007 - {52BAEC6B-9405-46F9-A131-6D50720A3CC4} - C:\Program Files\ImpotRapide\ImpotRapide 2007\ic2007pp.dll
O18 - Protocol: intu-ir2008 - {729D3592-92E7-4CBC-8E44-3C22B3F457B3} - C:\Program Files\ImpotRapide\ImpotRapide 2008\ic2008pp.dll
O18 - Protocol: intu-ir2009 - {E4616804-F2F8-4839-B728-5305004DA6A7} - C:\Program Files\ImpotRapide\ImpotRapide 2009\ic2009pp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\FICHIE~1\SYMANT~1\CCPD-LC\symlcsvc.exe

moment de grace · Answer

Cherches et cliques sur C:\Documents and Settings\Michel\Bureau\Michel.exe

Au menu principal, choisir do a scan only, puis cocher la case devant les lignes suivantes à corriger et cliquer en bas sur Fix Checked (s'il manque des lignes pas grave)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.navigationplus.com/menu
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) 
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll 
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe    
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background     
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe     
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"    
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe    
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (Talisma NetAgent Customer ActiveX Control version 3) - https://intuitcanada.ehosts.net/netagent/objects/custappx3.cab     
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 3D Viewer) - http://design-concept.ca/Core/Player/2020PlayerAX_Win32.cab 
O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB 
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://qsindoc1.csst.qc.ca/iNotes6W.cab 
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab     
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04b8ba931923e51d0902/netzip/RdxIE601_fr.cab 
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/cpbrkpie.cab 
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab 
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} (Photo Upload Plugin Class) - http://costco.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab 
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - http://geo.ville.quebec.qc.ca/carte_int/acgm.cab 
O18 - Protocol: intu-ir2009 - {E4616804-F2F8-4839-B728-5305004DA6A7} - C:\Program Files\ImpotRapide\ImpotRapide 2009\ic2009pp.dll    

redemarres le pc et dis moi si tu constates une amélioration--

Je cherche beaucoup...et maintenant je trouve ! 
(sourire)

aimedjie · Answer

Il y a toujours 2 IEXPLORE.EXE, mais cette fois, en majuscule.

moment de grace · Answer

Il y a toujours 2 IEXPLORE.EXE

ce sont deux fenêtres internet ouvertes ?

ce sont deux processus actifs en même temps ?

aimedjie · Answer

2 processus actifs, mais une seule fenêtre et si je ferme la fenêtre, aucun processus ferme et l'ordinateur plante.

aimedjie · Answer

Je dois terminer le processus par le gestionnaire des tâches.... dont je n'ai plus les onglets et l'entête...

moment de grace · Answer

je doute qu'un virus soit responsable de ca...

Télécharge Zeb Restore 
http://telechargement.zebulon.fr/zeb-restore.html 
Zeb-Restore est un petit utilitaire de restauration de clés de la base de registre. Le but du programme n'est pas de restaurer l'ensemble du système mais uniquement les points les plus souvent touchés afin de solutionner différents problèmes qui peuvent revenir de façon récurrente. 

Voici les éléments qui peuvent être restaurés : coche les lignes en gras 
- RegEdit : réactive l'accès à RegEdit 
- Clés RUN : réactive le lancement de programmes par clés RunXXX 
- Bouton Arrêter : rétablit le bouton Arrêter 
- Windows Update : rétablit la fonction Windows Update 
- Gestionnaire des tâches : réactive le gestionnaire des tâches 
- Panneau de configuration : réactive le Panneau de configuration 
- Ajout/Suppression de programmes : restaure la fonction Ajout-Suppression de programmes 
- Policies : remet en place des éléments désactivés par "Policies" 
- Bureau : réactive le Bureau 
- Réparation IE : répare Internet Exploreur (pages de recherche) 
- Extension des fichiers : répare les extensions des fichiers .exe .bat .reg. Pif.cmd.scr .com 
- Sites de confiance et sensibles : efface le contenu de ces zones (à utiliser si vous êtes infecté par des malwares) 
- Préfixes et Protocoles Internet : restore les clés des protocoles Internet (ZoneMap etc.) 
- Réinitialiser Fichier Hosts : réinitialise le fichier Hosts

.......................

possèdes tu le cd de windows ?

aimedjie · Answer

Oui, j'ai le CD de Windows.

aimedjie · Answer

J'ai fait le Zeb-restore, mais rien n'a changé.

moment de grace · Answer

ok

on fait ainsi pour commencer
https://forums.cnetfrance.fr/tutoriels-logiciels-et-applis/431-sfc-scannow-verifier-les-fichiers-systemes

en tapant la commande SFC /scannow 


si pas d'amélioration
=> une réparation windows

http://www.informatruc.com/reparer-windows-xp-2

aimedjie · Answer

Ma situation s'améliore grandement. J'ai toujours 2 IEXPLORE.EXE qui ouvre, mais je n'ai plus besoin de passer par le gestionnaire des tâches pour les fermer. Le "X" rouge la fenêtre suffit. C'est un très grand pas puisque mon ordinateur ne plante pas si je ne ferme le processus par le gestionnaire des tâches. Par contre, je n'ai toujours pas les onglets du gestionnaire des tâches.

aimedjie · Answer

Un autre grand pas, j'ai résolu le problème du gestionnaire des tâches :

https://www.informatruc.com

Il ne reste qu'à empêcher 2 IEXPLORE.EXE d'ouvrir lorsque j'ouvre internet. Par contre, le problème est beaucoup moins important puisqu'il se ferme comme avant. Bref, si je ne regarde pas le gestionnaire des tâches, rien ne paraît.

moment de grace · Answer

et ce n'est pas norlal ca ?

moi j'en ai 2 d'ouverts en même temps, un pour la fenêtre internet en court, l'autre pour l'onglet supplementaire internet...

si cela ne ralentit pas le pc...

aimedjie · Answer

Si c'est normal, j'imagine qu'il ne me reste qu'à te remercier plus que chaleureusement.

Merci énormément pour ta plus que précieuse aide. Je ne sais pas comment tu as fait, mais tu es tout simplement génial. Les mots me manquent pour exprimer toute ma reconnaissance. Si jamais tu te présentes à la présidence, tu me le dis et sois certain que tu as mon vote.

Merci infiniment!

moment de grace · Answer

pour finir

tu as deux antivirus...1 de trop 

enleves norton
https://www.commentcamarche.net/faq/2453-supprimer-desinstaller-norton-antivirus-norton-internet-security

.........................


IMPORTANT

Purger la restauration systeme XP

http://www.bibou0007.com/windows-xp-f101/purger-la-restauration-du-systeme-sous-windows-xp-t151.htm


..............


Télécharge ToolsCleaner2sur ton Bureau. 
https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/

* Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur ToolsCleaner2.exe pour le lancer. 
* Clique sur Recherche et laisse le scan agir. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options Facultatives. 
* Clique sur Quitter pour obtenir le rapport. 
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


Tu peux supprimer ToolCleaner ensuite

aimedjie · Answer

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\Combofix.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\lopR.txt: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\Rsit: trouvé !
C:\WINDOWS\mbr.exe: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\LopSD.exe: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\Navilog1.exe: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\ComboFix.exe: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\HijackThis.exe: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\hijackthis.log: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\cleannavi.txt: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\lopR.txt: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\Rsit.exe: trouvé !
C:\Documents and Settings\Michel\Bureau\Bogue\catchme.log: trouvé !
C:\Documents and Settings\Michel\Application Data\Registry Mechanic\SystemReport.txt: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Lop SD\catchme.exe: trouvé !
C:\Lop SD\catchme.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\Michel\Bureau\Bogue\LopSD.exe: supprimé !
C:\Documents and Settings\Michel\Bureau\Bogue\Navilog1.exe: supprimé !
C:\Documents and Settings\Michel\Bureau\Bogue\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Michel\Bureau\Bogue\HijackThis.exe: supprimé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Lop SD\catchme.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\lopR.txt: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Documents and Settings\Michel\Bureau\Bogue\hijackthis.log: supprimé !
C:\Documents and Settings\Michel\Bureau\Bogue\cleannavi.txt: supprimé !
C:\Documents and Settings\Michel\Bureau\Bogue\lopR.txt: supprimé !
C:\Documents and Settings\Michel\Bureau\Bogue\Rsit.exe: supprimé !
C:\Documents and Settings\Michel\Bureau\Bogue\catchme.log: supprimé !
C:\Documents and Settings\Michel\Application Data\Registry Mechanic\SystemReport.txt: supprimé !
C:\Lop SD\catchme.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\ZHPDiag: supprimé !

moment de grace · Answer

supprimes manuellement combofix

si tout est ok pour toi


tu peux mettre le topic en resolu 
https://www.commentcamarche.net/infos/25917-marquer-un-fil-de-discussion-comme-etant-resolu/


Bonne continuation et surtout , prudence et bon surf :)

aimedjie · Answer

Merci plus qu'infiniment!!!!!! Tu es un géni!!!!!!

Iexplore.exe ouvre plusieurs fois - Page 4

Discussions similaires

Newsletters