Fenetre pub qui s'ouvre toute seule

Question

Bonjour,

j'ai des pub qui s'ouvre tout le temps

voici le rapport hijackthis

ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:53, on 05/07/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\ASUSTPE.exe
C:\Windows\ASScrPro.exe
C:\Program Files\PowerForPhone\PowerForPhone.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\e-Carte Bleue Société Générale\ecbl-sg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fdajo%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.asus.com/fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ASUSTPE] C:\Windows\system32\ASUSTPE.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S362.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series (Copie 1)] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S3138.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [PartDent] "C:\ProgramData\Readmescrscr.wqfgcd4"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: e-Carte Bleue Société Générale.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe

Destrio5 · Answer

Bonjour,

Infection Lop/Swizzor.

--> Désactive l'UAC le temps de la désinfection.

--> Télécharge Lop S&D (par Eric_71 & Angeldark) sur ton Bureau.

--> Double-clique dessus pour lancer l'installation.

--> Puis double-clique sur Lop S&D présent sur ton Bureau.
(Sous Vista/Win7, il faut cliquer droit sur Lop S&D et choisir Exécuter en tant qu'administrateur)

--> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche).

--> Patiente jusqu'à la fin du scan.

--> Poste le rapport généré (C:\lopR.txt).

alex50300 · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual  CPU  T2310  @ 1.46GHz )
   BIOS : Default System BIOS
   USER : Noemie ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 081212-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total:89 Go (Free:20 Go)
   D:\ (Local Disk) - NTFS - Total:52 Go (Free:18 Go)
   E:\ (CD or DVD)
   G:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 17/02/2010|18:08 )

   [ UAC => 0 ]
 
   --------------------\  Listing des dossiers dans Local

   [14/11/2007|17:35] C:\Users\Noemie\AppData\Local\Adobe
   [01/11/2008|11:04] C:\Users\Noemie\AppData\Local\Ahead
   [08/11/2007|22:15] C:\Users\Noemie\AppData\Local\Application Data 
   [04/08/2009|16:04] C:\Users\Noemie\AppData\Local\Apps
   [15/02/2010|19:06] C:\Users\Noemie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [05/08/2008|12:41] C:\Users\Noemie\AppData\Local\DNA
   [10/02/2010|17:49] C:\Users\Noemie\AppData\Local\GDIPFONTCACHEV1.DAT
   [08/11/2007|22:15] C:\Users\Noemie\AppData\Local\Historique 
   [17/02/2010|18:02] C:\Users\Noemie\AppData\Local\IconCache.db
   [17/02/2010|18:04] C:\Users\Noemie\AppData\Local\jdzcqmad.bat
   [24/11/2007|22:01] C:\Users\Noemie\AppData\Local\Lphant
   [14/08/2008|20:38] C:\Users\Noemie\AppData\Local\Microsoft
   [01/05/2009|20:44] C:\Users\Noemie\AppData\Local\Microsoft Games
   [08/08/2008|18:03] C:\Users\Noemie\AppData\Local\MigWiz
   [06/08/2008|13:15] C:\Users\Noemie\AppData\Local\Mozilla
   [17/02/2010|18:07] C:\Users\Noemie\AppData\Local\Temp
   [08/11/2007|22:15] C:\Users\Noemie\AppData\Local\Temporary Internet Files 
   [28/01/2010|16:56] C:\Users\Noemie\AppData\Local\VirtualStore
   [17/02/2010|18:07] C:\Users\Noemie\AppData\Local\vnffu.dat
   [15/02/2010|19:37] C:\Users\Noemie\AppData\Local\vnffu.exe
   [11/02/2010|19:36] C:\Users\Noemie\AppData\Local\vnffu_nav.dat
   [17/02/2010|18:07] C:\Users\Noemie\AppData\Local\vnffu_navps.dat
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [17/02/2010 18:04][--ah-----] C:\Windows	asks\SA.DAT
   [17/02/2010 18:02][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [05/09/2007|15:57] C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}
   [05/09/2007|17:08] C:\ProgramData\Adobe
   [02/11/2006|14:02] C:\ProgramData\Application Data 
   [08/11/2007|22:55] C:\ProgramData\ASUS
   [05/09/2007|16:47] C:\ProgramData\Atheros
   [19/07/2008|10:41] C:\ProgramData\beep axis mode free
   [28/03/2008|20:48] C:\ProgramData\BOONTY
   [02/11/2006|14:02] C:\ProgramData\Desktop 
   [02/11/2006|14:02] C:\ProgramData\Documents 
   [19/11/2007|13:02] C:\ProgramData\EPSON
   [02/11/2006|14:02] C:\ProgramData\Favorites 
   [08/11/2007|22:21] C:\ProgramData\LightScribe
   [06/07/2008|21:29] C:\ProgramData\Malwarebytes
   [18/11/2009|21:28] C:\ProgramData\Microsoft
   [11/02/2010|06:59] C:\ProgramData\Microsoft Help
   [05/09/2007|15:59] C:\ProgramData\Nero
   [14/11/2009|08:25] C:\ProgramData\NOS
   [05/09/2007|17:00] C:\ProgramData\P4G
   [30/05/2008|21:51] C:\ProgramData\Readmescrscr.6f5ofyw
   [04/05/2008|16:33] C:\ProgramData\Readmescrscr.f7589
   [30/05/2008|21:51] C:\ProgramData\Readmescrscr.wqfgcd4
   [15/04/2008|22:34] C:\ProgramData\Readmescrscr.wvq58o
   [24/11/2009|12:54] C:\ProgramData\Real
   [09/08/2009|16:49] C:\ProgramData\Screaming Bee
   [02/11/2006|14:02] C:\ProgramData\Start Menu 
   [08/11/2008|10:15] C:\ProgramData\SURF TWO MESS
   [08/11/2007|22:32] C:\ProgramData\Symantec
   [28/03/2008|20:44] C:\ProgramData\TEMP
   [02/11/2006|14:02] C:\ProgramData\Templates 
   [17/08/2008|17:24] C:\ProgramData\WindowsSearch
   [08/11/2007|23:02] C:\ProgramData\WLInstaller
   [25/08/2008|09:00] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [05/09/2007|15:57] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [05/09/2007|17:08] C:\Program Files\Adobe
   [08/11/2007|22:39] C:\Program Files\Alwil Software
   [07/02/2008|00:04] C:\Program Files\ASUS
   [05/09/2007|16:47] C:\Program Files\Atheros
   [05/09/2007|16:37] C:\Program Files\ATI
   [05/09/2007|16:38] C:\Program Files\ATI Technologies
   [05/09/2007|16:42] C:\Program Files\ATK Hotkey
   [05/09/2007|16:44] C:\Program Files\ATKOSD2
   [21/03/2009|10:16] C:\Program Files\BitTorrent
   [27/06/2008|21:52] C:\Program Files\BoontyGames
   [06/02/2010|12:21] C:\Program Files\Common Files
   [06/08/2008|13:25] C:\Program Files\DivX
   [17/02/2010|18:05] C:\Program Files\DNA
   [26/05/2008|11:27] C:\Program Files\e-Carte Bleue Soci‚t‚ G‚n‚rale
   [30/10/2008|20:25] C:\Program Files\EPSON
   [26/05/2008|11:27] C:\Program Files\InstallShield Installation Information
   [25/01/2010|03:19] C:\Program Files\Internet Explorer
   [10/08/2009|08:44] C:\Program Files\ISO Commander
   [13/02/2010|13:41] C:\Program Files\Java
   [13/11/2007|15:50] C:\Program Files\LimeWire
   [24/11/2007|21:53] C:\Program Files\Lphant
   [06/07/2008|21:29] C:\Program Files\Malwarebytes' Anti-Malware
   [18/11/2009|21:32] C:\Program Files\Microsoft
   [11/11/2007|22:12] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [02/11/2006|13:37] C:\Program Files\Microsoft Games
   [05/09/2007|15:55] C:\Program Files\Microsoft Office
   [05/09/2007|15:55] C:\Program Files\Microsoft Visual Studio
   [09/02/2010|03:10] C:\Program Files\Microsoft Works
   [05/09/2007|15:54] C:\Program Files\Microsoft.NET
   [05/09/2007|16:46] C:\Program Files\Motorola
   [07/07/2008|11:19] C:\Program Files\Movie Maker
   [17/02/2010|18:06] C:\Program Files\Mozilla Firefox
   [02/11/2006|13:37] C:\Program Files\MSBuild
   [18/04/2007|09:43] C:\Program Files\MSXML 4.0
   [17/02/2010|12:39] C:\Program Files\Navilog1
   [05/09/2007|15:59] C:\Program Files\Nero
   [01/03/2008|17:45] C:\Program Files\OpenOffice.org 2.3
   [05/09/2007|17:00] C:\Program Files\P4G
   [05/09/2007|17:00] C:\Program Files\PowerForPhone
   [24/11/2009|12:52] C:\Program Files\Real
   [07/07/2008|18:06] C:\Program Files\Realtek
   [02/11/2006|13:37] C:\Program Files\Reference Assemblies
   [10/08/2009|08:42] C:\Program Files\Return to Castle Wolfenstein
   [09/08/2009|10:36] C:\Program Files\Screaming Bee
   [05/09/2007|16:57] C:\Program Files\Synaptics
   [05/07/2008|09:31] C:\Program Files\Trend Micro
   [02/11/2006|14:01] C:\Program Files\Uninstall Information
   [27/11/2009|09:55] C:\Program Files\VideoLAN
   [07/07/2008|11:19] C:\Program Files\Windows Calendar
   [07/07/2008|11:19] C:\Program Files\Windows Collaboration
   [07/07/2008|11:18] C:\Program Files\Windows Defender
   [07/07/2008|11:19] C:\Program Files\Windows Journal
   [18/11/2009|21:31] C:\Program Files\Windows Live
   [18/11/2009|21:32] C:\Program Files\Windows Live SkyDrive
   [11/02/2010|07:02] C:\Program Files\Windows Mail
   [14/11/2009|08:59] C:\Program Files\Windows Media Player
   [02/11/2006|13:37] C:\Program Files\Windows NT
   [07/07/2008|11:19] C:\Program Files\Windows Photo Gallery
   [07/07/2008|11:19] C:\Program Files\Windows Sidebar
   [05/09/2007|16:50] C:\Program Files\Wireless Console 2
   [22/08/2008|13:35] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [05/09/2007|17:08] C:\Program Files\Common Files\Adobe
   [05/09/2007|16:01] C:\Program Files\Common Files\Ahead
   [28/03/2008|20:48] C:\Program Files\Common Files\BOONTY Shared
   [05/09/2007|15:55] C:\Program Files\Common Files\DESIGNER
   [05/09/2007|16:51] C:\Program Files\Common Files\InstallShield
   [09/11/2007|17:23] C:\Program Files\Common Files\Java
   [05/09/2007|16:01] C:\Program Files\Common Files\LightScribe
   [09/02/2010|03:10] C:\Program Files\Common Files\microsoft shared
   [06/08/2008|13:25] C:\Program Files\Common Files\PX Storage Engine
   [06/02/2010|12:21] C:\Program Files\Common Files\Real
   [02/11/2006|12:18] C:\Program Files\Common Files\Services
   [02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [08/11/2007|22:34] C:\Program Files\Common Files\Symantec Shared
   [07/07/2008|11:18] C:\Program Files\Common Files\System
   [18/11/2009|21:28] C:\Program Files\Common Files\Windows Live
   [08/11/2007|23:07] C:\Program Files\Common Files\WindowsLiveInstaller

   --------------------\  Process

   ( 87 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   C:\ProgramData\Readmescrscr.f7589
   C:\ProgramData\Readmescrscr.wvq58o
   C:\ProgramData\Readmescrscr.6f5ofyw
   C:\ProgramData\Readmescrscr.wqfgcd4
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\ProgramData\beep axis mode free
   C:\ProgramData\SURF TWO MESS
   C:\Users\Noemie\AppData\Local\Temp
sz99A9.tmp
   C:\Users\Noemie\AppData\Roaming\MICROS~1\Windows\Cookies
oemie@advertstream[1].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "PartDent"="\"C:\ProgramData\Readmescrscr.wqfgcd4\""

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2010-02-17 18:08:17
   Windows 6.0.6001 Service Pack 1 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   C:\Windows\System32\wbem\Performance\WmiApRpl_new.h 357 bytes
   scan completed successfully
   hidden processes: 0
   hidden files: 301
 
   --------------------\  Recherche d'autres infections

 
   C:\Users\Noemie\AppData\Local\vnffu.dat
   C:\Users\Noemie\AppData\Local\vnffu.exe
   C:\Users\Noemie\AppData\Local\vnffu_nav.dat
   C:\Users\Noemie\AppData\Local\vnffu_navps.dat
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\Users\Noemie\AppData\Local\Temp\Temp1_ut-cd-crack.zip
   C:\Users\Noemie\AppData\Local\Temp\Temp1_ut-cd-crack.zip\UnrealTournament.exe
   C:\Users\Noemie\AppData\Roaming\Microsoft\Windows\Recent\GTA_DS_CRACK_ARM9+ARM7.nds.lnk
   C:\Users\Noemie\AppData\Roaming\Microsoft\Windows\Recent\GTA_DS_CRACK_ARM9+ARM7.rar.lnk
   C:\Users\Noemie\AppData\Roaming\Microsoft\Windows\Recent\ut-cd-crack.lnk


   [F:1050][D:86]-> C:\Users\Noemie\AppData\Local\Temp
   [F:691][D:1]-> C:\Users\Noemie\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:5449][D:10]-> C:\Users\Noemie\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:5][D:5]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 17/02/2010|18:12 - Option : [1]

   --------------------\  Fin du rapport a 18:12:42
   [ UAC => 1 ]

Destrio5 · Answer

--> Double-clique sur Lop S&D pour le lancer.
(Sous Vista/Win7, il faut cliquer droit sur Lop S&D et choisir Exécuter en tant qu'administrateur) 

--> Choisis cette fois-ci l'option 2 (Suppression).

--> Ne ferme pas la fenêtre lors de la suppression !

--> Poste le rapport généré (C:\lopR.txt).

(Si le Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

alex50300 · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual  CPU  T2310  @ 1.46GHz )
   BIOS : Default System BIOS
   USER : Noemie ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 081212-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total:89 Go (Free:20 Go)
   D:\ (Local Disk) - NTFS - Total:52 Go (Free:18 Go)
   E:\ (CD or DVD)
   G:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 17/02/2010|18:19 )

   [ UAC => 1 ]


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\Users\Noemie\AppData\Local\Temp
sz99A9.tmp
   Supprime! - C:\Users\Noemie\AppData\Roaming\MICROS~1\Windows\Cookies
oemie@advertstream[1].txt
   Supprime! - C:\ProgramData\Readmescrscr.f7589
   Supprime! - C:\ProgramData\Readmescrscr.wvq58o
   Supprime! - C:\ProgramData\Readmescrscr.6f5ofyw
   Supprime! - C:\ProgramData\Readmescrscr.wqfgcd4
   Supprime! - C:\ProgramData\beep axis mode free
   Supprime! - C:\ProgramData\SURF TWO MESS
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans Local

   [14/11/2007|17:35] C:\Users\Noemie\AppData\Local\Adobe
   [01/11/2008|11:04] C:\Users\Noemie\AppData\Local\Ahead
   [08/11/2007|22:15] C:\Users\Noemie\AppData\Local\Application Data 
   [04/08/2009|16:04] C:\Users\Noemie\AppData\Local\Apps
   [15/02/2010|19:06] C:\Users\Noemie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [05/08/2008|12:41] C:\Users\Noemie\AppData\Local\DNA
   [10/02/2010|17:49] C:\Users\Noemie\AppData\Local\GDIPFONTCACHEV1.DAT
   [08/11/2007|22:15] C:\Users\Noemie\AppData\Local\Historique 
   [17/02/2010|18:02] C:\Users\Noemie\AppData\Local\IconCache.db
   [17/02/2010|18:04] C:\Users\Noemie\AppData\Local\jdzcqmad.bat
   [24/11/2007|22:01] C:\Users\Noemie\AppData\Local\Lphant
   [14/08/2008|20:38] C:\Users\Noemie\AppData\Local\Microsoft
   [01/05/2009|20:44] C:\Users\Noemie\AppData\Local\Microsoft Games
   [08/08/2008|18:03] C:\Users\Noemie\AppData\Local\MigWiz
   [06/08/2008|13:15] C:\Users\Noemie\AppData\Local\Mozilla
   [17/02/2010|18:19] C:\Users\Noemie\AppData\Local\Temp
   [08/11/2007|22:15] C:\Users\Noemie\AppData\Local\Temporary Internet Files 
   [28/01/2010|16:56] C:\Users\Noemie\AppData\Local\VirtualStore
   [17/02/2010|18:19] C:\Users\Noemie\AppData\Local\vnffu.dat
   [15/02/2010|19:37] C:\Users\Noemie\AppData\Local\vnffu.exe
   [11/02/2010|19:36] C:\Users\Noemie\AppData\Local\vnffu_nav.dat
   [17/02/2010|18:19] C:\Users\Noemie\AppData\Local\vnffu_navps.dat
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [17/02/2010 18:04][--ah-----] C:\Windows	asks\SA.DAT
   [17/02/2010 18:02][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [05/09/2007|15:57] C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}
   [05/09/2007|17:08] C:\ProgramData\Adobe
   [02/11/2006|14:02] C:\ProgramData\Application Data 
   [08/11/2007|22:55] C:\ProgramData\ASUS
   [05/09/2007|16:47] C:\ProgramData\Atheros
   [28/03/2008|20:48] C:\ProgramData\BOONTY
   [02/11/2006|14:02] C:\ProgramData\Desktop 
   [02/11/2006|14:02] C:\ProgramData\Documents 
   [19/11/2007|13:02] C:\ProgramData\EPSON
   [02/11/2006|14:02] C:\ProgramData\Favorites 
   [08/11/2007|22:21] C:\ProgramData\LightScribe
   [06/07/2008|21:29] C:\ProgramData\Malwarebytes
   [18/11/2009|21:28] C:\ProgramData\Microsoft
   [11/02/2010|06:59] C:\ProgramData\Microsoft Help
   [05/09/2007|15:59] C:\ProgramData\Nero
   [14/11/2009|08:25] C:\ProgramData\NOS
   [05/09/2007|17:00] C:\ProgramData\P4G
   [24/11/2009|12:54] C:\ProgramData\Real
   [09/08/2009|16:49] C:\ProgramData\Screaming Bee
   [02/11/2006|14:02] C:\ProgramData\Start Menu 
   [08/11/2007|22:32] C:\ProgramData\Symantec
   [28/03/2008|20:44] C:\ProgramData\TEMP
   [02/11/2006|14:02] C:\ProgramData\Templates 
   [17/08/2008|17:24] C:\ProgramData\WindowsSearch
   [08/11/2007|23:02] C:\ProgramData\WLInstaller
   [25/08/2008|09:00] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [05/09/2007|15:57] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [05/09/2007|17:08] C:\Program Files\Adobe
   [08/11/2007|22:39] C:\Program Files\Alwil Software
   [07/02/2008|00:04] C:\Program Files\ASUS
   [05/09/2007|16:47] C:\Program Files\Atheros
   [05/09/2007|16:37] C:\Program Files\ATI
   [05/09/2007|16:38] C:\Program Files\ATI Technologies
   [05/09/2007|16:42] C:\Program Files\ATK Hotkey
   [05/09/2007|16:44] C:\Program Files\ATKOSD2
   [21/03/2009|10:16] C:\Program Files\BitTorrent
   [27/06/2008|21:52] C:\Program Files\BoontyGames
   [06/02/2010|12:21] C:\Program Files\Common Files
   [06/08/2008|13:25] C:\Program Files\DivX
   [17/02/2010|18:05] C:\Program Files\DNA
   [26/05/2008|11:27] C:\Program Files\e-Carte Bleue Soci‚t‚ G‚n‚rale
   [30/10/2008|20:25] C:\Program Files\EPSON
   [26/05/2008|11:27] C:\Program Files\InstallShield Installation Information
   [25/01/2010|03:19] C:\Program Files\Internet Explorer
   [10/08/2009|08:44] C:\Program Files\ISO Commander
   [13/02/2010|13:41] C:\Program Files\Java
   [13/11/2007|15:50] C:\Program Files\LimeWire
   [24/11/2007|21:53] C:\Program Files\Lphant
   [06/07/2008|21:29] C:\Program Files\Malwarebytes' Anti-Malware
   [18/11/2009|21:32] C:\Program Files\Microsoft
   [11/11/2007|22:12] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [02/11/2006|13:37] C:\Program Files\Microsoft Games
   [05/09/2007|15:55] C:\Program Files\Microsoft Office
   [05/09/2007|15:55] C:\Program Files\Microsoft Visual Studio
   [09/02/2010|03:10] C:\Program Files\Microsoft Works
   [05/09/2007|15:54] C:\Program Files\Microsoft.NET
   [05/09/2007|16:46] C:\Program Files\Motorola
   [07/07/2008|11:19] C:\Program Files\Movie Maker
   [17/02/2010|18:06] C:\Program Files\Mozilla Firefox
   [02/11/2006|13:37] C:\Program Files\MSBuild
   [18/04/2007|09:43] C:\Program Files\MSXML 4.0
   [17/02/2010|12:39] C:\Program Files\Navilog1
   [05/09/2007|15:59] C:\Program Files\Nero
   [01/03/2008|17:45] C:\Program Files\OpenOffice.org 2.3
   [05/09/2007|17:00] C:\Program Files\P4G
   [05/09/2007|17:00] C:\Program Files\PowerForPhone
   [24/11/2009|12:52] C:\Program Files\Real
   [07/07/2008|18:06] C:\Program Files\Realtek
   [02/11/2006|13:37] C:\Program Files\Reference Assemblies
   [10/08/2009|08:42] C:\Program Files\Return to Castle Wolfenstein
   [09/08/2009|10:36] C:\Program Files\Screaming Bee
   [05/09/2007|16:57] C:\Program Files\Synaptics
   [05/07/2008|09:31] C:\Program Files\Trend Micro
   [02/11/2006|14:01] C:\Program Files\Uninstall Information
   [27/11/2009|09:55] C:\Program Files\VideoLAN
   [07/07/2008|11:19] C:\Program Files\Windows Calendar
   [07/07/2008|11:19] C:\Program Files\Windows Collaboration
   [07/07/2008|11:18] C:\Program Files\Windows Defender
   [07/07/2008|11:19] C:\Program Files\Windows Journal
   [18/11/2009|21:31] C:\Program Files\Windows Live
   [18/11/2009|21:32] C:\Program Files\Windows Live SkyDrive
   [11/02/2010|07:02] C:\Program Files\Windows Mail
   [14/11/2009|08:59] C:\Program Files\Windows Media Player
   [02/11/2006|13:37] C:\Program Files\Windows NT
   [07/07/2008|11:19] C:\Program Files\Windows Photo Gallery
   [07/07/2008|11:19] C:\Program Files\Windows Sidebar
   [05/09/2007|16:50] C:\Program Files\Wireless Console 2
   [22/08/2008|13:35] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [05/09/2007|17:08] C:\Program Files\Common Files\Adobe
   [05/09/2007|16:01] C:\Program Files\Common Files\Ahead
   [28/03/2008|20:48] C:\Program Files\Common Files\BOONTY Shared
   [05/09/2007|15:55] C:\Program Files\Common Files\DESIGNER
   [05/09/2007|16:51] C:\Program Files\Common Files\InstallShield
   [09/11/2007|17:23] C:\Program Files\Common Files\Java
   [05/09/2007|16:01] C:\Program Files\Common Files\LightScribe
   [09/02/2010|03:10] C:\Program Files\Common Files\microsoft shared
   [06/08/2008|13:25] C:\Program Files\Common Files\PX Storage Engine
   [06/02/2010|12:21] C:\Program Files\Common Files\Real
   [02/11/2006|12:18] C:\Program Files\Common Files\Services
   [02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [08/11/2007|22:34] C:\Program Files\Common Files\Symantec Shared
   [07/07/2008|11:18] C:\Program Files\Common Files\System
   [18/11/2009|21:28] C:\Program Files\Common Files\Windows Live
   [08/11/2007|23:07] C:\Program Files\Common Files\WindowsLiveInstaller

   --------------------\  Process

   ( 88 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2010-02-17 18:19:29
   Windows 6.0.6001 Service Pack 1 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 300
 
   --------------------\  Recherche d'autres infections

 
   C:\Users\Noemie\AppData\Local\vnffu.dat
   C:\Users\Noemie\AppData\Local\vnffu.exe
   C:\Users\Noemie\AppData\Local\vnffu_nav.dat
   C:\Users\Noemie\AppData\Local\vnffu_navps.dat
   [b]==> EGDACCESS <==/b

   --------------------\  Cracks & Keygens ..

   C:\Users\Noemie\AppData\Local\Temp\Temp1_ut-cd-crack.zip
   C:\Users\Noemie\AppData\Local\Temp\Temp1_ut-cd-crack.zip\UnrealTournament.exe
   C:\Users\Noemie\AppData\Roaming\Microsoft\Windows\Recent\GTA_DS_CRACK_ARM9+ARM7.nds.lnk
   C:\Users\Noemie\AppData\Roaming\Microsoft\Windows\Recent\GTA_DS_CRACK_ARM9+ARM7.rar.lnk
   C:\Users\Noemie\AppData\Roaming\Microsoft\Windows\Recent\ut-cd-crack.lnk


   [F:1049][D:86]-> C:\Users\Noemie\AppData\Local\Temp
   [F:690][D:1]-> C:\Users\Noemie\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:5457][D:10]-> C:\Users\Noemie\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:5][D:5]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 17/02/2010|18:12 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 17/02/2010|18:23 - Option : [2]

   --------------------\  Fin du rapport a 18:23:27
   [ UAC => 1 ]

Destrio5 · Answer

On va s'occuper de l'infection Navipromo maintenant.

&#9679; Télécharge Ad-Remover (de C_XX) sur ton Bureau.

/!\ Déconnecte-toi d'Internet et ferme toutes applications en cours. /!\

&#9679; Double-clique sur le programme AD-R situé sur ton Bureau.
(Sous Vista/Win7, il faut cliquer droit sur AD-R et choisir Exécuter en tant qu'administrateur)
&#9679; Choisis la langue F pour Français.
&#9679; Au menu principal, choisis l'option L.
&#9679; Poste le rapport généré (C:\Ad-Report-CLEAN.log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Kaspersky, etc.) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

alex50300 · Answer

======= RAPPORT D'AD-REMOVER 1.1.4.6_J | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 05.02.2010 à 17:34
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:34:08, 17/02/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\
Système d'exploitation: Microsoft® Windows Vista™ HomePremium Service Pack 2 v6.0.6001
Nom du PC: PC-DE-NOEMIE | Utilisateur actuel: Noemie
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\Users\Noemie\AppData\Local\jdzcqmad.bat 
C:\Users\Noemie\AppData\Local\vnffu.dat 
C:\Users\Noemie\AppData\Local\vnffu.exe 
C:\Users\Noemie\AppData\Local\vnffu_nav.dat 
C:\Users\Noemie\AppData\Local\vnffu_navps.dat 

(!) -- Fichiers temporaires supprimés.
 
.
HKCU\software\fcn
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\vnffu 
HKLM\software\microsoft\windows\currentversion\uninstall\vnffu
.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.5.7 [fr] *
.
 Nom du profil: ts9flga5.default (Noemie)
.
(Noemie, prefs.js) Browser.download.dir, C:\Users\Noemie	elechargement internet
(Noemie, prefs.js) Browser.download.lastDir, C:\Users\Noemie\Pictures
(Noemie, prefs.js) Browser.search.defaultenginename, Google
(Noemie, prefs.js) Browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
(Noemie, prefs.js) Browser.search.selectedEngine, Google
(Noemie, prefs.js) Extensions.enabledItems, {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07,{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}:6.0.10,{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11,{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14,{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17,{20a82645-c095-46ed-80e3-08825760534b}:1.1,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.7
. 
.
* Internet Explorer Version 7.0.6001.18000 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Start Page: hxxp://fr.msn.com/
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Users\Noemie\AppData\Local\Temp\Temp1_ut-cd-crack.zip
C:\Users\Noemie\AppData\Local\Temp\Temp1_Modifier une rom NDS.zip\Modifier une rom NDS by SpyMaster\DSlazy
dspatch.exe
C:\Users\Noemie\AppData\Local\Temp\Temp1_ut-cd-crack.zip\UnrealTournament.exe
C:\Users\Noemie\AppData\Roaming\BitTorrent\GTA_Chinatown_Wars_Patcher.torrent
C:\Users\Noemie\Documents\Downloads\GTA_Chinatown_Wars_Patcher\The Patch\xdelta.exe
.
===================================
.
3379 Octet(s) - C:\Ad-Report-CLEAN[1].log 
.
809 Fichier(s) - C:\Users\Noemie\AppData\Local\Temp 
67 Fichier(s) - C:\Windows\Temp 
12 Fichier(s) - C:\Windows\Prefetch 
.
20 Fichier(s) - C:\Ad-Remover\BACKUP
5 Fichier(s) - C:\Ad-Remover\QUARANTINE
.
Fin à: 18:39:48 | 17/02/2010 - CLEAN[1]
.
============== E.O.F ==============
.

Destrio5 · Answer

--> Désinstalle Ad-Remover.

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\Rsit.

alex50300 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Noemie at 2010-02-17 19:01:25
Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 1
System drive C: has 22 GB (24%) free of 92 GB
Total RAM: 2047 MB (30% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:01:59, on 17/02/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\ASUSTPE.exe
C:\Windows\ASScrPro.exe
C:\Program Files\PowerForPhone\PowerForPhone.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\e-Carte Bleue Société Générale\ecbl-sg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ASUS\ASUS Live Update\LiveUpdt.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Noemie\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Noemie.exe
C:\Windows\system32\WerFault.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ASUSTPE] C:\Windows\system32\ASUSTPE.exe
O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKLM\..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S362.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series (Copie 1)] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S3138.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe"  -osboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: e-Carte Bleue Société Générale.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\Windows\System32\StkCSrv.exe

Destrio5 · Answer

--> Télécharge UsbFix (par El Desaparecido & C_XX) sur ton Bureau.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le programme UsbFix situé sur ton Bureau.

--> Choisis l'option 1 (Recherche).

--> Laisse travailler l'outil.

--> Poste le rapport UsbFix.txt.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.

alex50300 · Answer

############################## | UsbFix V6.095 |

User : Noemie (Administrateurs) # PC-DE-NOEMIE
Update on 15/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 20:03:53 | 17/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) Dual  CPU  T2310  @ 1.46GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1229 [VPS 081212-0] 4.8.1229 [ Enabled | Updated ]

C:\ -> Disque fixe local # 89,43 Go (21,45 Go free) [VistaOS] # NTFS
D:\ -> Disque fixe local # 52,78 Go (18,61 Go free) [DATA] # NTFS
E:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque fixe local # 37,24 Go (2,13 Go free) [LACIE] # FAT32

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\StkCSrv.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\ACEngSvr.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\ASUSTPE.exe
C:\Windows\ASScrPro.exe
C:\Program Files\PowerForPhone\PowerForPhone.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\e-Carte Bleue Société Générale\ecbl-sg.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32	askeng.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\wbem\wmiprvse.exe

################## | Elements infectieux |

C:\Users\Noemie\AppData\Local\Temp\Setup.exe  

################## | Registre |


################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{185a64c1-088d-11dd-896f-001d6061cffb}
shell\Auto\command =AdobeR.exe e
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

HKCU\..\..\Explorer\MountPoints2\{c0ea8b5f-062b-11dd-8202-001d6061cffb}
shell\AutoRun\command =C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe .MS32DLL.dll.vbs

################## | Vaccin |

(!) Cet ordinateur n'est pas vacciné !  

################## | ! Fin du rapport # UsbFix V6.095 ! |

Destrio5 · Answer

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur UsbFix présent sur ton Bureau.

--> Choisis l'option 2 (Suppression).

--> Ton Bureau disparaîtra et le PC redémarrera.

--> Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.

--> Ensuite, poste le rapport UsbFix.txt qui apparaîtra avec le Bureau.

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque (C:\UsbFix.txt).

alex50300 · Answer

############################## | UsbFix V6.095 |

User : Noemie (Administrateurs) # PC-DE-NOEMIE
Update on 15/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 09:35:36 | 18/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Pentium(R) Dual  CPU  T2310  @ 1.46GHz
Microsoft® Windows Vista™ Édition Familiale Premium  (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Enabled
AV : avast! antivirus 4.8.1229 [VPS 081212-0] 4.8.1229 [ Enabled | Updated ]

C:\ -> Disque fixe local # 89,43 Go (24,3 Go free) [VistaOS] # NTFS
D:\ -> Disque fixe local # 52,78 Go (18,48 Go free) [DATA] # NTFS
E:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque fixe local # 37,24 Go (2,13 Go free) [LACIE] # FAT32

############################## | Processus actifs |

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\StkCSrv.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Windows\Explorer.EXE
C:\Windows\system32unonce.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\ASUS\Splendid\ACMON.exe

################## | Elements infectieux |

Supprimé ! C:\Users\Noemie\AppData\Local\Temp\utt8881.tmp.exe 
Supprimé ! C:\Users\Noemie\AppData\Local\Temp\utt8A2A.tmp.exe 
Supprimé ! C:\Users\Noemie\AppData\Local\Temp\uttE052.tmp.exe 
Supprimé ! C:\Users\Noemie\AppData\Local\Temp\9t23C5D.exe 
Supprimé ! C:\Users\Noemie\AppData\Local\Temp\Setup.exe 
Supprimé ! C:\$Recycle.Bin\S-1-5-20 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2152478756-3922319563-605102323-500 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2435646319-3308023911-493739753-1000 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-2435646319-3308023911-493739753-500 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-4166659471-477811567-471052203-500 
Supprimé ! D:\$Recycle.Bin\S-1-5-20 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2435646319-3308023911-493739753-1000 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-2435646319-3308023911-493739753-500 

################## | Registre |


################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{185a64c1-088d-11dd-896f-001d6061cffb}\Shell\Auto\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{c0ea8b5f-062b-11dd-8202-001d6061cffb}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[02/11/2006 13:41|--a------|225280] C:\$$DeleteMe.tquery.dll.mui.01c8232a4f77bb07.0000 
[17/02/2010 18:39|--a------|3721] C:\Ad-Report-CLEAN[1].log 
[18/09/2006 22:43|--a------|24] C:\autoexec.bat 
[19/01/2008 08:45|-rahs----|333203] C:\bootmgr 
[18/04/2007 10:26|-ra-s----|8192] C:\BOOTSECT.BAK 
[04/04/2007 05:01|--a------|19] C:\CA12.txt 
[18/09/2006 22:43|--a------|10] C:\config.sys 
[05/09/2007 17:25|--a------|18322] C:\devlist.txt 
[22/06/2007 01:31|-rah-----|524288] C:\F5VL.ROM 
[22/06/2007 01:30|--a------|16] C:\F5VL_Vista.10 
[09/08/2009 10:39|--a------|0] C:\fftoutput.txt 
[05/09/2007 17:21|--a------|9] C:\Finish.log 
[05/07/2008 09:12|--a------|1233] C:\fixnavi.txt 
[?|?|?] C:\hiberfil.sys 
[17/02/2010 18:23|--a------|10878] C:\lopR.txt 
[15/04/2007 00:26|--a------|27] C:\NERO.LOG 
[16/03/2007 00:18|--a------|25] C:\OFFICE2007_A.TXT 
[?|?|?] C:\pagefile.sys 
[19/07/2007 00:40|--a------|508] C:\Patch.LOG 
[05/09/2007 16:46|--a------|372] C:\RHDSetup.log 
[16/05/2006 01:22|--a------|5] C:\Store.LOG 
[18/02/2010 09:38|--a------|5268] C:\UsbFix.txt 
[18/04/2007 03:55|--a------|18] C:\V52.TXT 
[13/11/2008 22:57|--a------|0] C:\wizard.txt 
[22/08/2009 11:13|--a------|790528] D:\20 ans Melinda.MSWMM 
[14/08/2009 21:59|--a------|1715380] D:\img026.jpg 
[14/08/2009 22:00|--a------|1576498] D:\img027.jpg 
[27/08/2009 21:17|--a------|149787648] H:\OOo_3.1.0_Win32Intel_install_wJRE_fr.exe 
[27/08/2009 21:11|--a------|37897320] H:\setupfre(2).exe 
[27/08/2009 21:09|--a------|17828326] H:\vlc-1.0.0-win32.exe 
[28/08/2009 13:15|--a------|141491208] H:\100_215_DJ_AIO_03_F2200_Full_NonNet_enu_NB.exe 

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 
# H:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 

################## | Upload | 

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_PC-de-Noemie.zip : https://www.ionos.fr/?affiliate_id=77097 
Merci pour votre contribution .  

################## | ! Fin du rapport # UsbFix V6.095 ! |

Fenetre pub qui s'ouvre toute seule

12 réponses

Votre réponse

Discussions similaires

Newsletters