Mon pc rame Résolu

Question

Bonjour,
Depuis lundi mon pc rame, j'aimerais savoir s'il  est infecté merci de votre aide
voici les 2 fichiers  textes que j'ai fait avec Random

Logfile of random's system information tool 1.06 (written by random/random)
Run by Soria at 2010-02-18 20:03:54
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 16 GB (14%) free of 116 GB
Total RAM: 1023 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:03:57, on 18/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Soria\Bureau\RSIT.exe
C:\Documents and Settings\Soria\Bureau\Soria.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://signin.ebay.fr/ws/eBayISAPI.dll?SignIn&UsingSSL=1&pUserId=&co_partnerId=2&siteid=71&ru=https%3A%2F%2Fmy.ebay.fr%2Fws%2FeBayISAPI.dll%3FMyEbayBeta%26MyeBay%3D%26CurrentPage%3DMyeBaySelling%26ssPageName%3DSTRK%253AME%253ALNLK%26guest%3D1&pageType=3984
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60446
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60446
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\ctbr.dll
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: (no name) - {C48F0939-992C-45C8-A9C2-B97A22D9B4BD} - (no file)
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AOL Dialer] C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F89B3CE-5706-40EA-9F6E-62C6BFF04DFC}: NameServer = 80.118.192.100,80.118.196.36
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7AD884B-CCB5-4D8E-8137-19079D3267A8}: NameServer = 192.168.1.1
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Unknown owner - C:\Program Files\Inventel\Add-on\wlancfg.exe (file missing)

jacques.gache · Answer

bonjour, d'entrée sur ton rapport il y a bien des chose infectieuse , mais aussi la présencede 2 anti-virus car tu as norton et antivir d'actif sur le pc et cela pour le ralentir voir le planter c'est pas mal !! 
tu me dira celui que tu veux désinstaller et je te donnerais la procédure pour.

sinon pour pas perdre trop de temps dans ton problème pour le côté infection tu fais ce qui suit , Merci

1) passes ad-remover option L

• Télécharge Ad-remover ( de C_XX ) sur ton bureau : 

https://www.androidworld.fr/

! Déconnecte toi et ferme toutes applications en cours ! 

• Double clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut . 

• Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
 
• Au menu principal choisis l'option "L" et tape sur [entrée] .

• Laisse travailler l'outil et ne touche à rien ... 

--> Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé sous C:\Ad-report-clean.log ) 

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 



2) passes usbfix option 2

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


• Télécharges et installes : http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
 

 (!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

• Double clic sur le raccourci UsbFix présent sur ton bureau .

• choisis l'option 2 ( Suppression )

• Ton bureau disparaitra et le pc redémarrera .

• Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

• Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Pendant son nettoyage, l'outil a récolté certains fichiers infectieux.
Nous vous demandons de nous les faire parvenir pour des futures mises à jour, ainsi que pour un meilleur traitement des infections.
Nous vous remercions pour votre contribution.

. UsbFix te proposera d'uploader un dossier compressé à cette adresse : https://www.ionos.fr/?affiliate_id=77097

Ce dossier a été créé par UsbFix et est enregistré sur ton bureau.

Merci de l'envoyer à l'adresse indiquée afin d'aider l'auteur de UsbFix dans ses recherches.

Merci d'avance pour ta contribution !!

jacques.gache · Answer

bonjour, ok tu vas virer norton depuis ajout suppression des programmes si tu pouvais le faire en mode sans echec cela serait mieux , et puis tu passeras l'outil spéciphique de chez sysmantec , et tu posteras un hijackthis pour contrôle , merci 

1) désinstalles norton de dans tes programmes en mode sans echec 

 pour redémarrer en mode sans échec : /!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\ 
 
(attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

.Cliques sur Démarrer
.Cliques sur Arrêter
.Sélectionnes Redémarrer et au redémarrage
.Appuis sur la touche F8 ou F5 celon les marques de pc sans discontinuer "1 appuis seconde" dès qu'un écran de texte apparaît puis disparaît
.Utilises les touches de direction pour sélectionner mode sans échec
.puis appuis sur ENTRÉE
.Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre
une fois démarré ne t'inquiette pas si les couleurs et les icônes ne sont pas comme d'abitude 

tuto:http://www.vista-xp.fr/forum/topic93.html



2) passes cet outil 

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

en fin desuppression il ouvre une page comment réinstaller un produit symantec tu la ferme tous simplement c'est une pub !!



3) postes un hijackthis de contrôle 

télécharge Hijackthis : http://www.trendsecure.com/portal/fr/_download/HJTInstall.exe


.enregistres le sur le bureau
.Tu fermes tout les programmes ouverts y compris le navigateur. sauf ton anti-virus et pare-feux
.installes le , il va s'installer par défaut dans C:\Program Files\Trend Micro\HijackThis
.Cliques sur "Do a system scan and save the logfile"
.Cela va t'ouvrir un bloc note à la fin du scan.
.Copie son contenu et poste le dans ton prochain message. sinon le rapport est dans C:\Program Files\Trend Micro\HijackThis\ hijackthis "document texte"


si besion d'aide pour l'installation  : https://www.androidworld.fr/


des expliquations en images pour l'utiliser : http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm

balto64 · Answer

bonsoir, voici le rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:30:23, on 19/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Bureau\Soria.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://signin.ebay.fr/ws/eBayISAPI.dll?SignIn&UsingSSL=1&pUserId=&co_partnerId=2&siteid=71&ru=https%3A%2F%2Fmy.ebay.fr%2Fws%2FeBayISAPI.dll%3FMyEbayBeta%26MyeBay%3D%26CurrentPage%3DMyeBaySelling%26ssPageName%3DSTRK%253AME%253ALNLK%26guest%3D1&pageType=3984
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: (no name) - {C48F0939-992C-45C8-A9C2-B97A22D9B4BD} - (no file)
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AOL Dialer] C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F89B3CE-5706-40EA-9F6E-62C6BFF04DFC}: NameServer = 80.118.192.100,80.118.196.36
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7AD884B-CCB5-4D8E-8137-19079D3267A8}: NameServer = 192.168.1.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Unknown owner - C:\Program Files\Inventel\Add-on\wlancfg.exe (file missing)

jacques.gache · Answer

bonjour, et comment va le pc  il y a quelque lignes supperflut à fixer et finaliser le nettoyage

balto64 · Answer

Bonsoir, 
j'ai l'impression qu'il rame moins est ce que le nettoyage est terminé, pourriez-vous me dire
s'il faut supprimer des programmes inutiles

jacques.gache · Answer

fais un examem complet de ton pc avec malwarebytes 

Télécharge Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe


. enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. si le pare-feu demande l'autorisation  de se connecter pour malwarebytes, acceptes
. rend-toi dans l'onglet, Recherche
. Sélectionnes  Exécuter un examen complet
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, cliques sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. redemarre le pc si il le fait pas lui même
. une fois redémarré  double-cliques sur malwarebytes
. rends toi dans l'onglet rapport/log
. tu cliques dessus pour l'afficher une fois affiché
. tu cliques sur edition en haut du boc notes,et puis sur sélectionner tous
. tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller


Si tu as besoin d'aide regarde ce tutoriel :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

balto64 · Answer

voici le rapport

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

20/02/2010 00:03:22
mbam-log-2010-02-20 (00-03-22).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 204314
Temps écoulé: 48 minute(s), 58 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

jacques.gache · Answer

bonjour, tu fais ce qui suis , merci 

1) Desactive ton antivirus le temps de la manip ainsi que ton parefeu si présent(car il est detecté a tort comme infection) 

. Télécharge List&Kill'em et enregistre le sur ton bureau 

. Branche clés usb , disques durs externes , mp3 , mp4 , etc.. 

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation 

coche la case "creer une icone sur le bureau" 

une fois terminée , clic sur "terminer" et le programme se lancera seul 

choisis la langue puis choisis l'option 1 = Mode Recherche 

. laisse travailler l'outil 

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué. 

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , mais ne le supprime pas pour l instant, le scan n'est pas fini. 

. Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED" 

tu peux supprimer le rapport catchme.log de ton bureau maintenant.


 

==============================
 


2) . Relance List&Kill'em(soit en clic droit pour vista),avec le raccourci sur ton bureau. 
mais cette fois-ci : 

. choisis l'option 2 = Mode Suppression 

laisse travailler l'outil. 

en fin de scan un rapport s'ouvre 

. colle le contenu dans ta reponse

balto64 · Answer

bonjour, 
voici le rapport

List'em by g3n-h@ckm@n 1.2.7.0

User : Soria (Administrateurs) 
Update on 23/02/2010 by g3n-h@ckm@n ::::: 16.30 
Start at: 08:24:47 | 24/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) 64 X2 Dual Core Processor 4200+
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local | 113,27 Go (15,25 Go free) [ACER] | NTFS
D:\ -> Disque fixe local | 113,73 Go (88,4 Go free) [ACERDATA] | FAT32
E:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local | 931,51 Go (452,84 Go free) [Packard Bell] | NTFS
K:\ -> Disque amovible
M:\ -> Disque fixe local | 152,66 Go (9,08 Go free) [Externe] | NTFS

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Soria\Local Settings\Temp\18.tmp\pv.exe

======================
Keys "Run" 
======================
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
CTFMON.EXE	REG_SZ         	C:\WINDOWS\system32\ctfmon.exe
AOL Dialer	REG_SZ         	C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
SUPERAntiSpyware	REG_SZ         	C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
Google Update	REG_SZ         	"C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
LogitechSoftwareUpdate	REG_SZ         	"C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
ccleaner	REG_SZ         	"C:\Program Files\CCleaner\ccleaner.exe" /AUTO
swg	REG_SZ         	C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
ehTray	REG_SZ         	C:\WINDOWS\ehome\ehtray.exe 
LaunchApp	REG_SZ         	Alaunch 
RTHDCPL	REG_SZ         	RTHDCPL.EXE 
SkyTel	REG_SZ         	SkyTel.EXE 
IMJPMIG8.1	REG_SZ         	"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 
IMEKRMIG6.1	REG_SZ         	C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE 
MSPY2002	REG_SZ         	C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC 
PHIME2002ASync	REG_SZ         	C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC 
PHIME2002A	REG_SZ         	C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName 
Acer Empowering Technology Monitor	REG_SZ         	C:\WINDOWS\system32\SysMonitor.exe 
eDataSecurity Loader	REG_SZ         	C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1 
eRecoveryService	REG_SZ         	C:\Acer\Empowering Technology\eRecovery\eRAgent.exe 
AOLSAV	REG_SZ         	C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe 
SSBkgdUpdate	REG_SZ         	"C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot 
OpwareSE4	REG_SZ         	"C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" 
SpywareTerminator	REG_SZ         	"C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" 
QuickTime Task	REG_SZ         	"C:\Program Files\QuickTime\qttask.exe" -atboottime 
avgnt	REG_SZ         	"C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min 
NvCplDaemon	REG_SZ         	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
NvMediaCenter	REG_SZ         	RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
LVCOMSX	REG_SZ         	C:\WINDOWS\system32\LVCOMSX.EXE 
LogitechVideoRepair	REG_SZ         	C:\Program Files\Logitech\Video\ISStart.exe  
LogitechVideoTray	REG_SZ         	C:\Program Files\Logitech\Video\LogiTray.exe 
Adobe Reader Speed Launcher	REG_SZ         	"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
Adobe ARM	REG_SZ         	"C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" 
iTunesHelper	REG_SZ         	"C:\Program Files\iTunes\iTunesHelper.exe" 
HostManager	REG_SZ         	C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe 
AOLDialer	REG_SZ         	C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe 
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\avp6_post_uninstall 
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

=====================
Other Keys
=====================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] 
dontdisplaylastusername	REG_DWORD      	0 (0x0) 
legalnoticecaption	REG_SZ         	 
legalnoticetext	REG_SZ         	 
shutdownwithoutlogon	REG_DWORD      	1 (0x1) 
undockwithoutlogon	REG_DWORD      	1 (0x1) 
InstallVisualStyle	REG_EXPAND_SZ  	C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles 
InstallTheme	REG_EXPAND_SZ  	C:\WINDOWS\Resources\Themes\Royale.theme 
HideLegacyLogonScripts	REG_DWORD      	0 (0x0) 
HideLogoffScripts	REG_DWORD      	0 (0x0) 
RunLogonScriptSync	REG_DWORD      	1 (0x1) 
RunStartupScriptSync	REG_DWORD      	0 (0x0) 
HideStartupScripts	REG_DWORD      	0 (0x0) 

===============
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveTypeAutoRun	REG_DWORD      	255 (0xff) 
Nouvelle valeur #1	REG_BINARY     	00000001 
NoDriveAutoRun	REG_DWORD      	255 (0xff) 
HonorAutoRunSetting	REG_DWORD      	0 (0x0) 

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] 
NoDriveAutoRun	REG_DWORD      	255 (0xff) 
NoDriveTypeAutoRun	REG_DWORD      	255 (0xff) 
HonorAutoRunSetting	REG_DWORD      	0 (0x0) 

=============== 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLS	REG_SZ         	

===============
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 
 AutoRestartShell	REG_DWORD      	1 (0x1) 
 DefaultUserName	REG_SZ         	Soria 
 LegalNoticeCaption	REG_SZ         	 
 LegalNoticeText	REG_SZ         	 
 PowerdownAfterShutdown	REG_SZ         	0 
 ReportBootOk	REG_SZ         	1 
 Shell	REG_SZ         	explorer.exe 
 ShutdownWithoutLogon	REG_SZ         	0 
 System	REG_SZ         	 
 Userinit	REG_SZ         	C:\WINDOWS\system32\userinit.exe, 
 VmApplet	REG_SZ         	rundll32 shell32,Control_RunDLL "sysdm.cpl" 
 SfcQuota	REG_DWORD      	-1 (0xffffffff) 
 allocatecdroms	REG_SZ         	0 
 allocatedasd	REG_SZ         	0 
 allocatefloppies	REG_SZ         	0 
 cachedlogonscount	REG_SZ         	10 
 forceunlocklogon	REG_DWORD      	0 (0x0) 
 passwordexpirywarning	REG_DWORD      	14 (0xe) 
 scremoveoption	REG_SZ         	0 
 AllowMultipleTSSessions	REG_DWORD      	1 (0x1) 
 UIHost	REG_EXPAND_SZ  	logonui.exe 
 LogonType	REG_DWORD      	1 (0x1) 
 Background	REG_SZ         	0 0 0 
 DebugServerCommand	REG_SZ         	no 
 SFCDisable	REG_DWORD      	0 (0x0) 
 WinStationsDisabled	REG_SZ         	0 
 HibernationPreviouslyEnabled	REG_DWORD      	1 (0x1) 
 ShowLogonOptions	REG_DWORD      	0 (0x0) 
 AltDefaultUserName	REG_SZ         	Soria 
 AltDefaultDomainName	REG_SZ         	MOMO 
 DefaultDomainName	REG_SZ         	MOMO 
 ChangePasswordUseKerberos	REG_DWORD      	1 (0x1) 

===============
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\!SASWinLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\crypt32chain]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cryptnet]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cscdll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\dimsntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\ScCertProp]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\Schedule]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\sclgntfy]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\SensLogn]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify	ermsrv]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\WgaLogon]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\wlballoon]

===============
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
{AEB6717E-7E19-11d0-97EE-00C04FD91972}	REG_SZ         	 
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}	REG_SZ         	 

===============
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe	REG_SZ         	C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe	REG_SZ         	C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE	REG_SZ         	C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook
C:\Program Files\Messenger\msmsgs.exe	REG_SZ         	C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe	REG_SZ         	C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe:*:Enabled:AOL Loader
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\Real\RealPlayerealplay.exe	REG_SZ         	C:\Program Files\Real\RealPlayerealplay.exe:*:Disabled:RealPlayer
C:\Program Files\AOL 9.0\waol.exe	REG_SZ         	C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL
C:\Program Files\Fichiers communs\AOL\1172324924\ee\aolsoftware.exe	REG_SZ         	C:\Program Files\Fichiers communs\AOL\1172324924\ee\aolsoftware.exe:*:Enabled:AOL Shared Components
C:\Program Files\MSN Messenger\livecall.exe	REG_SZ         	C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
C:\Program Files\iTunes\iTunes.exe	REG_SZ         	C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe	REG_SZ         	C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe:*:Enabled:Malwarebytes' Anti-Malware

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
%windir%\system32\sessmgr.exe	REG_SZ         	%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe	REG_SZ         	C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe:*:Enabled:AOL
C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe	REG_SZ         	C:\Program Files\Fichiers communs\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
C:\Program Files\AOL 9.0b\waol.exe	REG_SZ         	C:\Program Files\AOL 9.0b\waol.exe:*:Enabled:AOL
C:\Program Files\AOL 9.0a\waol.exe	REG_SZ         	C:\Program Files\AOL 9.0a\waol.exe:*:Enabled:AOL
%windir%\Network Diagnostic\xpnetdiag.exe	REG_SZ         	%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
C:\Program Files\AOL 9.0\waol.exe	REG_SZ         	C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL
C:\Program Files\MSN Messenger\livecall.exe	REG_SZ         	C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
C:\Program Files\Windows Live\Messenger\wlcsdk.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
C:\Program Files\Windows Live\Messenger\msnmsgr.exe	REG_SZ         	C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger

===============
ActivX controls
===============
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{166B1BCA-3F9C-11CF-8075-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{D27CDB6E-AE6D-11CF-96B8-444553540000}

===============
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\KB910393
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0291E591-EA41-4c82-8106-3DC6CE7F7664}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{04F81CB6-8AAE-D6DD-2C5F-0E6BF4D2540E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1325db73-d9f1-48f8-8895-6d814ec58889}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1BC46932-21B2-4130-86E0-B4EB4F7A7A7B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{30528230-99F7-4BB4-88D8-FA1D4F56A2AB}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{347B0667-C7ED-429B-BDE3-CC8D3BACAA31}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{407408d4-94ed-4d86-ab69-a7f649d112ee}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73fa19d0-2d75-11d2-995d-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B508B3F1-A24A-32C0-B310-85786919EF28}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BDE0FA43-6952-4BA8-8C58-09AF690F88E1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DCECC7CA-D5F8-3AD0-347D-2C35D8AAE399}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E8EA5BD6-D931-4001-ABF6-81BAA500360A}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EA29D410-CE41-4953-A862-2DE706A1DAD7}
HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}

==============
BHO :
======
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

============
Recherche DNS
============

HKLM\SYSTEM\CCS\Services\Tcpip\..\{8F89B3CE-5706-40EA-9F6E-62C6BFF04DFC}: NameServer=80.118.192.100,80.118.196.36 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B7AD884B-CCB5-4D8E-8137-19079D3267A8}: NameServer=192.168.1.1 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{8F89B3CE-5706-40EA-9F6E-62C6BFF04DFC}: NameServer=80.118.192.100,80.118.196.36 
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B7AD884B-CCB5-4D8E-8137-19079D3267A8}: NameServer=192.168.1.1 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{8F89B3CE-5706-40EA-9F6E-62C6BFF04DFC}: NameServer=80.118.192.100,80.118.196.36 
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B7AD884B-CCB5-4D8E-8137-19079D3267A8}: NameServer=192.168.1.1 

================
Internet Explorer :
================
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://www.msn.com/fr-fr

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page	REG_SZ         	https://signin.ebay.fr/ws/eBayISAPI.dll?SignIn&UsingSSL=1&pUserId=&co_partnerId=2&siteid=71&ru=https%3A%2F%2Fmy.ebay.fr%2Fws%2FeBayISAPI.dll%3FMyEbayBeta%26MyeBay%3D%26CurrentPage%3DMyeBaySelling%26ssPageName%3DSTRK%253AME%253ALNLK%26guest%3D1&pageType=3984

========
Services
========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] 

Ndisuio : 0x4 ( OK = 3 )
EapHost : 0x3 ( OK = 2 )
SharedAccess : 0x2 ( OK = 2 )
wuauserv : 0x2 ( OK = 2 )

=========
Atapi.sys
=========

%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\Soria\Local Settings\Temp\18.tmp
## C:\> hashdeep.exe C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
## 
95360,cdfe4411a69c224bd1d11b2da92dac51,0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d,C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\Soria\Local Settings\Temp\18.tmp
## C:\> hashdeep.exe C:\WINDOWS\ServicePackFiles\i386\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\ServicePackFiles\i386\atapi.sys
%%%% HASHDEEP-1.0
%%%% size,md5,sha256,filename
## Invoked from: C:\Documents and Settings\Soria\Local Settings\Temp\18.tmp
## C:\> hashdeep.exe C:\WINDOWS\system32\drivers\atapi.sys
## 
96512,9f3a2f5aa6875c72bf062c712cfa2674,b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9,C:\WINDOWS\system32\drivers\atapi.sys

Référence :
==========

Win 2000_SP2   : ff953a8f08ca3f822127654375786bbe
Win XP_32b     : a64013e98426e1877cb653685c5c0009
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b      : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b  : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b  : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b  : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b  : 80C40F7FDFC376E4C5FEEC28B41C119E
Windows 7_64b  : 02062C0B390B7729EDC9E69C680A6F3C
 
=======
Drive :
=======

D‚fragmenteur de disque Windows
Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

Rapport d'analyse                 	 
    113 Go total,  15,25 Go libre (13%),  23% fragment‚ (fragmentation du fichier 45%)

Vous devriez d‚fragmenter ce volume. 	 

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Present !! : C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}  
Present !! : C:\WINDOWS\_delis32.ini  
Present !! : C:\WINDOWS\kb913800.exe  
Present !! : C:\WINDOWS\System32\autorun.* 
Present !! : C:\WINDOWS\System32\SET*.tmp 
Present !! : C:\WINDOWS\System32	mp.reg"  
Present !! : C:\WINDOWS\unins000.dat  
Present !! : C:\WINDOWS\unins000.exe  
Present !! : C:\Documents and Settings\Soria\Application Data\pcouffin.inf  
Present !! : C:\Documents and Settings\Soria\Application Data\inst.exe  
Present !! : C:\Documents and Settings\Soria\LOCAL Settings\Temp\SSUPDATE.EXE  
 
¤¤¤¤¤¤¤¤¤¤ Keys : 

Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  

============

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-24 08:41:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 
kernel: MBR read successfully
user & kernel MBR OK 

==========
Programs
==========

a-squared Free
ACE Mega CoDecS Pack
Acer WLAN 11g USB Dongle
Adobe
Apple Software Update
ArcSoft
Audacity
Avira
Canal
Canon
CanonBJ
CCleaner
CleanUp!
commercial
ComPlus Applications
CyberLink
DIFX
Fichiers communs
Free Audio Pack
FrenchOtto
GemMasterFrench
Google
IDENCIG
IKEA HomePlanner
InstallShield Installation Information
Internet Explorer
iPod
iTunes
IVT Corporation
Java
K-Lite Codec Pack
Lavasoft
Learn2.com
List_Kill'em
Logitech
MaCuisineLapeyrePrima
Malwarebytes' Anti-Malware
Messenger
Micro Application
Microsoft
Microsoft CAPICOM 2.1.0.2
microsoft frontpage
Microsoft Office
Microsoft Visual Studio
Microsoft Works
Microsoft.NET
Movie Maker
Mozilla Firefox
MSBuild
MSN
MSN Gaming Zone
MSXML 4.0
Nero
NetMeeting
Neuf
NewTech Infosystems
Nullsoft
Oca History Tool
Online Services
Outlook Express
Prolific Publishing, Inc
QuickTime
Real
Realtek
Reference Assemblies
RegCleaner
ScanSoft
Services en ligne
Spyware Terminator
SUPERAntiSpyware
TechCity Solutions
TuneUp Utilities 2007
Uninstall Information
uTorrent
VideoLAN
Windows Live
Windows Live SkyDrive
Windows Media Connect 2
Windows Media Player
Windows NT
Windows Plus
WindowsUpdate
WinRAR
xerox

============
Drive C:
============

$AVG8.VAULT$
Acer
Ad-Remover
Ad-Report-CLEAN[1].log
AUTOEXEC.BAT
autorun.inf
boot.ini
Bootfont.bin
CMPNENTS
ComboFix.txt
Config.Msi
CONFIG.SYS
Documents and Settings
dotnetfx
drv
drwtsn32.log
eDS_PSD_drive.vmdf
GUIDE
hiberfil.sys
i386
INSTALL.LOG
IO.SYS
ISACER.id
Kill'em
List'em.txt
LogiSetup.log
MSDOS.SYS
MSOCache
My Downloads
My Music
NTDETECT.COM
ntldr
NVIDIA
pagefile.sys
Pontarolo Engineering
preload.aaa
Program Files
QooBox
rapport.txt
rapport_smit.txt
RECYCLER
RHDSetup.log
RNDIS.log
rsit
smit.txt
SYSINFO
System Volume Information
UsbFix.txt
UsbFix_Upload_Me_MOMO.zip
VALUEADD
WINDOWS
 
¤¤¤¤¤¤¤¤¤¤ Cracks | Keygens | Serials 
 
 
 
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan :  9:03:32,82

balto64 · Answer

voici le 2eme  rapport
Kill'em by g3n-h@ckm@n 1.2.7.0 
 
User : Soria (Administrateurs) 
Update on 23/02/2010 by g3n-h@ckm@n ::::: 16.30 
Start at: 09:07:47 | 24/02/2010
Contact : https://forums.commentcamarche.net/forum/virus-securite-7

AMD Athlon(tm) 64 X2 Dual Core Processor 4200+
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]

C:\ -> Disque fixe local | 113,27 Go (15,25 Go free) [ACER] | NTFS
D:\ -> Disque fixe local | 113,73 Go (88,4 Go free) [ACERDATA] | FAT32
E:\ -> Disque CD-ROM
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque fixe local | 931,51 Go (452,84 Go free) [Packard Bell] | NTFS
K:\ -> Disque amovible
M:\ -> Disque fixe local | 152,66 Go (9,08 Go free) [Externe] | NTFS
 

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\List_Kill'em\List_Kill'em.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Soria\Local Settings\Temp\26.tmp\ERUNT.EXE
C:\Documents and Settings\Soria\Local Settings\Temp\26.tmp\pv.exe
 
Detections : 
========== 
 

¤¤¤¤¤¤¤¤¤¤ Files/folders : 

Quarantined & Deleted !! : C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 
Quarantined & Deleted !! : C:\WINDOWS\_delis32.ini 
Quarantined & Deleted !! : C:\WINDOWS\kb913800.exe 
 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET100.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET101.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET102.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET103.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET104.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET105.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET106.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET107.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET108.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET109.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET10F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET110.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET111.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET112.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET113.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET114.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET115.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET116.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET117.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET118.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET119.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET11A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET11B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET11C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET11D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET11E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET11F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET120.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET121.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET122.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET123.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET124.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET125.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET126.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET127.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET128.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET129.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET12A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET12B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET12C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET12D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET12E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET12F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET130.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET131.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET132.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET133.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET134.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET135.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET136.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET137.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET138.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET139.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET13A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET13B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET13C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET13D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET13E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET13F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET140.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET141.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET142.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET143.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET144.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET145.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET146.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET147.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET148.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET149.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET14F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET150.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET151.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET152.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET153.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET154.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET155.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET156.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET157.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET158.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET159.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET15A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET15B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET15C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET15D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET15E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET15F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET16.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET160.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET161.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET162.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET163.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET164.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET165.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET166.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET167.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET168.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET169.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET16A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET16B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET16C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET16D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET16E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET16F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET170.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET171.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET172.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET173.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET174.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET175.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET176.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET177.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET178.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET179.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET17F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET18.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET180.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET181.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET182.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET183.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET184.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET185.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET186.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET187.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET188.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET189.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET18A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET18B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET18C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET18D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET18E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET18F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET19.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET190.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET191.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET192.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET193.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET194.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET195.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET196.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET197.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET198.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET199.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET19A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET19B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET19C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET19D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET19E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET19F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1A9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1AA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1AB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1AC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1AD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1AE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1AF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1B9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1BA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1BB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1BC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1BD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1BE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1BF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1C9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1CA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1CB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1CC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1CD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1CE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1CF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1D9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1DA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1DB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1DC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1DD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1DE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1DF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1E9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1EA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1EC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1ED.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1EE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1EF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1F9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1FA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1FB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1FC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1FD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET1FF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET200.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET201.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET202.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET203.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET204.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET206.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET207.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET208.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET209.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET20A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET20B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET20C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET20D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET20E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET20F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET68.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET6E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET7F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET80.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET81.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET82.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET83.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET86.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET87.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET88.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET89.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET8F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET90.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET91.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET92.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET93.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET94.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET95.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET96.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET97.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET98.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET99.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9A.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9B.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9C.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9D.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9E.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SET9F.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETA9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETAA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETAB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETAC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETAD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETAE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETAF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETB7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETBF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETC9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETCA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETCB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETCC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETCD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETCE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETCF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETD9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETDA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETDB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETDC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETDD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETDE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETDF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETE9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETEA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETEB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETEE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETEF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF0.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF1.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF2.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF3.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF4.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF5.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF6.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF7.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF8.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETF9.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETFA.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETFB.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETFC.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETFD.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETFE.tmp 
Quarantined & Deleted !! : C:\WINDOWS\System32\SETFF.tmp 
Quarantined & Deleted !! : C:\WINDOWS\system32	mp.reg 
Quarantined & Deleted !! : C:\WINDOWS\unins000.dat 
Quarantined & Deleted !! : C:\WINDOWS\unins000.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Soria\Application Data\pcouffin.inf 
Quarantined & Deleted !! : C:\Documents and Settings\Soria\Application Data\inst.exe 
Quarantined & Deleted !! : C:\Documents and Settings\Soria\LOCAL Settings\Temp\SSUPDATE.EXE 
 
==============
host file OK !
==============

========
Registry
========

Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"  
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"  
========
Services
=========

 Ndisuio : Start = 3   
 EapHost : Start = 2   
 Ip6Fw : Start = 2   
 SharedAccess : Start = 2   
 wuauserv : Start = 2   
 wscsvc : Start = 2   

============
Disk Cleaned
============
 
=================
anti-ver blaster : OK !! 
=================

================
Prefetch cleaned 
================
 
 
 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

jacques.gache · Answer

bonjour, list&kill"em a trouver et supprimé pas mal de chose restante , comment va ton pc peux tu poster un nouveau hijackthis pour voir les lignes restante à fixer

jacques.gache · Answer

tu vas arrêter les services donné et puis tu repostes un hijackthis je regarderais demain la dodo boulot dans 7h 

Pour à accèder et arrêter un  services 

.Cliques sur Démarrer 
.Cliques sur Executer 
.Tapes dans la fenêttre services.msc 
.Dans la liste déroulante trouves : les services et fais cela pour les 2
 Planificateur LiveUpdate automatique et Boonty Games
.Cliques droit sur Propriétés 
.Cliques sur Arrêter
.Cliques sur désacriver si proposé
.cliques sur OKFerme la fenêttre des services

balto64 · Answer

re,
les services donnés n'etaient pas démarrer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:13:47, on 25/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\dllhost.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Bureau\Soria.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://signin.ebay.fr/ws/eBayISAPI.dll?SignIn&UsingSSL=1&pUserId=&co_partnerId=2&siteid=71&ru=https%3A%2F%2Fmy.ebay.fr%2Fws%2FeBayISAPI.dll%3FMyEbayBeta%26MyeBay%3D%26CurrentPage%3DMyeBaySelling%26ssPageName%3DSTRK%253AME%253ALNLK%26guest%3D1&pageType=3984
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: (no name) - {C48F0939-992C-45C8-A9C2-B97A22D9B4BD} - (no file)
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AOL Dialer] C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F89B3CE-5706-40EA-9F6E-62C6BFF04DFC}: NameServer = 80.118.192.100,80.118.196.36
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7AD884B-CCB5-4D8E-8137-19079D3267A8}: NameServer = 192.168.1.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Unknown owner - C:\Program Files\Inventel\Add-on\wlancfg.exe (file missing)

balto64 · Answer

voici le rapport que je viens de faire !!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:17:30, on 01/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Soria\Bureau\Soria.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.ebay.fr/ws/eBayISAPI.dll?MyeBay
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: (no name) - {C48F0939-992C-45C8-A9C2-B97A22D9B4BD} - (no file)
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1172324924\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AOL Dialer] C:\Program Files\Fichiers communs\AOL\ACS\AOlDial.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Soria\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8F89B3CE-5706-40EA-9F6E-62C6BFF04DFC}: NameServer = 80.118.192.100,80.118.196.36
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7AD884B-CCB5-4D8E-8137-19079D3267A8}: NameServer = 192.168.1.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Service de lancement de WlanCfg (Wlancfg) - Unknown owner - C:\Program Files\Inventel\Add-on\wlancfg.exe (file missing)

jacques.gache · Answer

bonjour, tu fais ce qui suit , merci

1) Fixer les lignes

.Tu fermes tout les programmes ouverts y compris le navigateur. sauf ton anti-virus et pare-feux 
.Lances HijackThis 
.Cliques sur "Do a system scan only" 
.Tu coches les lignes suivantes : 
R3 - Default URLSearchHook is missing
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: (no name) - {C48F0939-992C-45C8-A9C2-B97A22D9B4BD} - (no file)
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

.Tu cliques sur "Fix Checked" 
.Tu fermes HijackThis 

des expliquations en images : http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm







2) passes OTCleanIT


Télécharge OTCleanIT d’Old Timer. 
http://www.geekstogo.com/forum/files/file/403-otc-oldtimers-clean-it/ 
si ce lien ne marche pas essais avec celui-ci: http://www.geekstogo.com/forum/files/file/399-ots-oldtimers-system-scanner/ 
Enregistre le fichier sur ton bureau. 

Double clique " si tu es sous vista cliques droit et en tant que administrateursur " OTCleanit.exe pour l’exécuter. 
Clique sur CleanUp !. 
Le logiciel va te demander de commencer l’analyse. Accepte. 

Il te sera demandé le redémarrage de ton PC pour finir la suppression des fichiers et supprimer également OTCleanIT. Accepte. 





3) passes ccleaner avec les réglages donnés je ne te donnes pas pour l'installer car je vois que tu est déjà avec et en automatique pour le nettoyage !!



.double-cliques sur l'icône de Ccleaner pour l'ouvrir
.une fois ouvert tu cliques sur option et puis avancé
.tu décoches effacer uniquement les fichiers, du dossier temp de windows plus vieux que 24 heures
.cliques sur nettoyeur
.cliques sur windows et dans la colonne avancé
.cochesla première case vieilles données du perfetch que celle-la 
.cliques sur analyse une fois l'analyse terminé
.cliques sur lancer le nettoyage et sur la demande de confirmation OK il vas falloir que tu le refasses une autre fois une fois fini vériffis en appuiant de nouveau sur analyse pour être sur qu'il n'y est plus rien
.cliques maintenant sur registre et puis sur rechercher les erreurs
.laisses tout cochées et cliques sur réparrer les erreurs sélectionnées
.il te demande de sauvegarder OUI
.tu lui donnes un nom pour pouvoir la retrouver et enregistre
.cliques sur corriger toutes les erreurs sélectionnées et sur la demande de confirmation OK
.il supprime et fermer tu vériffis en relancant  rechercher les erreurs
.tu retournes dans option et tu recoches la case effacer uniquement les fichiers, du dossier temp de windows plus vieux que 48 heures et sur nettoyeur, windows sous avancé  tu décoches la première case vieilles données du perfetch
.tu peux fermer Ccleaner

pour aider si besion tutoriel: https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

ou plus ici: http://www.lescofofides.fr/forum/viewtopic.php?f=30&t=96




4) et si plus de problème il restera le sujet à mettre en résolu et à purger la restauration système

balto64 · Answer

il semble que ça va comment mettre le sujet en résolu et purger la restauration système

jacques.gache · Answer

ok pour mettre en résolu regarde au niveau de ton premier message en haut tu as la possibilité de cocher résolu !!

sinon nune chose que j'ai oublié de de dire c'est de mettre ton IE à jour avec IE 8 http://www.microsoft.com/downloads/details.aspx?FamilyID=341c2ad5-8c3d-4347-8c03-08cdecd8852b&DisplayLang=fr


Après une désinfection il est utile de supprimer tous les points de restauration système de façon à ne pas remonter, par mégarde, un point de restauration infecté. 

Pour cela, il faut désactiver la restauration système (ce qui aura pour conséquence de supprimer tous les points de restauration existants) puis la réactiver juste après pour que Windows continue à faire des points de sauvegarde réguliers.


Supprimer les anciens points de restauration : System Volume Information\_restore

(1) Désactiver la Restauration du système

cliques sur Démarrer
Cliques droit sur Poste de travail 
cliques sur Propriétés
Cliques sur l'onglet Restauration du système
Coches Désactiver la Restauration du système sur tous les lecteurs
Cliques sur Appliquer, Lorsque le message de confirmation apparaît, 
cliques sur Oui.
Cliques sur OK.


(2) Activer la Restauration du système


cliques sur Démarrer
Cliques droit sur Poste de travail 
cliques sur Propriétés
Cliques sur l'onglet Restauration du système
Décoches Désactiver la Restauration du système sur tous les lecteurs
Cliques sur Appliquer, Lorsque le message de confirmation apparaît,
cliques sur Oui.
Cliques sur OK.





(3) Créer un point de restauration


    .cliquer sur démarrer
    .cliquer sur tous les programmes
    .cliquer sur accessoires
    .cliquer sur outils système
    .cliquer sur restauration du système
    .sur la fenêtre qui s'ouvre cocher créer un point de restauration
    .cliquer sur suivant
    .dans la fenêtre description du point de restauration lui donner un nom explisitede façon à savoir à quoi il correspond
    .cliquer sur céer
    .une fois que la page s'affiche avec en haut sur gauche le nom et l'heure de ton point de restauration  fermes la fenêtre

jacques.gache · Answer

non il se réinstalles par dessus sans rien changer 
perso j'ai même trouver la solution pour pas perdre mes favorie de IE en cas de plantage du pc et de réinstallation usine

jacques.gache · Answer

normalement OTCleanIT devrait les avoir supprimé ??

balto64 · Answer

sur le bureau il reste List_Kill'em et RSIT, peux-tu me dire si mon antivirus Avira antivir personal est efficace
dois-je garder 
 Malwarebytes' Anti-Malware,
 Spyware Terminator, 
SUPERAntiSpyware Free Edition,
CCleaner sur mon Pc que me conseilles-tu? et encore merci pour ton aide

jacques.gache · Answer

pour list&kill"em et rsit tu cliques droit dessus et supprimer , sinon oui antivir est un anti-virus très fiable, perso je te conseillerais de conserver et d'utiliser régulièrement malwarebytes< mais toujours lui faire la mise à jour avant de faire l'examem du pc avec , sinon pour conserve aussi ccleaner et utilises le en fonction nettoyeur à chaque arrêt du pc ou plus simplement comme chez moi ou il est en automatique pour cette fonction et je l'utilises sur le registre après chaque désinstallation de programme.

sinon pour Spyware Terminator, et SUPERAntiSpyware Free Edition, perso je les désinstallerais !!

balto64 · Answer

Bonjour, Merci pour ton aide, je te garde dans mes favoris
cordialement

Mon pc rame - Page 2

Newsletters