trojan horseRésolu/Fermé

Question

Bonjour,

voila j ai un virus trojan horse que mon antivirus ne peut pas virer aidez moi merci d avance

Utilisateur anonyme · Answer

Bonjour

Ouvre ce lien et télécharge ZHPDiag : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html
 
Une fois le téléchargement achevé, dé zippe le fichier obtenu et place ZHPDiag.exe sur ton Bureau.

Double-clique sur l'icône pour lancer le programme. Sous Vista ou Seven clic droit «  exécuter en tant que administrateur »

Clique sur Tous pour cocher toutes les cases des options.

Clique sur la loupe pour lancer l'analyse.

Laisse l'outil travailler, il peut être assez long. 

Ferme ZHPDiag en fin d'analyse. 


Pour transmettre le rapport clique sur ce lien : 

http://www.cijoint.fr/index.php
Clique sur Parcourir et cherche le répertoire où est installé ZHPDiag (en général C:\Program Files\ZHPDiag). 

Sélectionne le fichier ZHPDiag.txt. 

Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt 

est ajouté dans la page. 

Copie ce lien dans ta réponse.

@+

On a tous été un jour débutant dans quelque chose.
Mais le savoir est la récompense de l'assiduité.

melusine2006 · Answer

rebonjour,

merci pour les liens j ai essaye un peu dans tous les sens ca ne marche pas...

j ai passe spybot il m a vire des saloperies mais pas un certain win32 que je ne sais pas comment enlever

pardonnez moi j ai un clavier anglais sans accents dsl

merci de m aider un peu plus je suis perdue :(

melusine2006 · Answer

re bonjour,

voilà je vous écrit d'un autre ordinateur parce que je n'arrive à rien du tout depuis l'autre :(

j'ai fait le programme pour avoir un rapport, déjà je n'ai aps pu en cochant toutes les options ça le faisait planter à chaque fois "not responding"

je l'ai donc fait en l'état

pour ensuite m'appercevoir que je ne pouvais utiliser le site pour l'hébergement de fichiers parce qu'à chaque fois que je validais pouf plus d'internet...

j'ai aussi essayé de vous copier le rapport directement sur le forum en copier coller mais à chaque fois que je voulais valider le message pouf, plus d'internet :'(

impossible de valider quoi que ce soit sur internet, ni mail ni rien

je ne sais plus comment faire...

merci de m'aider

Utilisateur anonyme · Answer

Re

Procédons autrement:

1)Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection): 
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac 
* Va dans démarrer puis panneau de configuration 
* Double Clique sur l'icône "Comptes d'utilisateurs" 
* Clique ensuite sur désactiver et valide.


2)Télécharge Rkill sur le bureau ; à partir d'un de ces liens
http://download.bleepingcomputer.com/grinler/rkill.pif
https://download.bleepingcomputer.com/grinler/rkill.scr
https://download.bleepingcomputer.com/grinler/rkill.com
https://download.bleepingcomputer.com/grinler/rkill.exe

Double clic pour le lancer.
Une fenêtre (très rapide) indiquera que tout s'est bien déroulé.
Pour Vista ou Seven, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil. 


3)Télécharge Malwaresbytes anti malware ici  
http://www.malwarebytes.org/mbam.php
 
* Installe le (choisis bien "français" ; ne modifie pas les paramètres d'installe ) et  mets le à jour .   

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : https://www.malekal.com/tutorial-aboutbuster/ 

* Potasse le tuto pour te familiariser avec le prg : 

https://forum.pcastuces.com/sujet.asp?f=31&s=3 

(cela dis, il est très simple d'utilisation). 

relance Malwaresbytes en suivant scrupuleusement ces consignes : 

! Déconnecte toi et ferme toutes applications en cours ! 

* Lance Malwarebyte's. 

Fais un examen dit "Complet"

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ). 
--> à la fin tu cliques sur  "Afficher les résultats" "   . 
--> Vérifie que tous les objets infectés soient validés, puis  clique sur " supprimer la sélection "   . 

 Note   : si il faut redémarrer ton PC pour finir le nettoyage, fais le ! 


 Poste le rapport sauvegardé après la suppression des objets infectés   (dans l'onglet "rapport/log"de Malwaresbytes, le dernier en date)


@+

On a tous été un jour débutant dans quelque chose.
Mais le savoir est la récompense de l'assiduité.

melusine2006 · Answer

ouf c est fait ..
le programme a plante trois fois l horreur...
mais on y est :)
merci infiniment pour votre aide

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3832
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18882

07.03.2010 20:03:02
mbam-log-2010-03-07 (20-03-02).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 338091
Temps écoulé: 1 hour(s), 23 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{009e94a1-ca78-49d0-90d7-316f08ba2d94} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{009e94a1-ca78-49d0-90d7-316f08ba2d94} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{012e9f9c-1a95-451d-9362-4af9f04a0b7f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{012e9f9c-1a95-451d-9362-4af9f04a0b7f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c44fa4ce-85a5-463a-9526-4b6a6ee31322} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c44fa4ce-85a5-463a-9526-4b6a6ee31322} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.Tracur) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Windows\System32\sgzjanpf.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\Windows\System32\dyqqugz.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Re

Passe au post 1;merci

@+
On a tous été un jour débutant dans quelque chose.
Mais le savoir est la récompense de l'assiduité. 




On a tous été un jour débutant dans quelque chose.
Mais le savoir est la récompense de l'assiduité.

melusine2006 · Answer

rebelotte.. je ne peux pas valider l hebergement sur cijoint.fr et je ne peux pas valider une reponse dans laquelle je copie colle le rapport...

melusine2006 · Answer

peut etre que le pb c est juste que le texte est trop grand ?

parce que je n ai pas d autre pb sur internet, juste pour ce fichier

peut etre vous pouvez me dire les parties importantes du rapport que je vous les copie ?

Utilisateur anonyme · Answer

Re

Essaye ceci:

a) Télécharge et installe le logiciel HijackThis :

https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html

-->Clique sur le setup pour lancer l'installation : laisse toi guider et ne modifie pas les paramètres d'installation .
A la fin de l'installation, le programme se lance automatiquement : ferme le en cliquant sur la croix rouge.
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme :
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

(Ne lance pas ce prg pour l'instant et fais la suite ... )

b) Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau.

-> http://images.malwareremoval.com/random/RSIT.exe

! Déconnecte toi et ferme toutes tes applications en cours !

Double-clique sur " RSIT.exe " pour le lancer.

Clic droit sous VISTA (exécuter en tant que...)

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " .

* Devant l'option "List files/folders created ..." , tu choisis : 2 months

* clique ensuite sur " Continue " pour lancer l'analyse ...

-> laisse faire le scan et ne touche pas au PC ...

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-notes).

Poste le contenu de " log.txt " (c'est celui qui apparaît à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ...

Important : poste un rapport, puis l'autre dans la réponse suivante ...
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum ...
( Et si "log.txt" seul, ne passe pas non plus , fais le en 2 fois ... merci ... )

( Note : les rapports seront en outre sauvegardés dans ce dossier -> <gras>C:\rsit </gras

@+
On a tous été un jour débutant dans quelque chose.
Mais le savoir est la récompense de l'assiduité.

melusine2006 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by eshak at 2010-03-07 21:11:44
Microsoft® Windows Vista™ Home Premium  Service Pack 2
System drive C: has 198 GB (68%) free of 293 GB
Total RAM: 3069 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:11:46, on 07.03.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\PoivY.com\PoivY\PoivY.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\eshak\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\eshak.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www8.hp.com/uk/en/home.html?jumpid=ex_r11642_uk/en/any/psg/touchpoint_iehome-ot-xx-xx-/chev
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DVDAgent] "C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe"
O4 - HKLM\..\Run: [TSMAgent] "C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"
O4 - HKLM\..\Run: [CLMLServer for HP TouchSmart] "C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [TVAgent] "C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam"
O4 - HKLM\..\Run: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePDIRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [PoivY] "C:\Program Files\PoivY.com\PoivY\PoivY.exe" -nosplash -minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [LosAlamos] rundll32.exe C:\Windows\system32\sshnas21.dll,AttachConsoleA (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [LosAlamos] rundll32.exe C:\Windows\system32\sshnas21.dll,AttachConsoleA (User 'Default user')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix: 
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\aestsrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: AVG Firewall (avgfws9) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgfws9.exe
O23 - Service: AVG9IDSAgent (AVGIDSAgent) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Googles oppdateringstjeneste (gupdate1ca67ecf57615e0) (gupdate1ca67ecf57615e0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\STacSV.exe
O23 - Service: TV Background Capture Service (TVBCS) (TVCapSvc) - Unknown owner - C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
O23 - Service: TV Task Scheduler (TVTS) (TVSched) - Unknown owner - C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

melusine2006 · Answer

info.txt logfile of random's system information tool 1.06 2010-03-07 21:11:48

======Uninstall list======

-->"C:\Program Files\HP Games\Agatha Christie - Death on the Nile\Uninstall.exe"
-->"C:\Program Files\HP Games\Bejeweled 2 Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Blasterball 3\Uninstall.exe"
-->"C:\Program Files\HP Games\Build-a-lot 2\Uninstall.exe"
-->"C:\Program Files\HP Games\Chuzzle Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Crystal Maze\Uninstall.exe"
-->"C:\Program Files\HP Games\Diner Dash 2 Restaurant Rescue\Uninstall.exe"
-->"C:\Program Files\HP Games\Diner Dash\Uninstall.exe"
-->"C:\Program Files\HP Games\Escape the Museum\Uninstall.exe"
-->"C:\Program Files\HP Games\FATE\Uninstall.exe"
-->"C:\Program Files\HP Games\Gem Shop\Uninstall.exe"
-->"C:\Program Files\HP Games\Granny in Paradise\Uninstall.exe"
-->"C:\Program Files\HP Games\Insaniquarium Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Magic Academy\Uninstall.exe"
-->"C:\Program Files\HP Games\Mah Jong Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\Mahjongg Artifacts\Uninstall.exe"
-->"C:\Program Files\HP Games\My HP Game Console\Uninstall.exe"
-->"C:\Program Files\HP Games\Peggle\Uninstall.exe"
-->"C:\Program Files\HP Games\Penguins!\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Bowler\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Golfer Pineapple Cup\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Golfer\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Pool\Uninstall.exe"
-->"C:\Program Files\HP Games\Slingo Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Snowy - Treasure Hunter 2\Uninstall.exe"
-->"C:\Program Files\HP Games\SPORE Creature Creator Trial Edition\Uninstall.exe"
-->"C:\Program Files\HP Games\Tradewinds Legends\Uninstall.exe"
-->"C:\Program Files\HP Games\Tradewinds\Uninstall.exe"
-->"C:\Program Files\HP Games\Virtual Villagers - A New Home\Uninstall.exe"
-->"C:\Program Files\HP Games\Virtual Villagers - The Secret City\Uninstall.exe"
-->"C:\Program Files\HP Games\Zuma Deluxe\Uninstall.exe"
-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
Acrobat.com-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9 - Norsk-->MsiExec.exe /I{AC76BA86-7AD7-1044-7B44-A90000000001}
Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
Adobe Shockwave Player-->MsiExec.exe /X{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}
AMD USB Audio Driver Filter-->MsiExec.exe /X{A3AB35FA-943E-4799-99DC-46EFD59E998F}
AOL Toolbar 5.0-->"C:\Program Files\AOL\AOL Toolbar 5.0\uninstall.exe"
Ask Toolbar-->MsiExec.exe /I{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Atheros Driver Installation Program-->C:\Program Files\InstallShield Installation Information\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}\setup.exe -runfromtemp -l0x0009
AVG 9.0-->C:\Program Files\AVG\AVG9\setup.exe /UNINSTALL
Catalyst Control Center - Branding-->MsiExec.exe /I{558FF444-F562-4E4C-98BD-7B20EE184D2E}
Cisco EAP-FAST Module-->MsiExec.exe /I{415B2719-AD3A-4944-B404-C472DB6085B3}
Cisco LEAP Module-->MsiExec.exe /I{83770D14-21B9-44B3-8689-F7B523F94560}
Cisco PEAP Module-->MsiExec.exe /I{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
CyberLink DVD Suite-->"C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\Setup.exe" /z-uninstall
CyberLink DVD Suite-->"C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\Setup.exe" /z-uninstall
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Plus Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
eBay Icon-->C:\Users\eshak\AppData\Roaming\Desktopicon\uninst.exe
ESU for Microsoft Vista-->MsiExec.exe /I{3877C901-7B90-4727-A639-B6ED2DD59D43}
FormatFactory 2.20-->C:\Program Files\FreeTime\FormatFactory\uninst.exe
Google Chrome-->"C:\Program Files\Google\Chrome\Application\4.0.249.89\Installer\setup.exe" --uninstall --system-level
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_E85CDE7661A53A6A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Hewlett-Packard Active Check for Health Check-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent for Health Check-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Active Support Library-->C:\Program Files\InstallShield Installation Information\{5DAA9C36-8F8B-462F-8CCA-E205BC3751F5}\setup.exe -runfromtemp -l0x0409
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F4770313-7391-411F-B484-43394A785B97}\setup.exe" -l0x9  -removeonly
HP Doc Viewer-->MsiExec.exe /I{082702D5-5DD8-4600-BCE5-48B15174687F}
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F4C96E82-14D2-485F-93A9-6B246C40130A}\setup.exe" -l0x9  -removeonly
HP Help and Support-->MsiExec.exe /I{0054A0F6-00C9-4498-B821-B5C9578F433E}
HP MediaSmart DVD-->"C:\Program Files\InstallShield Installation Information\{DCCAD079-F92C-44DA-B258-624FC6517A5A}\setup.exe" /z-uninstall
HP MediaSmart DVD-->"C:\Program Files\InstallShield Installation Information\{DCCAD079-F92C-44DA-B258-624FC6517A5A}\setup.exe" /z-uninstall
HP MediaSmart Music/Photo/Video-->"C:\Program Files\InstallShield Installation Information\{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}\setup.exe" /z-uninstall
HP MediaSmart Music/Photo/Video-->"C:\Program Files\InstallShield Installation Information\{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}\setup.exe" /z-uninstall /zMS
HP MediaSmart SmartMenu-->MsiExec.exe /I{D8BB0945-B990-47DC-BFE3-3FDE1E165B30}
HP MediaSmart TV-->"C:\Program Files\InstallShield Installation Information\{67626E09-5366-4480-8F1E-93FADF50CA15}\setup.exe" /z-uninstall
HP MediaSmart TV-->"C:\Program Files\InstallShield Installation Information\{67626E09-5366-4480-8F1E-93FADF50CA15}\setup.exe" /z-uninstall
HP MediaSmart Webcam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
HP MediaSmart Webcam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
HP Quick Launch Buttons 6.40 J1-->C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe -runfromtemp -l0x0009 uninst
HP Update-->MsiExec.exe /X{818ABC3C-635C-4651-8183-D0E9640B7DD1}
HP User Guides 0128-->MsiExec.exe /X{07A5026D-5F9F-43D1-9073-C2F882D417E7}
HP Wireless Assistant-->MsiExec.exe /I{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}
HPNetworkAssistant-->MsiExec.exe /I{228C6B46-64E2-404E-898A-EF0830603EF4}
IDT Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}\setup.exe" -l0x9 -remove -removeonly
iOutlookWorks 7.80-->C:\Program Files\A4Tech\Mouse\Uninst32.exe
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216017FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
JMicron JMB38X Flash Media Controller-->"C:\Program Files\InstallShield Installation Information\{26604C7E-A313-4D12-867F-7C6E7820BE4C}\setup.exe" delpkg
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
LabelPrint-->"C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\Setup.exe" /z-uninstall
LabelPrint-->"C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\Setup.exe" /z-uninstall
LightScribe System Software  1.14.17.1-->MsiExec.exe /X{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}
Magic Desktop-->C:\Windows\system32\ezMDUninstall.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (English)-->MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729-->MsiExec.exe /X{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}
Microsoft Works-->MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
My HP Games-->"C:\Program Files\HP Games\Uninstall.exe"
OGA Notifier 2.0.0048.0-->MsiExec.exe /I{B2544A03-10D0-4E5E-BA69-0362FFC20D18}
PoivY-->"C:\Program Files\PoivY.com\PoivY\unins000.exe"
Power2Go-->"C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" /z-uninstall
Power2Go-->"C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\Setup.exe" /z-uninstall
PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" /z-uninstall
PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" /z-uninstall
ProtectSmart Hard Drive Protection-->MsiExec.exe /X{AAD72731-807A-4B79-AE05-9190B7002B7B}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB1puninst.exe RealNetworks|RealPlayer|12.0
Realtek 8169 8168 8101E 8102E Ethernet Driver-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0009 -removeonly
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
SPORE Creature Creator Trial Edition-->"C:\Program Files\HP Games\SPORE Creature Creator Trial Edition\Uninstall.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}
Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VLC media player 1.0.3-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Driver Package - ENE (enecir) HIDClass  (09/04/2008 2.6.0.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\DPInst.exe /u C:\Windows\System32\DriverStore\FileRepository\enecir.inf_1a3c82dd\enecir.inf
Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}
Windows Live Communications Platform-->MsiExec.exe /I{ED00D08A-3C5F-488D-93A0-A04F21F23956}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}
Windows Live Family Safety-->MsiExec.exe /X{139E303E-1050-497F-98B1-9AE87B15C463}
Windows Live Mail-->MsiExec.exe /I{6412CECE-8172-4BE5-935B-6CECACD2CA87}
Windows Live Messenger-->MsiExec.exe /X{A85FD55B-891B-4314-97A5-EA96C0BD80B5}
Windows Live Movie Maker-->MsiExec.exe /X{3D5044A5-97B8-45C0-B956-BB2376569188}
Windows Live Photo Gallery-->MsiExec.exe /X{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}
Windows Live Sign-in Assistant-->MsiExec.exe /I{45338B07-A236-4270-9A77-EBB4115517B5}
Windows Live Sync-->MsiExec.exe /X{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}
Windows Live Toolbar-->MsiExec.exe /X{995F1E2E-F542-4310-8E1D-9926F5A279B3}
Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Live Writer-->MsiExec.exe /X{178832DE-9DE0-4C87-9F82-9315A9B03985}
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Search Protection-->C:\PROGRA~1\Yahoo!\SEARCH~1\UNINST~1.EXE
Yahoo! Software Update-->C:\PROGRA~1\Yahoo!\SOFTWA~1\UNINST~1.EXE
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
ZHPDiag 1.25-->"C:\Program Files\ZHPDiag\unins000.exe"

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: eshak-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB974455(Security Update) into Staged(Staged) state
Record Number: 15560
Source Name: Microsoft-Windows-Servicing
Time Written: 20091120010635.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: eshak-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB974455(Security Update) into Install Requested(Install Requested) state
Record Number: 15544
Source Name: Microsoft-Windows-Servicing
Time Written: 20091120010635.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: eshak-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB974455(Security Update) into Install Requested(Install Requested) state
Record Number: 15542
Source Name: Microsoft-Windows-Servicing
Time Written: 20091120010635.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: eshak-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB974455(Security Update) into Install Requested(Install Requested) state
Record Number: 15538
Source Name: Microsoft-Windows-Servicing
Time Written: 20091120010635.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: eshak-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB974455(Security Update) into Install Requested(Install Requested) state
Record Number: 15532
Source Name: Microsoft-Windows-Servicing
Time Written: 20091120010635.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

=====Application event log=====

Computer Name: eshak-PC
Event Code: 0
Message: 
Record Number: 630
Source Name: gupdate1ca67ecf57615e0
Time Written: 20091118011802.000000-000
Event Type: Informasjon
User: 

Computer Name: eshak-PC
Event Code: 0
Message: 
Record Number: 618
Source Name: YahooAUService
Time Written: 20091117235327.000000-000
Event Type: Informasjon
User: 

Computer Name: eshak-PC
Event Code: 1000
Message: Faulting application TVAgent.exe, version 2.0.1.924, time stamp 0x48da0ed1, faulting module MSVCR71.dll, version 7.10.3052.4, time stamp 0x3e561eac, exception code 0xc0000005, fault offset 0x00010428, process id 0xae0, application start time 0x01ca67d5950aa712.
Record Number: 611
Source Name: Application Error
Time Written: 20091117234151.000000-000
Event Type: Error
User: 

Computer Name: eshak-PC
Event Code: 0
Message: 
Record Number: 603
Source Name: Com4QLBEx
Time Written: 20091117223111.000000-000
Event Type: Informasjon
User: 

Computer Name: eshak-PC
Event Code: 0
Message: 
Record Number: 602
Source Name: hpqwmiex
Time Written: 20091117223048.000000-000
Event Type: Informasjon
User: 

=====Security event log=====

Computer Name: eshak-PC
Event Code: 4616
Message: The system time was changed.

Subject:
	Security ID:		S-1-5-19
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3e5

Process Information:
	Process ID:	0x53c
	Name:		C:\Windows\System32\svchost.exe

Previous Time:		00:37:16 18.11.2009
New Time:		00:37:16 18.11.2009

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
Record Number: 631
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091117233716.694000-000
Event Type: Audit Success
User: 

Computer Name: eshak-PC
Event Code: 4616
Message: The system time was changed.

Subject:
	Security ID:		S-1-5-19
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3e5

Process Information:
	Process ID:	0x53c
	Name:		C:\Windows\System32\svchost.exe

Previous Time:		23:36:38 17.11.2009
New Time:		00:37:16 18.11.2009

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
Record Number: 630
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091117233716.614985-000
Event Type: Audit Success
User: 

Computer Name: eshak-PC
Event Code: 4905
Message: An attempt was made to unregister a security event source.

Subject
	Security ID:		S-1-5-18
	Account Name:		ESHAK-PC$
	Account Domain:		WORKGROUP
	Logon ID:		0x3e7

Process:
	Process ID:	0x874
	Process Name:	C:\Windows\System32\VSSVC.exe

Event Source:
	Source Name:	VSSAudit
	Event Source ID:	0x2a0fd8
Record Number: 629
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091117222029.107473-000
Event Type: Audit Success
User: 

Computer Name: eshak-PC
Event Code: 4904
Message: An attempt was made to register a security event source.

Subject :
	Security ID:		S-1-5-18
	Account Name:		ESHAK-PC$
	Account Domain:		WORKGROUP
	Logon ID:		0x3e7

Process:
	Process ID:	0x874
	Process Name:	C:\Windows\System32\VSSVC.exe

Event Source:
	Source Name:	VSSAudit
	Event Source ID:	0x2a0fd8
Record Number: 628
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091117222029.107473-000
Event Type: Audit Success
User: 

Computer Name: eshak-PC
Event Code: 1102
Message: The audit log was cleared.
Subject:
	Security ID:	S-1-5-21-1147707696-1811796726-151477202-1000
	Account Name:	eshak
	Domain Name:	eshak-PC
	Logon ID:	0x59f77
Record Number: 627
Source Name: Microsoft-Windows-Eventlog
Time Written: 20091117222017.579073-000
Event Type: Audit Success
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\CyberLink\Power2Go;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Common Files\DivX Shared\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=17
"PROCESSOR_IDENTIFIER"=x86 Family 17 Model 3 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=0301
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON"=FALSE
"OnlineServices"=Online Services
"Platform"=MCD
"PCBRAND"=Pavilion

-----------------EOF-----------------

Utilisateur anonyme · Answer

Re 

1)Désactiver le TeaTimer de Spybot (Merci à Nico):  

Pour désactiver le TeaTimer :  
=> Ouvrir Spybot S&D  
=> Dans le menu "Mode", sélectionner le mode avancé.  
=> Une fenêtre demande confirmation cliquer sur "oui".  
=> Une fois le mode avancé actif, ouvrir l'onglet "Outils".  
=> Cliquer sur Résident.  
=> La partie Résident comporte deux lignes qui sont normalement cochées :  

*Résident "SDHelper" (bloqueur de téléchargements nuisibles pour Internet Explorer) actif.  
* Résident "TeaTimer" (Protection des réglages système fondamentaux) actif.  

=> Décocher la ligne TeaTimer.  
=> Redémarrer Spybot (le fermer et le rouvrir)  
=> Retourner dans le menu Résident et vérifier qu'il soit bien désactivé. 

2)* Télécharge Ad-remover ( de C_XX ) sur ton bureau :  

http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe 

! Déconnecte toi et ferme toutes applications en cours !  

* Double clique ou clic droit (exécuter en tant que admin...sur Vista et Windows7)  sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut.  

* Double-clique ou clic droit (exécuter en tant que admin...sur Vista) sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil . 
  
* Au menu principal choisis l'option "L"  et sur [entrée]  . 

* Laisse travailler l'outil et ne touche à rien ...  

--> Poste le rapport qui apparaît à la fin , sur le forum ... 

( Le rapport est sauvegardé aussi sous C:\Ad-report.log )  
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )  

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.  
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.  
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.  

Aides en images (Installation) : http://pagesperso-orange.fr/NosTools/ad_remover.html images (Recherche):    http://pagesperso-orange.fr/NosTools/tuto_adr_2.html 


3) # Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.  
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.  
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.  


Télécharge et install UsbFix de C_XX 
Ici : :  http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe 
Tutorial de Malekal_Morte si besoin, merci à lui : https://www.malekal.com/usbfix-supprimer-virus-usb/  

 Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir 
  

#  Clic droit "Exécuter en tant qu'administrateur" sur le raccourci UsbFix présent sur ton bureau.  

# Choisi l  option 2 (Suppression)  

# Laisse travailler l outil.  

# Ensuite post le rapport UsbFix.txt qui apparaîtra.  

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )  

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 


Poste les rapports au fur et à mesure;merci 

@+ 
On a tous été un jour débutant dans quelque chose. 
Mais le savoir est la récompense de l'assiduité.

melusine2006 · Answer

.
======= LOGFILE OF AD-REMOVER 1.1.4.6_J | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 05.02.2010 at 17:34
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at: 21:43:28, 07.03.2010 | Normal Boot | Option: CLEAN
Executed from: C:\Ad-Remover\
Operating system: Microsoft® Windows Vista™ HomePremium Service Pack 2 v6.0.6002
Computer Name: ESHAK-PC | Current user: eshak
.
============== NEUTRALIZED ELEMENT(S) ==============
.

C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE} 
C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar 
C:\Program Files\Ask.com 
C:\Users\eshak\AppData\Roaming\Desktopicon 
C:\Users\eshak\AppData\LocalLow\AskToolbar 
C:\Users\eshak\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Ebay.lnk 
C:\Users\eshak\AppData\Roaming\MICROS~1\Windows\STARTM~1\Ebay.lnk 

(!) -- Temp files deleted.
 
.
HKCU\software\appdatalow\AskBarDis
HKCU\software\appdatalow\software\AskToolbar
HKCU\software\Ask.com
HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
HKCU\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} 
HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
HKLM\software\classes\appid\GenericAskToolbar.DLL
HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\classes\GenericAskToolbar.ToolbarWnd
HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKLM\software\microsoft\internet explorer\searchscopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{D4027C7F-154A-4066-A1AD-4243D8127440} 
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\software\microsoft\windows\currentversion\uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
.
============== Added scan ==============
.
.
* Internet Explorer Version 8.0.6001.18882 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Do404Search: 01000000
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Start Page Redirect Cache: hxxp://no.msn.com/?ocid=iehp
Start Page Redirect Cache_TIMESTAMP: 902273535f74ca01
Start Page Redirect Cache AcceptLangs: no
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Users\eshak\AppData\Roaming\uTorrent\AVG AntiVirus Pro 2010 9.0.787 build 2721 Multilanguage + Serial.torrent
C:\Users\eshak\AppData\Roaming\uTorrent\AVG Internet Security 9.0 + working serial.torrent
C:\Users\eshak\Downloads\AVG Internet Security 9.0 + working serial\avg_iswt_stb_all_9_40.exe
.
===================================
.
4776 Byte(s) - C:\Ad-Report-CLEAN[1].log 
.
147 File(s) - C:\Users\eshak\AppData\Local\Temp 
787 File(s) - C:\Windows\Temp 
0 File(s) - C:\Windows\Prefetch 
.
19 File(s) - C:\Ad-Remover\BACKUP
12 File(s) - C:\Ad-Remover\QUARANTINE
.
End at: 21:58:48 | 07.03.2010 - CLEAN[1]
.
============== E.O.F ==============
.

melusine2006 · Answer

re...

usb fix il faut que je le fasse meme si je n ai pas de cle usb ?

parce que j ai essaye de le faire sans rien brancher d externe parce que je n ai rien et il m a mis un ecran noir dont il n avait pas l air de vouloir bouger je ne savais pas trop s il etait plante ou s il fallait attendre j ai fini par redemarrer...

melusine2006 · Answer

bonjour,

enfin j ai reussi a faire le usb fix il n a pas arrete de planter a divers moments..

par contre je ne sais pas comment desactiver mon antivirus, j ai avg, je n ai pas trouve comment faire pour la suite... merci de m expliquer comment faire

voici le rapport usbfix


############################## | UsbFix V6.098 |

User : eshak (Administrators) # ESHAK-PC
Update on 03/03/2010 by El Desaparecido , C_XX & Chimay8
Start at: 10:00:48 | 08.03.2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

AMD Turion(tm) X2 Dual-Core Mobile RM-74
Microsoft® Windows Vista™ Home Premium  (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18882
Windows Firewall Status : Disabled

C:\ -> Local Fixed Disk # 286,48 Go (195,85 Go free) # NTFS
D:\ -> Local Fixed Disk # 11,6 Go (1,89 Go free) [RECOVERY] # NTFS
E:\ -> CD-ROM Disc

################## | Elements infectieux |

Supprimé ! C:\Windows\Tasks\At1.job 
Supprimé ! C:\Windows\Temp\Ezj.exe 
Supprimé ! C:\Windows\Temp\a.dat 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-1147707696-1811796726-151477202-1000 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-1147707696-1811796726-151477202-500 
Supprimé ! C:\$Recycle.Bin\S-1-5-21-3294427754-468160995-3774245442-500 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-1147707696-1811796726-151477202-1000 
Supprimé ! D:\$Recycle.Bin\S-1-5-21-1147707696-1811796726-151477202-500 

################## | Registre |

Supprimé ! [HKUS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "cbssreg"  
Supprimé ! [HKUS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "LosAlamos"  
Supprimé ! [HKUS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "TOY5KNQ8OC"  
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoClose"  

################## | Mountpoints2 |


################## | Listing des fichiers présent |

[07.03.2010 21:58|--a------|5103] C:\Ad-Report-CLEAN[1].log 
[18.09.2006 22:43|--a------|24] C:\autoexec.bat 
[11.04.2009 07:36|-rahs----|333257] C:\bootmgr 
[18.09.2006 22:43|--a------|10] C:\config.sys 
[?|?|?] C:\hiberfil.sys 
[?|?|?] C:\pagefile.sys 
[07.03.2010 17:38|--a------|765] C:\rkill.log 
[08.03.2010 10:10|--a------|1948] C:\UsbFix.txt 
[17.11.2009 23:06|---hs----|13] D:\BLOCK.RIN 
[04.10.2006 00:02|---hs----|438328] D:\bootmgr 
[12.09.2008 19:00|---hs----|1199] D:\Desktop.ini 
[10.09.2002 17:14|---hs----|8134] D:\Folder.htt 
[08.03.2010 10:00|--ahs----|177] D:\MASTER.LOG 
[12.09.2008 18:17|---hs----|381873] D:\protect.arabic 
[15.09.2008 16:57|---hs----|182624] D:\protect.bulgarian 
[16.09.2002 15:37|---hs----|181898] D:\protect.chinese hong kong 
[16.09.2002 15:37|---hs----|181916] D:\protect.chinese simplified 
[16.09.2002 15:37|---hs----|181898] D:\protect.chinese traditional 
[27.04.2006 17:19|---hs----|181865] D:\protect.czech 
[03.11.2005 16:21|---hs----|181726] D:\protect.danish 
[10.09.2002 14:56|---hs----|181605] D:\protect.dutch 
[10.09.2002 14:50|---hs----|181651] D:\protect.ed 
[22.11.2004 16:28|---hs----|181648] D:\protect.english 
[03.11.2005 16:20|---hs----|181673] D:\protect.finnish 
[03.11.2005 16:19|---hs----|181736] D:\protect.french 
[03.11.2005 16:18|---hs----|181669] D:\protect.german 
[23.11.2005 16:56|---hs----|182689] D:\protect.greek 
[23.01.2006 10:18|---hs----|182605] D:\protect.hebrew 
[28.08.2007 15:58|---hs----|181696] D:\protect.hungarian 
[03.11.2005 16:17|---hs----|181554] D:\protect.italian 
[19.06.2007 16:22|---hs----|182351] D:\protect.japanese 
[24.11.2005 12:24|---hs----|218295] D:\protect.korean 
[03.11.2005 16:15|---hs----|181578] D:\protect.norwegian 
[25.04.2006 15:44|---hs----|181789] D:\protect.polish 
[03.11.2005 16:13|---hs----|181624] D:\protect.portuguese 
[27.10.2005 20:24|---hs----|181882] D:\protect.portuguese brazilian 
[15.09.2008 16:57|---hs----|181735] D:\protect.romanian 
[28.06.2004 09:52|---hs----|211936] D:\protect.russian 
[04.07.2007 12:46|---hs----|181954] D:\protect.slovak 
[03.11.2005 16:11|---hs----|181586] D:\protect.spanish 
[10.09.2002 15:15|---hs----|181602] D:\protect.swedish 
[12.08.2003 11:37|---hs----|181783] D:\protect.turkish 

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido). 

################## | Upload | 

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_eshak-PC.zip : https://www.ionos.fr/?affiliate_id=77097 
Merci pour votre contribution .  

################## | ! Fin du rapport # UsbFix V6.098 ! |

melusine2006 · Answer

question subsidiaire..

au demarrage j ai un programme qui merde a chaque fois aucune idee du pourquoi je ne sais pas si c est lie au virus ou non...

c est le programme hp smart media il etait d origine sur l ordi

au demarrage donc il me dit "the resident programm hp smart media has stopped working et un blabla comme quoi windows va essayer de regler le pb"

si vous pouvez m aider la dessus aussi ?

vraiment merci de votre patience

melusine2006 · Answer

j ai essaye sans enlever l antivirus et ca a marche voici donc le dernier rapport


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Home Premium  ( v6.0.6002 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) X2 Dual-Core Mobile RM-74 )
   BIOS : Default System BIOS
   USER : eshak ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:286 Go (Free:195 Go)
   D:\ (Local Disk) - NTFS - Total:11 Go (Free:1 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 08.03.2010|12:26 )

   [ UAC => 0 ]
 
   --------------------\  Listing des dossiers dans Local

   [06.03.2010|22:04] C:\Users\eshak\AppData\Local\Adobe
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\Application Data 
   [17.11.2009|23:30] C:\Users\eshak\AppData\Local\ATI
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\AtStart.txt
   [06.03.2010|22:15] C:\Users\eshak\AppData\Local\C44FA4CE-85A5-463A-9526-4B6A6EE31322.txt
   [06.03.2010|23:54] C:\Users\eshak\AppData\Local\d3d9caps.dat
   [08.03.2010|00:21] C:\Users\eshak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\DSwitch.txt
   [27.02.2010|00:23] C:\Users\eshak\AppData\Local\GDIPFONTCACHEV1.DAT
   [08.02.2010|20:18] C:\Users\eshak\AppData\Local\Google
   [21.11.2009|23:43] C:\Users\eshak\AppData\Local\Hewlett-Packard
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\History 
   [08.03.2010|12:15] C:\Users\eshak\AppData\Local\IconCache.db
   [06.03.2010|22:26] C:\Users\eshak\AppData\Local\Microsoft
   [03.01.2010|22:15] C:\Users\eshak\AppData\Local\Microsoft Games
   [17.11.2009|23:10] C:\Users\eshak\AppData\Local\Microsoft Help
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\QSwitch.txt
   [17.11.2009|23:14] C:\Users\eshak\AppData\Local\Seven Zip
   [08.03.2010|12:26] C:\Users\eshak\AppData\Local\Temp
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\Temporary Internet Files 
   [18.11.2009|00:57] C:\Users\eshak\AppData\Local\VirtualStore
   [18.11.2009|13:34] C:\Users\eshak\AppData\Local\Yahoo
   [18.11.2009|00:53] C:\Users\eshak\AppData\Local\Yahoo!
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [08.03.2010 09:09][--ah-----] C:\Windows	asks\User_Feed_Synchronization-{1B5256F6-5FF3-408F-9DE9-D72B5B4C11A6}.job
   [08.03.2010 11:39][--a------] C:\Windows	asks\GoogleUpdateTaskMachineUA.job
   [08.03.2010 12:17][--a------] C:\Windows	asks\GoogleUpdateTaskMachineCore.job
   [21.02.2010 12:37][--a------] C:\Windows	asks\HPCeeScheduleForeshak.job
   [08.03.2010 12:17][--ah-----] C:\Windows	asks\SA.DAT
   [08.03.2010 12:15][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [21.01.2009|12:14] C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
   [17.11.2009|23:14] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [17.11.2008|15:03] C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
   [21.01.2009|12:13] C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
   [17.11.2008|14:57] C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
   [21.01.2009|12:11] C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
   [21.01.2009|12:13] C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
   [17.11.2008|14:55] C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
   [17.11.2008|15:03] C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
   [21.01.2009|12:14] C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
   [04.12.2009|00:52] C:\ProgramData\Adobe
   [17.11.2008|15:15] C:\ProgramData\AOL
   [02.11.2006|14:02] C:\ProgramData\Application Data 
   [21.01.2009|11:33] C:\ProgramData\Atheros
   [21.01.2009|12:18] C:\ProgramData\ATI
   [06.03.2010|22:30] C:\ProgramData\AVG Security Toolbar
   [06.03.2010|22:28] C:\ProgramData\avg9
   [25.12.2009|19:40] C:\ProgramData\CanonBJ
   [18.11.2009|14:27] C:\ProgramData\CyberLink
   [02.11.2006|14:02] C:\ProgramData\Desktop 
   [02.11.2006|14:02] C:\ProgramData\Documents 
   [02.11.2006|14:02] C:\ProgramData\Favorites 
   [10.12.2009|21:11] C:\ProgramData\Google
   [21.01.2009|12:14] C:\ProgramData\Hewlett-Packard
   [07.03.2010|17:42] C:\ProgramData\Malwarebytes
   [23.11.2009|20:49] C:\ProgramData\Microsoft
   [10.12.2009|21:40] C:\ProgramData\Microsoft Help
   [17.01.2010|18:05] C:\ProgramData\Norton
   [17.11.2008|14:03] C:\ProgramData\NortonInstaller
   [07.03.2010|22:55] C:\ProgramData
tuser.pol
   [24.01.2010|00:41] C:\ProgramData\Office Genuine Advantage
   [05.03.2010|00:40] C:\ProgramData\Real
   [07.03.2010|22:38] C:\ProgramData\Spybot - Search & Destroy
   [02.11.2006|14:02] C:\ProgramData\Start Menu 
   [17.11.2009|23:32] C:\ProgramData\Symantec
   [21.01.2009|12:14] C:\ProgramData\Temp
   [02.11.2006|14:02] C:\ProgramData\Templates 
   [22.11.2009|01:07] C:\ProgramData\WildTangent
   [18.11.2009|00:53] C:\ProgramData\Yahoo!
   [17.01.2010|18:26] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [03.01.2010|17:11] C:\Program Files\A4Tech
   [17.11.2009|23:14] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [17.11.2009|23:09] C:\Program Files\Adobe
   [21.01.2009|11:33] C:\Program Files\AMD
   [17.11.2008|15:15] C:\Program Files\AOL
   [21.01.2009|11:33] C:\Program Files\Atheros
   [21.01.2009|11:24] C:\Program Files\ATI
   [21.01.2009|11:26] C:\Program Files\ATI Technologies
   [06.03.2010|22:28] C:\Program Files\AVG
   [21.01.2009|11:32] C:\Program Files\Cisco
   [17.01.2010|18:07] C:\Program Files\Common Files
   [17.11.2008|15:04] C:\Program Files\CyberLink
   [21.01.2009|11:28] C:\Program Files\DIFX
   [18.11.2009|02:18] C:\Program Files\DivX
   [06.03.2010|23:03] C:\Program Files\EasyBits For Kids
   [07.12.2009|19:07] C:\Program Files\FreeTime
   [10.12.2009|21:11] C:\Program Files\Google
   [21.01.2009|12:10] C:\Program Files\Hewlett-Packard
   [03.12.2009|22:58] C:\Program Files\HP
   [17.11.2008|14:52] C:\Program Files\HP Games
   [21.01.2009|11:31] C:\Program Files\IDT
   [21.01.2009|12:14] C:\Program Files\InstallShield Installation Information
   [31.01.2010|23:01] C:\Program Files\Internet Explorer
   [10.12.2009|21:08] C:\Program Files\Java
   [23.11.2009|20:51] C:\Program Files\Microsoft
   [02.11.2006|13:37] C:\Program Files\Microsoft Games
   [17.11.2009|23:12] C:\Program Files\Microsoft Office
   [24.01.2010|00:39] C:\Program Files\Microsoft Silverlight
   [23.11.2009|20:46] C:\Program Files\Microsoft SQL Server Compact Edition
   [23.11.2009|20:49] C:\Program Files\Microsoft Sync Framework
   [23.11.2009|22:31] C:\Program Files\Microsoft Works
   [17.11.2009|23:12] C:\Program Files\Microsoft.NET
   [30.11.2009|02:51] C:\Program Files\Movie Maker
   [02.11.2006|13:37] C:\Program Files\MSBuild
   [20.11.2009|01:25] C:\Program Files\MSXML 4.0
   [17.11.2009|23:20] C:\Program Files\Online Services
   [18.11.2009|01:12] C:\Program Files\PoivY.com
   [06.12.2009|00:14] C:\Program Files\Real
   [21.01.2009|11:31] C:\Program Files\Realtek
   [02.11.2006|13:37] C:\Program Files\Reference Assemblies
   [17.11.2009|23:30] C:\Program Files\SMINST
   [07.03.2010|22:39] C:\Program Files\Spybot - Search & Destroy
   [21.01.2009|11:27] C:\Program Files\Synaptics
   [07.03.2010|21:10] C:\Program Files\Trend Micro
   [02.11.2006|14:01] C:\Program Files\Uninstall Information
   [04.12.2009|00:54] C:\Program Files\uTorrent
   [06.12.2009|01:01] C:\Program Files\VideoLAN
   [30.11.2009|02:51] C:\Program Files\Windows Calendar
   [30.11.2009|02:51] C:\Program Files\Windows Collaboration
   [30.11.2009|02:51] C:\Program Files\Windows Defender
   [30.11.2009|02:51] C:\Program Files\Windows Journal
   [23.11.2009|20:50] C:\Program Files\Windows Live
   [23.11.2009|20:43] C:\Program Files\Windows Live SkyDrive
   [12.02.2010|22:32] C:\Program Files\Windows Mail
   [30.11.2009|02:51] C:\Program Files\Windows Media Player
   [02.11.2006|13:37] C:\Program Files\Windows NT
   [30.11.2009|02:51] C:\Program Files\Windows Photo Gallery
   [06.12.2009|23:22] C:\Program Files\Windows Portable Devices
   [30.11.2009|02:51] C:\Program Files\Windows Sidebar
   [18.11.2009|00:53] C:\Program Files\Yahoo!
   [07.03.2010|22:43] C:\Program Files\ZHPDiag

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [17.11.2009|23:08] C:\Program Files\Common Files\Adobe
   [17.11.2009|23:09] C:\Program Files\Common Files\Adobe AIR
   [17.11.2009|23:12] C:\Program Files\Common Files\DESIGNER
   [18.11.2009|02:17] C:\Program Files\Common Files\DivX Shared
   [17.11.2008|15:39] C:\Program Files\Common Files\InstallShield
   [17.11.2008|15:28] C:\Program Files\Common Files\Java
   [21.01.2009|12:02] C:\Program Files\Common Files\LightScribe
   [26.11.2009|22:22] C:\Program Files\Common Files\microsoft shared
   [18.11.2009|02:18] C:\Program Files\Common Files\PX Storage Engine
   [06.12.2009|00:14] C:\Program Files\Common Files\Real
   [02.11.2006|12:18] C:\Program Files\Common Files\Services
   [02.11.2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [30.11.2009|02:51] C:\Program Files\Common Files\System
   [23.11.2009|20:37] C:\Program Files\Common Files\Windows Live
   [06.12.2009|00:14] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 90 Processes )

   iexplore.exe ~ [PID:5540]
   iexplore.exe ~ [PID:5608]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\Users\eshak\AppData\Local\Temp
sbBBE0.tmp
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2010-03-08 12:27:14
   Windows 6.0.6002 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:211][D:74]-> C:\Users\eshak\AppData\Local\Temp
   [F:451][D:1]-> C:\Users\eshak\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:1944][D:5]-> C:\Users\eshak\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:1][D:1]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 08.03.2010|12:29 - Option : [1]

   --------------------\  Fin du rapport a 12:29:34
   [ UAC => 1 ]

melusine2006 · Answer

j ai essaye sans enlever l antivirus et ca a marche voici donc le dernier rapport


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Home Premium  ( v6.0.6002 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) X2 Dual-Core Mobile RM-74 )
   BIOS : Default System BIOS
   USER : eshak ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:286 Go (Free:195 Go)
   D:\ (Local Disk) - NTFS - Total:11 Go (Free:1 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 08.03.2010|12:26 )

   [ UAC => 0 ]
 
   --------------------\  Listing des dossiers dans Local

   [06.03.2010|22:04] C:\Users\eshak\AppData\Local\Adobe
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\Application Data 
   [17.11.2009|23:30] C:\Users\eshak\AppData\Local\ATI
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\AtStart.txt
   [06.03.2010|22:15] C:\Users\eshak\AppData\Local\C44FA4CE-85A5-463A-9526-4B6A6EE31322.txt
   [06.03.2010|23:54] C:\Users\eshak\AppData\Local\d3d9caps.dat
   [08.03.2010|00:21] C:\Users\eshak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\DSwitch.txt
   [27.02.2010|00:23] C:\Users\eshak\AppData\Local\GDIPFONTCACHEV1.DAT
   [08.02.2010|20:18] C:\Users\eshak\AppData\Local\Google
   [21.11.2009|23:43] C:\Users\eshak\AppData\Local\Hewlett-Packard
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\History 
   [08.03.2010|12:15] C:\Users\eshak\AppData\Local\IconCache.db
   [06.03.2010|22:26] C:\Users\eshak\AppData\Local\Microsoft
   [03.01.2010|22:15] C:\Users\eshak\AppData\Local\Microsoft Games
   [17.11.2009|23:10] C:\Users\eshak\AppData\Local\Microsoft Help
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\QSwitch.txt
   [17.11.2009|23:14] C:\Users\eshak\AppData\Local\Seven Zip
   [08.03.2010|12:26] C:\Users\eshak\AppData\Local\Temp
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\Temporary Internet Files 
   [18.11.2009|00:57] C:\Users\eshak\AppData\Local\VirtualStore
   [18.11.2009|13:34] C:\Users\eshak\AppData\Local\Yahoo
   [18.11.2009|00:53] C:\Users\eshak\AppData\Local\Yahoo!
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [08.03.2010 09:09][--ah-----] C:\Windows	asks\User_Feed_Synchronization-{1B5256F6-5FF3-408F-9DE9-D72B5B4C11A6}.job
   [08.03.2010 11:39][--a------] C:\Windows	asks\GoogleUpdateTaskMachineUA.job
   [08.03.2010 12:17][--a------] C:\Windows	asks\GoogleUpdateTaskMachineCore.job
   [21.02.2010 12:37][--a------] C:\Windows	asks\HPCeeScheduleForeshak.job
   [08.03.2010 12:17][--ah-----] C:\Windows	asks\SA.DAT
   [08.03.2010 12:15][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [21.01.2009|12:14] C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
   [17.11.2009|23:14] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [17.11.2008|15:03] C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
   [21.01.2009|12:13] C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
   [17.11.2008|14:57] C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
   [21.01.2009|12:11] C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
   [21.01.2009|12:13] C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
   [17.11.2008|14:55] C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
   [17.11.2008|15:03] C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
   [21.01.2009|12:14] C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
   [04.12.2009|00:52] C:\ProgramData\Adobe
   [17.11.2008|15:15] C:\ProgramData\AOL
   [02.11.2006|14:02] C:\ProgramData\Application Data 
   [21.01.2009|11:33] C:\ProgramData\Atheros
   [21.01.2009|12:18] C:\ProgramData\ATI
   [06.03.2010|22:30] C:\ProgramData\AVG Security Toolbar
   [06.03.2010|22:28] C:\ProgramData\avg9
   [25.12.2009|19:40] C:\ProgramData\CanonBJ
   [18.11.2009|14:27] C:\ProgramData\CyberLink
   [02.11.2006|14:02] C:\ProgramData\Desktop 
   [02.11.2006|14:02] C:\ProgramData\Documents 
   [02.11.2006|14:02] C:\ProgramData\Favorites 
   [10.12.2009|21:11] C:\ProgramData\Google
   [21.01.2009|12:14] C:\ProgramData\Hewlett-Packard
   [07.03.2010|17:42] C:\ProgramData\Malwarebytes
   [23.11.2009|20:49] C:\ProgramData\Microsoft
   [10.12.2009|21:40] C:\ProgramData\Microsoft Help
   [17.01.2010|18:05] C:\ProgramData\Norton
   [17.11.2008|14:03] C:\ProgramData\NortonInstaller
   [07.03.2010|22:55] C:\ProgramData
tuser.pol
   [24.01.2010|00:41] C:\ProgramData\Office Genuine Advantage
   [05.03.2010|00:40] C:\ProgramData\Real
   [07.03.2010|22:38] C:\ProgramData\Spybot - Search & Destroy
   [02.11.2006|14:02] C:\ProgramData\Start Menu 
   [17.11.2009|23:32] C:\ProgramData\Symantec
   [21.01.2009|12:14] C:\ProgramData\Temp
   [02.11.2006|14:02] C:\ProgramData\Templates 
   [22.11.2009|01:07] C:\ProgramData\WildTangent
   [18.11.2009|00:53] C:\ProgramData\Yahoo!
   [17.01.2010|18:26] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [03.01.2010|17:11] C:\Program Files\A4Tech
   [17.11.2009|23:14] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [17.11.2009|23:09] C:\Program Files\Adobe
   [21.01.2009|11:33] C:\Program Files\AMD
   [17.11.2008|15:15] C:\Program Files\AOL
   [21.01.2009|11:33] C:\Program Files\Atheros
   [21.01.2009|11:24] C:\Program Files\ATI
   [21.01.2009|11:26] C:\Program Files\ATI Technologies
   [06.03.2010|22:28] C:\Program Files\AVG
   [21.01.2009|11:32] C:\Program Files\Cisco
   [17.01.2010|18:07] C:\Program Files\Common Files
   [17.11.2008|15:04] C:\Program Files\CyberLink
   [21.01.2009|11:28] C:\Program Files\DIFX
   [18.11.2009|02:18] C:\Program Files\DivX
   [06.03.2010|23:03] C:\Program Files\EasyBits For Kids
   [07.12.2009|19:07] C:\Program Files\FreeTime
   [10.12.2009|21:11] C:\Program Files\Google
   [21.01.2009|12:10] C:\Program Files\Hewlett-Packard
   [03.12.2009|22:58] C:\Program Files\HP
   [17.11.2008|14:52] C:\Program Files\HP Games
   [21.01.2009|11:31] C:\Program Files\IDT
   [21.01.2009|12:14] C:\Program Files\InstallShield Installation Information
   [31.01.2010|23:01] C:\Program Files\Internet Explorer
   [10.12.2009|21:08] C:\Program Files\Java
   [23.11.2009|20:51] C:\Program Files\Microsoft
   [02.11.2006|13:37] C:\Program Files\Microsoft Games
   [17.11.2009|23:12] C:\Program Files\Microsoft Office
   [24.01.2010|00:39] C:\Program Files\Microsoft Silverlight
   [23.11.2009|20:46] C:\Program Files\Microsoft SQL Server Compact Edition
   [23.11.2009|20:49] C:\Program Files\Microsoft Sync Framework
   [23.11.2009|22:31] C:\Program Files\Microsoft Works
   [17.11.2009|23:12] C:\Program Files\Microsoft.NET
   [30.11.2009|02:51] C:\Program Files\Movie Maker
   [02.11.2006|13:37] C:\Program Files\MSBuild
   [20.11.2009|01:25] C:\Program Files\MSXML 4.0
   [17.11.2009|23:20] C:\Program Files\Online Services
   [18.11.2009|01:12] C:\Program Files\PoivY.com
   [06.12.2009|00:14] C:\Program Files\Real
   [21.01.2009|11:31] C:\Program Files\Realtek
   [02.11.2006|13:37] C:\Program Files\Reference Assemblies
   [17.11.2009|23:30] C:\Program Files\SMINST
   [07.03.2010|22:39] C:\Program Files\Spybot - Search & Destroy
   [21.01.2009|11:27] C:\Program Files\Synaptics
   [07.03.2010|21:10] C:\Program Files\Trend Micro
   [02.11.2006|14:01] C:\Program Files\Uninstall Information
   [04.12.2009|00:54] C:\Program Files\uTorrent
   [06.12.2009|01:01] C:\Program Files\VideoLAN
   [30.11.2009|02:51] C:\Program Files\Windows Calendar
   [30.11.2009|02:51] C:\Program Files\Windows Collaboration
   [30.11.2009|02:51] C:\Program Files\Windows Defender
   [30.11.2009|02:51] C:\Program Files\Windows Journal
   [23.11.2009|20:50] C:\Program Files\Windows Live
   [23.11.2009|20:43] C:\Program Files\Windows Live SkyDrive
   [12.02.2010|22:32] C:\Program Files\Windows Mail
   [30.11.2009|02:51] C:\Program Files\Windows Media Player
   [02.11.2006|13:37] C:\Program Files\Windows NT
   [30.11.2009|02:51] C:\Program Files\Windows Photo Gallery
   [06.12.2009|23:22] C:\Program Files\Windows Portable Devices
   [30.11.2009|02:51] C:\Program Files\Windows Sidebar
   [18.11.2009|00:53] C:\Program Files\Yahoo!
   [07.03.2010|22:43] C:\Program Files\ZHPDiag

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [17.11.2009|23:08] C:\Program Files\Common Files\Adobe
   [17.11.2009|23:09] C:\Program Files\Common Files\Adobe AIR
   [17.11.2009|23:12] C:\Program Files\Common Files\DESIGNER
   [18.11.2009|02:17] C:\Program Files\Common Files\DivX Shared
   [17.11.2008|15:39] C:\Program Files\Common Files\InstallShield
   [17.11.2008|15:28] C:\Program Files\Common Files\Java
   [21.01.2009|12:02] C:\Program Files\Common Files\LightScribe
   [26.11.2009|22:22] C:\Program Files\Common Files\microsoft shared
   [18.11.2009|02:18] C:\Program Files\Common Files\PX Storage Engine
   [06.12.2009|00:14] C:\Program Files\Common Files\Real
   [02.11.2006|12:18] C:\Program Files\Common Files\Services
   [02.11.2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [30.11.2009|02:51] C:\Program Files\Common Files\System
   [23.11.2009|20:37] C:\Program Files\Common Files\Windows Live
   [06.12.2009|00:14] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 90 Processes )

   iexplore.exe ~ [PID:5540]
   iexplore.exe ~ [PID:5608]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\Users\eshak\AppData\Local\Temp
sbBBE0.tmp
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2010-03-08 12:27:14
   Windows 6.0.6002 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:211][D:74]-> C:\Users\eshak\AppData\Local\Temp
   [F:451][D:1]-> C:\Users\eshak\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:1944][D:5]-> C:\Users\eshak\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:1][D:1]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 08.03.2010|12:29 - Option : [1]

   --------------------\  Fin du rapport a 12:29:34
   [ UAC => 1 ]

Utilisateur anonyme · Answer

Re

1)Envoie le fichier comme demandé;merci.

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_eshak-PC.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution . 



2)Relance Lop S&D 

? Choisis cette fois-ci l'option 2 (Suppression) 

? Ne ferme pas la fenêtre lors de la suppression ! 

? Poste le rapport généré (C:\lopR.txt) 

* (Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)


3)Pour désactiver AVG:

    * Ouvre l'interface d'AVG (double clic sur le carré avec 4 couleurs en bas à droite à coté de l'horloge
    * Double-clic sur " the Resident Shield."
    * tu décoches l' option "Resident Shield active". et tu appliques.


4)Pour verification ;poste un nouveau RSIT;merci



@+

melusine2006 · Answer

Bonjour,

d'accord je ferai tout ça dans la journée, il faut d'abord que je récupère l'ordi, ce n'est pas le mien mais celui de mon beau-frère.

en attendant à propos du programme qui se plante tout seul au démarrage ( hp media smart ) vous pensez que c'est dû au virus ( ça serait bizarre, le virus depuis tout ce que j'ai fait s'est fait super discret, on dirait qu'il n'y en a plus d'ailleurs ) ou que c'est autre chose ?

et si c'est autre chose vous avez une idée de comment régler ça ?

encore merci pour tout, dès que j'ai l'ordi je fais tout ce qu'il y a d'indiqué.

melusine2006 · Answer

voila pour lop


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft® Windows Vista™ Home Premium  ( v6.0.6002 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) X2 Dual-Core Mobile RM-74 )
   BIOS : Default System BIOS
   USER : eshak ( Administrator )
   BOOT : Normal boot
   C:\ (Local Disk) - NTFS - Total:286 Go (Free:195 Go)
   D:\ (Local Disk) - NTFS - Total:11 Go (Free:1 Go)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 09.03.2010| 9:53 )

   [ UAC => 1 ]


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\Users\eshak\AppData\Local\Temp
sbBBE0.tmp
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans Local

   [06.03.2010|22:04] C:\Users\eshak\AppData\Local\Adobe
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\Application Data 
   [17.11.2009|23:30] C:\Users\eshak\AppData\Local\ATI
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\AtStart.txt
   [06.03.2010|22:15] C:\Users\eshak\AppData\Local\C44FA4CE-85A5-463A-9526-4B6A6EE31322.txt
   [06.03.2010|23:54] C:\Users\eshak\AppData\Local\d3d9caps.dat
   [08.03.2010|00:21] C:\Users\eshak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\DSwitch.txt
   [27.02.2010|00:23] C:\Users\eshak\AppData\Local\GDIPFONTCACHEV1.DAT
   [08.02.2010|20:18] C:\Users\eshak\AppData\Local\Google
   [21.11.2009|23:43] C:\Users\eshak\AppData\Local\Hewlett-Packard
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\History 
   [08.03.2010|22:20] C:\Users\eshak\AppData\Local\IconCache.db
   [06.03.2010|22:26] C:\Users\eshak\AppData\Local\Microsoft
   [03.01.2010|22:15] C:\Users\eshak\AppData\Local\Microsoft Games
   [17.11.2009|23:10] C:\Users\eshak\AppData\Local\Microsoft Help
   [17.11.2009|23:31] C:\Users\eshak\AppData\Local\QSwitch.txt
   [17.11.2009|23:14] C:\Users\eshak\AppData\Local\Seven Zip
   [09.03.2010|09:53] C:\Users\eshak\AppData\Local\Temp
   [17.11.2009|23:05] C:\Users\eshak\AppData\Local\Temporary Internet Files 
   [18.11.2009|00:57] C:\Users\eshak\AppData\Local\VirtualStore
   [18.11.2009|13:34] C:\Users\eshak\AppData\Local\Yahoo
   [18.11.2009|00:53] C:\Users\eshak\AppData\Local\Yahoo!
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [09.03.2010 09:44][--ah-----] C:\Windows	asks\User_Feed_Synchronization-{1B5256F6-5FF3-408F-9DE9-D72B5B4C11A6}.job
   [08.03.2010 21:39][--a------] C:\Windows	asks\GoogleUpdateTaskMachineUA.job
   [09.03.2010 09:43][--a------] C:\Windows	asks\GoogleUpdateTaskMachineCore.job
   [21.02.2010 12:37][--a------] C:\Windows	asks\HPCeeScheduleForeshak.job
   [09.03.2010 09:43][--ah-----] C:\Windows	asks\SA.DAT
   [08.03.2010 22:20][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [21.01.2009|12:14] C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
   [17.11.2009|23:14] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [17.11.2008|15:03] C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
   [21.01.2009|12:13] C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
   [17.11.2008|14:57] C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
   [21.01.2009|12:11] C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
   [21.01.2009|12:13] C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
   [17.11.2008|14:55] C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
   [17.11.2008|15:03] C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
   [21.01.2009|12:14] C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
   [04.12.2009|00:52] C:\ProgramData\Adobe
   [17.11.2008|15:15] C:\ProgramData\AOL
   [02.11.2006|14:02] C:\ProgramData\Application Data 
   [21.01.2009|11:33] C:\ProgramData\Atheros
   [21.01.2009|12:18] C:\ProgramData\ATI
   [06.03.2010|22:30] C:\ProgramData\AVG Security Toolbar
   [06.03.2010|22:28] C:\ProgramData\avg9
   [25.12.2009|19:40] C:\ProgramData\CanonBJ
   [18.11.2009|14:27] C:\ProgramData\CyberLink
   [02.11.2006|14:02] C:\ProgramData\Desktop 
   [02.11.2006|14:02] C:\ProgramData\Documents 
   [02.11.2006|14:02] C:\ProgramData\Favorites 
   [10.12.2009|21:11] C:\ProgramData\Google
   [21.01.2009|12:14] C:\ProgramData\Hewlett-Packard
   [07.03.2010|17:42] C:\ProgramData\Malwarebytes
   [23.11.2009|20:49] C:\ProgramData\Microsoft
   [10.12.2009|21:40] C:\ProgramData\Microsoft Help
   [17.01.2010|18:05] C:\ProgramData\Norton
   [17.11.2008|14:03] C:\ProgramData\NortonInstaller
   [07.03.2010|22:55] C:\ProgramData
tuser.pol
   [24.01.2010|00:41] C:\ProgramData\Office Genuine Advantage
   [05.03.2010|00:40] C:\ProgramData\Real
   [07.03.2010|22:38] C:\ProgramData\Spybot - Search & Destroy
   [02.11.2006|14:02] C:\ProgramData\Start Menu 
   [17.11.2009|23:32] C:\ProgramData\Symantec
   [21.01.2009|12:14] C:\ProgramData\Temp
   [02.11.2006|14:02] C:\ProgramData\Templates 
   [22.11.2009|01:07] C:\ProgramData\WildTangent
   [18.11.2009|00:53] C:\ProgramData\Yahoo!
   [17.01.2010|18:26] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [03.01.2010|17:11] C:\Program Files\A4Tech
   [17.11.2009|23:14] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [17.11.2009|23:09] C:\Program Files\Adobe
   [21.01.2009|11:33] C:\Program Files\AMD
   [17.11.2008|15:15] C:\Program Files\AOL
   [21.01.2009|11:33] C:\Program Files\Atheros
   [21.01.2009|11:24] C:\Program Files\ATI
   [21.01.2009|11:26] C:\Program Files\ATI Technologies
   [06.03.2010|22:28] C:\Program Files\AVG
   [21.01.2009|11:32] C:\Program Files\Cisco
   [17.01.2010|18:07] C:\Program Files\Common Files
   [17.11.2008|15:04] C:\Program Files\CyberLink
   [21.01.2009|11:28] C:\Program Files\DIFX
   [18.11.2009|02:18] C:\Program Files\DivX
   [06.03.2010|23:03] C:\Program Files\EasyBits For Kids
   [07.12.2009|19:07] C:\Program Files\FreeTime
   [10.12.2009|21:11] C:\Program Files\Google
   [21.01.2009|12:10] C:\Program Files\Hewlett-Packard
   [03.12.2009|22:58] C:\Program Files\HP
   [17.11.2008|14:52] C:\Program Files\HP Games
   [21.01.2009|11:31] C:\Program Files\IDT
   [21.01.2009|12:14] C:\Program Files\InstallShield Installation Information
   [31.01.2010|23:01] C:\Program Files\Internet Explorer
   [10.12.2009|21:08] C:\Program Files\Java
   [23.11.2009|20:51] C:\Program Files\Microsoft
   [02.11.2006|13:37] C:\Program Files\Microsoft Games
   [17.11.2009|23:12] C:\Program Files\Microsoft Office
   [24.01.2010|00:39] C:\Program Files\Microsoft Silverlight
   [23.11.2009|20:46] C:\Program Files\Microsoft SQL Server Compact Edition
   [23.11.2009|20:49] C:\Program Files\Microsoft Sync Framework
   [23.11.2009|22:31] C:\Program Files\Microsoft Works
   [17.11.2009|23:12] C:\Program Files\Microsoft.NET
   [30.11.2009|02:51] C:\Program Files\Movie Maker
   [02.11.2006|13:37] C:\Program Files\MSBuild
   [20.11.2009|01:25] C:\Program Files\MSXML 4.0
   [17.11.2009|23:20] C:\Program Files\Online Services
   [18.11.2009|01:12] C:\Program Files\PoivY.com
   [06.12.2009|00:14] C:\Program Files\Real
   [21.01.2009|11:31] C:\Program Files\Realtek
   [02.11.2006|13:37] C:\Program Files\Reference Assemblies
   [17.11.2009|23:30] C:\Program Files\SMINST
   [07.03.2010|22:39] C:\Program Files\Spybot - Search & Destroy
   [21.01.2009|11:27] C:\Program Files\Synaptics
   [07.03.2010|21:10] C:\Program Files\Trend Micro
   [02.11.2006|14:01] C:\Program Files\Uninstall Information
   [04.12.2009|00:54] C:\Program Files\uTorrent
   [06.12.2009|01:01] C:\Program Files\VideoLAN
   [30.11.2009|02:51] C:\Program Files\Windows Calendar
   [30.11.2009|02:51] C:\Program Files\Windows Collaboration
   [30.11.2009|02:51] C:\Program Files\Windows Defender
   [30.11.2009|02:51] C:\Program Files\Windows Journal
   [23.11.2009|20:50] C:\Program Files\Windows Live
   [23.11.2009|20:43] C:\Program Files\Windows Live SkyDrive
   [12.02.2010|22:32] C:\Program Files\Windows Mail
   [30.11.2009|02:51] C:\Program Files\Windows Media Player
   [02.11.2006|13:37] C:\Program Files\Windows NT
   [30.11.2009|02:51] C:\Program Files\Windows Photo Gallery
   [06.12.2009|23:22] C:\Program Files\Windows Portable Devices
   [30.11.2009|02:51] C:\Program Files\Windows Sidebar
   [18.11.2009|00:53] C:\Program Files\Yahoo!
   [07.03.2010|22:43] C:\Program Files\ZHPDiag

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [17.11.2009|23:08] C:\Program Files\Common Files\Adobe
   [17.11.2009|23:09] C:\Program Files\Common Files\Adobe AIR
   [17.11.2009|23:12] C:\Program Files\Common Files\DESIGNER
   [18.11.2009|02:17] C:\Program Files\Common Files\DivX Shared
   [17.11.2008|15:39] C:\Program Files\Common Files\InstallShield
   [17.11.2008|15:28] C:\Program Files\Common Files\Java
   [21.01.2009|12:02] C:\Program Files\Common Files\LightScribe
   [26.11.2009|22:22] C:\Program Files\Common Files\microsoft shared
   [18.11.2009|02:18] C:\Program Files\Common Files\PX Storage Engine
   [06.12.2009|00:14] C:\Program Files\Common Files\Real
   [02.11.2006|12:18] C:\Program Files\Common Files\Services
   [02.11.2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [30.11.2009|02:51] C:\Program Files\Common Files\System
   [23.11.2009|20:37] C:\Program Files\Common Files\Windows Live
   [06.12.2009|00:14] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 93 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2010-03-09 09:54:31
   Windows 6.0.6002 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MSNIWPL\google_no[7].txt 12279 bytes
   scan completed successfully
   hidden processes: 0
   hidden files: 1
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:220][D:74]-> C:\Users\eshak\AppData\Local\Temp
   [F:458][D:1]-> C:\Users\eshak\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:2214][D:5]-> C:\Users\eshak\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:1][D:1]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 08.03.2010|12:29 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 09.03.2010| 9:57 - Option : [2]

   --------------------\  Fin du rapport a  9:57:10
   [ UAC => 1 ]

melusine2006 · Answer

et pour rsit cette fois pas d infotxt juste log j espere que c est normal

Logfile of random's system information tool 1.06 (written by random/random)
Run by eshak at 2010-03-09 10:07:38
Microsoft® Windows Vista™ Home Premium  Service Pack 2
System drive C: has 200 GB (68%) free of 293 GB
Total RAM: 3069 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:42, on 09.03.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\PoivY.com\PoivY\PoivY.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\ytbb.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10e.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Windows\system32\conime.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Users\eshak\Desktop\RSIT.exe
C:\Program Files	rend micro\eshak.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DVDAgent] "C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe"
O4 - HKLM\..\Run: [TSMAgent] "C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"
O4 - HKLM\..\Run: [CLMLServer for HP TouchSmart] "C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [TVAgent] "C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam"
O4 - HKLM\..\Run: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePDIRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [PoivY] "C:\Program Files\PoivY.com\PoivY\PoivY.exe" -nosplash -minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\aestsrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: AVG Firewall (avgfws9) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgfws9.exe
O23 - Service: AVG9IDSAgent (AVGIDSAgent) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Googles oppdateringstjeneste (gupdate1ca67ecf57615e0) (gupdate1ca67ecf57615e0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_805f33de\STacSV.exe
O23 - Service: TV Background Capture Service (TVBCS) (TVCapSvc) - Unknown owner - C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
O23 - Service: TV Task Scheduler (TVTS) (TVSched) - Unknown owner - C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

Utilisateur anonyme · Answer

Bonsoir 

? Rends toi sur ce site :  

https://www.virustotal.com/gui/  

? Clique sur " parcourir ", cherche ces fichiers :  

C:\Windows\system32\C44FA4CE-85A5-463A-9526-4B6A6EE31322.txt     

? Clique sur Send File.  

? Un rapport va s'élaborer ligne à ligne.  

? Attends la fin. Il doit comprendre la taille du fichier envoyé.  

? Sauvegarde le rapport avec le bloc-notes.  

? Copie le dans ta réponse.  

(!) Si VirusTotal indique que le fichier a déjà été analysé, cliquer sur le bouton Reanalyser le fichier maintenant 


@+ 
On a tous été un jour débutant dans quelque chose. 
Mais le savoir est la récompense de l'assiduité.

Melusine2006 · Answer

Bonsoir,

j'ai rendu l'ordinateur à mon beau-frère. Ca fait trois jours que je lui pique et là il ne comprend plus pourquoi parce qu'il ne voit pas de changement, son ordi marche tout à fait normalement...

Pour le programme à la con je l'ai supprimé en passant par ajout/suppression des programmes de toutes façons il ne s'en servait pas donc...

J'espère qu'il n'y a plus de virus ? 

De toutes façons merci beaucoup pour votre aide :)

Vous avez beaucoup de patience, j'admire *chapeau bas*

Utilisateur anonyme · Answer

Re

Donc ;le problème est résolu?
Je te propose de clore ce post.
@+

melusine2006 · Answer

vi :)

je ne trouve pas comment mettre le post en résolu

merci

Utilisateur anonyme · Answer

Re

Je m'en occupe.
Bon surf mais avec vigilance...

@+

Trojan horse

27 réponses

Discussions similaires

Newsletters