Scan SEARCHSETTINS via Toolbar S&D, Merci!! Fermé

Question

Bonjour à tous,

je suis harcélée par la petite fenetre Search Settings.msi et je veux m'en débarasser. Après quelques recherches de solutions sur le net, j'ai effectué un scan via Toolbar S&D et voici le rapport d'analyse, si toutefois un génie pouvait l'interpréter pour me donner la procédure de suppression, ce serait génial!

Merci à tous!

 C:\ (Local Disk) - NTFS - Total:111 Go (Free:28 Go)
   D:\ (Local Disk) - NTFS - Total:110 Go (Free:33 Go)
   E:\ (CD or DVD)
   F:\ (Local Disk) - FAT32 - Total:372 Go (Free:329 Go)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [1] ( 21/03/2010| 8:08 )

   [ UAC => 1 ]

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "SEARCH PAGE"="https://www.google.com/?gws_rd=ssl"
   "Local Page"="C:\Windows\system32\blank.htm"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
   "Start Page"="https://fr.yahoo.com/"
   "Default_Page_URL"="https://fr.yahoo.com/?fr=fp-yie8"
   "Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://fr.yahoo.com/"
   "Default_Page_URL"="https://fr.yahoo.com/"
   "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
   "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
   "Local Page"="C:\Windows\System32\blank.htm"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 21/03/2010| 8:08 - Option : [1]

   -----------\  Fin du rapport a  8:08:33,21

moment de grace · Answer

bonjour


* Télécharge de AD-Remover sur ton Bureau. (Merci à C_XX) 
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe 

Miroir: 

https://www.androidworld.fr/ 

/!\ Déconnecte-toi d'internet et ferme toutes applications en cours /!\ 

? Désactive provisoirement et seulement le temps de l'utilisation de ADremover, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. 

- Double-clique sur l'icône Ad-remover située sur ton Bureau. 
- Sur la page, clique sur le bouton « NETTOYER » 
- Confirme lancement du scan 
- Laisse travailler l'outil. 
- Poste le rapport qui apparaît à la fin. 

(Le rapport est sauvegardé aussi sous C:\Ad-report(Scan/clean).Txt) 

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Moni@ · Answer

merci à toi!
voici le rapport 


======= RAPPORT D'AD-REMOVER 2.0.0.0,B | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 19/03/10 à 18:30
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 08:39:45 le 21/03/2010 | Mode normal | Option: SCAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows Vista(TM) HomePremium Service Pack 2 - X86
Nom du PC: PC-DE-MONIA | Utilisateur actuel: Monia (Administrateur)
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.
Service: *RelevantKnowledge*
.
C:\Program Files\Dealio Toolbar
C:\Program Files\Everest Poker
C:\Program Files\Fast Browser Search
C:\Program Files\PokerStars
C:\Program Files\RelevantKnowledge
C:\Program Files\Search Guard PlusU
C:\Program Files\SGPSA
C:\Program Files\Windows Live\Messenger\Msimg32.dll
C:\Program Files\Windows Live\Messenger\Riched20.dll
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everest Poker
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\PartyPoker.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PartyPoker
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
C:\Programs\PartyGaming
C:\Users\Monia\AppData\Local\PokerStars
C:\Users\Monia\AppData\LocalLow\Dealio
C:\Users\Monia\AppData\LocalLow\Search Settings
C:\Users\Monia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PartyPoker.lnk
C:\Users\Monia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PartyPoker
C:\Users\Monia\Contacts\Desktop\PartyPoker.lnk
C:\Users\Public\Desktop\Everest Poker.lnk
C:\Users\Public\MyWebTattoo.exe
C:\Windows\Downloaded Program Files\F3initialsetup1.0.1.1.inf
.
HKCU\Software\AppDataLow\Software\Dealio
HKCU\Software\Grand Virtual
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1979999C-7659-4549-8336-9968117202A4}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKCU\Software\PartyGaming
HKLM\Software\Classes\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKLM\Software\Classes\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}
HKLM\Software\Classes\CLSID\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKLM\Software\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
HKLM\Software\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Classes\CLSID\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKLM\Software\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKLM\Software\Classes\ComObject.DeskbarEnabler
HKLM\Software\Classes\ComObject.DeskbarEnabler.1
HKLM\Software\Classes\Installer\Products\79CAA1B036589D14EA74856E2A220F1E
HKLM\Software\Classes\Installer\Products\A3BB3C491A65ED342A24B8144FE679FE
HKLM\Software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
HKLM\Software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
HKLM\Software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
HKLM\Software\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}
HKLM\Software\Classes\SearchSettings.BHO
HKLM\Software\Classes\SearchSettings.BHO.1
HKLM\Software\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
HKLM\Software\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}
HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
HKLM\Software\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook
HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook.1
HKLM\Software\Dealio
HKLM\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{53AA34DE-1990-4370-A963-1105B66911FD}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\79CAA1B036589D14EA74856E2A220F1E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A3BB3C491A65ED342A24B8144FE679FE
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0B1AAC97-8563-41D9-AE47-58E6A222F0E1}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PartyPoker
HKLM\Software\Search Settings
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{91C18ED5-5E1C-4AE5-A148-A861DE8C8E16}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\kb128\SearchSettings.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\kb128\SearchSettingsRes409.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettings.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\CleanUp.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\CleanUp.txt
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\DID.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\images\habeas_webseal.gif
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\libeay32.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\llh.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\PartyGaming.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\PGDetector.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\PGImageDll.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\ssleay32.dll
.
============== SCAN ADDITIONNEL ==============
.
.
* Internet Explorer Version 8.0.6001.18882 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://fr.yahoo.com/?fr=fp-yie8
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search Page: hxxp://www.google.com
Show_ToolBar: yes
Start Page: hxxp://fr.yahoo.com/
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://fr.fr.acer.yahoo.com
Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Start Page: hxxp://fr.fr.acer.yahoo.com
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: hxxp://www.fastbrowsersearch.com/new-tab/?v=18&tid={2058E424-C3B0-43f2-AB2E-E7095322E76A}
Blank: res://mshtml.dll/blank.htm
.
========================================
.
C:\Users\Monia\AppData\Local\Temp: 4463 Fichier(s), 237 Dossier(s)
C:\Windows	emp: 380 Fichier(s), 38 Dossier(s)
C:\Users\Monia\AppData\Roaming\Microsoft\Windows\Cookies: 146 Fichier(s), 2 Dossier(s)
Temporary Internet Files: 511 Fichier(s), 165 Dossier(s)
.
C:\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Ad-Remover\Backup: 0 Fichier(s)
.
C:\Ad-Report-SCAN[1].txt - 10755 Octet(s)
.
Fin à: 08:48:28, 21/03/2010
.
============== E.O.F - SCAN[1] ==============

moment de grace · Answer

vu

tu n'as pas fait la bonne option..

relancer Ad Remover option NETTOYER et poster le rapport

ensuite pour vérifier le reste du pc

* Télécharge Random's System Information Tool (RSIT) de Random/Random. 

(outil de diagnostic)

http://images.malwareremoval.com/random/RSIT.exe 

* Enregistre le sur ton Bureau. 

* Double clique sur RSIT.exe pour lancer l'outil. 

* Clique sur "Continue" à l'écran Disclaimer. 

* Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) 

et tu devras accepter la licence. 

* Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp

Les rapports se trouvent à cet endroit: 
C:\rsit\info.txt 
C:\rsit\log.txt

Moni@ · Answer

voici le rapport avec l'option NETTOYER : ad remover


======= RAPPORT D'AD-REMOVER 2.0.0.0,B | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 19/03/10 à 18:30
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 08:58:09 le 21/03/2010 | Mode normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows Vista(TM) HomePremium Service Pack 2 - X86
Nom du PC: PC-DE-MONIA | Utilisateur actuel: Monia (Administrateur)
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
Service: *RelevantKnowledge*
.
C:\Program Files\Dealio Toolbar
C:\Program Files\Everest Poker
C:\Program Files\Fast Browser Search
C:\Program Files\PokerStars
C:\Program Files\RelevantKnowledge
C:\Program Files\Search Guard PlusU
C:\Program Files\SGPSA
C:\Program Files\Windows Live\Messenger\Msimg32.dll
C:\Program Files\Windows Live\Messenger\Riched20.dll
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everest Poker
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\PartyPoker.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PartyPoker
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
C:\Programs\PartyGaming
C:\Users\Monia\AppData\Local\PokerStars
C:\Users\Monia\AppData\LocalLow\Dealio
C:\Users\Monia\AppData\LocalLow\Search Settings
C:\Users\Monia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PartyPoker.lnk
C:\Users\Monia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PartyPoker
C:\Users\Monia\Contacts\Desktop\PartyPoker.lnk
C:\Users\Public\Desktop\Everest Poker.lnk
C:\Users\Public\MyWebTattoo.exe
C:\Windows\Downloaded Program Files\F3initialsetup1.0.1.1.inf

(!) -- Fichiers temporaires supprimés.
.
HKCU\Software\AppDataLow\Software\Dealio
HKCU\Software\Grand Virtual
HKCU\Software\Microsoft\Internet Explorer\LowRegistry\Search Settings
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1979999C-7659-4549-8336-9968117202A4}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKCU\Software\PartyGaming
HKLM\Software\Classes\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKLM\Software\Classes\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}
HKLM\Software\Classes\CLSID\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKLM\Software\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
HKLM\Software\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Classes\CLSID\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKLM\Software\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKLM\Software\Classes\ComObject.DeskbarEnabler
HKLM\Software\Classes\ComObject.DeskbarEnabler.1
HKLM\Software\Classes\Installer\Products\79CAA1B036589D14EA74856E2A220F1E
HKLM\Software\Classes\Installer\Products\A3BB3C491A65ED342A24B8144FE679FE
HKLM\Software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
HKLM\Software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
HKLM\Software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
HKLM\Software\Classes\Interface\{D5A1EF9A-7948-435D-8B87-D6A598317288}
HKLM\Software\Classes\SearchSettings.BHO
HKLM\Software\Classes\SearchSettings.BHO.1
HKLM\Software\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
HKLM\Software\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}
HKLM\Software\Classes\TypeLib\{CD082CCA-086F-4FD8-8FD7-247A0DBBD1CC}
HKLM\Software\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook
HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook.1
HKLM\Software\Dealio
HKLM\Software\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{53AA34DE-1990-4370-A963-1105B66911FD}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0626A63-410B-45E2-99A1-3F2475B2D695}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\79CAA1B036589D14EA74856E2A220F1E
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A3BB3C491A65ED342A24B8144FE679FE
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0B1AAC97-8563-41D9-AE47-58E6A222F0E1}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PartyPoker
HKLM\Software\Search Settings
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{91C18ED5-5E1C-4AE5-A148-A861DE8C8E16}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKLM\Software\Microsoft\Windows\CurrentVersion\Run|SearchSettings
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\kb128\SearchSettings.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\kb128\SearchSettingsRes409.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Search Settings\SearchSettings.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\CleanUp.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\CleanUp.txt
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\DID.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\images\habeas_webseal.gif
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\libeay32.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\llh.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\PartyGaming.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\PGDetector.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\PGImageDll.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\programs\partygaming	mpUpgrade\..\ssleay32.dll
.
============== SCAN ADDITIONNEL ==============
.
.
* Internet Explorer Version 8.0.6001.18882 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
========================================
.
C:\Users\Monia\AppData\Local\Temp: 6 Fichier(s), 237 Dossier(s)
C:\Windows	emp: 0 Fichier(s), 38 Dossier(s)
C:\Users\Monia\AppData\Roaming\Microsoft\Windows\Cookies: 2 Fichier(s), 2 Dossier(s)
Temporary Internet Files: 2 Fichier(s), 165 Dossier(s)
.
C:\Ad-Remover\Quarantine: 3929 Fichier(s)
C:\Ad-Remover\Backup: 15 Fichier(s)
.
C:\Ad-Report-CLEAN[1].txt - 10982 Octet(s)
C:\Ad-Report-SCAN[1].txt - 10880 Octet(s)
.
Fin à: 09:07:36, 21/03/2010
.
============== E.O.F - CLEAN[1] ==============

moment de grace · Answer

vu

==> RSIT stp maintenant

Moni@ · Answer

1ere partie du 1er rapport 

Logfile of random's system information tool 1.06 (written by random/random)
Run by Monia at 2010-03-21 09:26:45
Microsoft® Windows Vista(TM) Édition Familiale Premium  Service Pack 2
System drive C: has 31 GB (27%) free of 114 GB
Total RAM: 3069 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:27:58, on 21/03/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Users\Monia\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\Lexmark 5400 Series\lxctmon.exe
C:\Program Files\Lexmark 5400 Series\ezprint.exe
C:\Windows\System32undll32.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32undll32.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Fr Codec\FFDShow\svcodecs.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Program Files\Apoint2K\Apntex.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Monia\Contacts\Desktop\RSIT.exe
C:\Program Files	rend micro\Monia.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\IPSBHO.DLL
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [lxctmon.exe] "C:\Program Files\Lexmark 5400 Series\lxctmon.exe"
O4 - HKLM\..\Run: [Lexmark 5400 Series Fax Server] "C:\Program Files\Lexmark 5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 5400 Series\ezprint.exe"
O4 - HKLM\..\Run: [LXCTCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [codecs] C:\Program Files\Fr Codec\FFDShow\svcodecs.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O13 - Gopher Prefix: 
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/...
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.fnacphoto.com/ECTelechargement/Origma/ImageUploader5.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {A66AC08A-ECD9-4031-A058-618E2756705F} (UploadPhoto.IconeaAX) - http://www.iconea.fr/apps/IconeaX.CAB
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.mypix.com/fr/fr/importer/ImageUploader4.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxct_device -   - C:\Windows\system32\lxctcoms.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

Moni@ · Answer

2eme partie du 1er rapport 

End of file - 11867 bytes

======Scheduled tasks folder======

C:\Windows	asks\Norton Internet Security - Effectuer une analyse complète du système - Monia.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll [2009-12-10 394608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\IPSBHO.DLL [2009-11-17 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}]
ShowBarObj Class - C:\Windows\system32\ActiveToolBand.dll [2007-04-25 299008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-04-25 151552]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll [2009-12-10 394608]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"ALaunch"=C:\Acer\ALaunch\AlaunchClient.exe []
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-07-06 4669440]
"eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-04-25 457216]
"Acer Tour"= []
"PLFSetL"=C:\Windows\PLFSetL.exe [2007-07-05 94208]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-07-12 178712]
"LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe [2007-10-17 768520]
"PlayMovie"=C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [2007-12-05 200704]
"eRecoveryService"= []
"WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-05 57344]
"Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-08-01 151552]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2007-06-06 159744]
"eAudio"=C:\Acer\Empowering Technology\eAudio\eAudio.exe [2007-08-31 1286144]
"lxctmon.exe"=C:\Program Files\Lexmark 5400 Series\lxctmon.exe [2007-03-19 291760]
"Lexmark 5400 Series Fax Server"=C:\Program Files\Lexmark 5400 Series\fm3032.exe [2007-03-19 304048]
"EzPrint"=C:\Program Files\Lexmark 5400 Series\ezprint.exe [2007-03-19 82864]
"LXCTCATS"=rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16 []
"Skytel"=C:\Windows\Skytel.exe [2007-06-15 1826816]
"NvSvc"=C:\Windows\system32
vsvc.dll [2007-10-10 86016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-10-10 8501792]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-10-10 81920]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OBealsched.exe [2008-07-20 185896]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-15 149280]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"BlackBerryAutoUpdate"=C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe [2009-05-12 623888]
""= []
"RoxWatchTray"=C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [2009-04-11 236016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"Acer Tour Reminder"= []
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"codecs"=C:\Program Files\Fr Codec\FFDShow\svcodecs.exe [2008-11-14 3325440]
"ISUSPM"=C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2008-10-24 206112]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfUsbccidDriver]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoFolderOptions"=0
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{329001b6-28c1-11dd-834e-db09700afe71}]
shell\AutoRun\command - F:\
shell\explore\command - RECYCLED\INFO.exe
shell\open\command - RECYCLED\INFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb323154-5810-11dd-a559-001b38cfe883}]
shell\AutoRun\command - F:\
shell\explore\command - F:\RECYCLED\INFO.exe
shell\open\command - F:\RECYCLED\INFO.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-21 09:26:45 ----D---- C:sit
2010-03-21 09:26:45 ----D---- C:\Program Files	rend micro
2010-03-21 08:58:14 ----A---- C:\Ad-Report-CLEAN[1].txt
2010-03-21 08:40:01 ----A---- C:\Ad-Report-SCAN[1].txt
2010-03-21 08:39:44 ----D---- C:\Ad-Remover
2010-03-21 08:07:58 ----A---- C:\TB.txt
2010-03-21 08:06:51 ----D---- C:\ToolBar SD
2010-03-20 20:52:50 ----D---- C:\Users\Monia\AppData\Roaming\Malwarebytes
2010-03-20 20:52:44 ----D---- C:\ProgramData\Malwarebytes
2010-03-20 20:52:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-03-20 20:30:47 ----D---- C:\Windows\system32\eu-ES
2010-03-20 20:30:47 ----D---- C:\Windows\system32\ca-ES
2010-03-20 20:30:46 ----D---- C:\Windows\system32\vi-VN
2010-03-11 23:47:13 ----A---- C:\Windows\_MSRSTRT.EXE
2010-03-11 23:29:02 ----D---- C:\Program Files\Babylon
2010-03-11 23:18:09 ----D---- C:\Program Files\AutoShutdown
2010-03-10 10:45:21 ----A---- C:\Windows\system32
shhttp.dll
2010-03-10 10:45:18 ----A---- C:\Windows\system32\httpapi.dll
2010-03-09 21:40:01 ----A---- C:\Windows\system32
toskrnl.exe
2010-03-09 21:40:01 ----A---- C:\Windows\system32
tkrnlpa.exe
2010-02-23 21:10:48 ----A---- C:\Windows\system32\jscript.dll
2010-02-23 21:10:43 ----A---- C:\Windows\system32	zres.dll
2010-02-23 21:10:11 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-02-23 21:10:11 ----A---- C:\Windows\system32\RMActivate.exe
2010-02-23 21:10:10 ----A---- C:\Windows\system32\secproc_isv.dll
2010-02-23 21:10:10 ----A---- C:\Windows\system32\secproc.dll
2010-02-23 21:10:10 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-02-23 21:10:10 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-02-23 21:10:10 ----A---- C:\Windows\system32\msdrm.dll
2010-02-23 21:10:09 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-02-23 21:10:09 ----A---- C:\Windows\system32\secproc_ssp.dll

======List of files/folders modified in the last 1 months======

2010-03-21 09:27:58 ----D---- C:\Windows\Prefetch
2010-03-21 09:26:45 ----RD---- C:\Program Files
2010-03-21 09:26:37 ----D---- C:\Windows\Temp
2010-03-21 09:22:49 ----D---- C:\Windows\inf
2010-03-21 09:18:20 ----SHD---- C:\System Volume Information
2010-03-21 09:06:05 ----SD---- C:\Windows\Downloaded Program Files
2010-03-21 09:06:04 ----D---- C:\Programs
2010-03-21 08:31:01 ----SHD---- C:\Windows\Installer
2010-03-21 08:02:16 ----D---- C:\Windows\system32\catroot
2010-03-21 08:02:14 ----D---- C:\Windows\system32\catroot2
2010-03-21 08:02:12 ----D---- C:\Windows\winsxs
2010-03-20 21:06:56 ----D---- C:\Windows\Microsoft.NET
2010-03-20 21:06:47 ----RSD---- C:\Windows\assembly
2010-03-20 20:55:11 ----D---- C:\Windowsescache
2010-03-20 20:52:45 ----D---- C:\Windows\system32\drivers
2010-03-20 20:52:44 ----HD---- C:\ProgramData
2010-03-20 20:45:30 ----D---- C:\Windows\System32
2010-03-20 20:44:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-03-20 20:41:12 ----D---- C:\Windows
2010-03-20 20:41:03 ----SHD---- C:\Boot
2010-03-20 20:31:59 ----D---- C:\Program Files\Windows Mail
2010-03-20 20:31:59 ----D---- C:\Program Files\Windows Calendar
2010-03-20 20:31:59 ----D---- C:\Program Files\Movie Maker
2010-03-20 20:31:58 ----D---- C:\Program Files\Windows Sidebar
2010-03-20 20:31:58 ----D---- C:\Program Files\Windows Media Player
2010-03-20 20:31:58 ----D---- C:\Program Files\Windows Journal
2010-03-20 20:31:58 ----D---- C:\Program Files\Windows Collaboration
2010-03-20 20:31:58 ----D---- C:\Program Files\Internet Explorer
2010-03-20 20:31:56 ----D---- C:\Program Files\Windows Photo Gallery
2010-03-20 20:31:56 ----D---- C:\Program Files\Common Files\System
2010-03-20 20:31:53 ----D---- C:\Windows\servicing
2010-03-20 20:31:53 ----D---- C:\Program Files\Windows Defender
2010-03-20 20:31:52 ----D---- C:\Windows\ehome
2010-03-20 20:31:39 ----D---- C:\Windows\system32\XPSViewer
2010-03-20 20:31:39 ----D---- C:\Windows\system32\sk-SK
2010-03-20 20:31:39 ----D---- C:\Windows\system32\lv-LV
2010-03-20 20:31:39 ----D---- C:\Windows\system32\ko-KR
2010-03-20 20:31:39 ----D---- C:\Windows\system32\it-IT
2010-03-20 20:31:39 ----D---- C:\Windows\system32\hr-HR
2010-03-20 20:31:39 ----D---- C:\Windows\system32\et-EE
2010-03-20 20:31:39 ----D---- C:\Windows\system32\en-US
2010-03-20 20:31:39 ----D---- C:\Windows\system32\el-GR
2010-03-20 20:31:39 ----D---- C:\Windows\system32\de-DE
2010-03-20 20:31:39 ----D---- C:\Windows\system32\da-DK
2010-03-20 20:31:39 ----D---- C:\Windows\IME
2010-03-20 20:31:38 ----D---- C:\Windows\system32\oobe
2010-03-20 20:31:38 ----D---- C:\Windows\system32\migration
2010-03-20 20:31:38 ----D---- C:\Windows\system32\fr
2010-03-20 20:31:36 ----D---- C:\Windows\system32u-RU
2010-03-20 20:31:36 ----D---- C:\Windows\system32\AdvancedInstallers
2010-03-20 20:31:33 ----D---- C:\Windows\system32\fr-FR
2010-03-20 20:31:29 ----D---- C:\Windows\system32\sv-SE
2010-03-20 20:31:29 ----D---- C:\Windows\system32\setup
2010-03-20 20:31:29 ----D---- C:\Windows\system32\he-IL
2010-03-20 20:31:28 ----D---- C:\Windows\system32\SLUI
2010-03-20 20:31:28 ----D---- C:\Windows\system32\pt-PT
2010-03-20 20:31:28 ----D---- C:\Windows\system32\hu-HU
2010-03-20 20:31:28 ----D---- C:\Windows\system32\fi-FI
2010-03-20 20:31:28 ----D---- C:\Windows\system32\cs-CZ
2010-03-20 20:31:27 ----D---- C:\Windows\system32\zh-CN
2010-03-20 20:31:27 ----D---- C:\Windows\system32\sr-Latn-CS
2010-03-20 20:31:27 ----D---- C:\Windows\system32\manifeststore
2010-03-20 20:31:26 ----D---- C:\Windows\system32\zh-TW
2010-03-20 20:31:26 ----D---- C:\Windows\system32\uk-UA
2010-03-20 20:31:26 ----D---- C:\Windows\system32\sl-SI
2010-03-20 20:31:26 ----D---- C:\Windows\system32o-RO
2010-03-20 20:31:26 ----D---- C:\Windows\system32\pl-PL
2010-03-20 20:31:26 ----D---- C:\Windows\system32\ja-JP
2010-03-20 20:31:26 ----D---- C:\Windows\system32\es-ES
2010-03-20 20:31:26 ----D---- C:\Windows\system32\bg-BG
2010-03-20 20:31:25 ----D---- C:\Windows\system32	h-TH
2010-03-20 20:31:24 ----D---- C:\Windows\system32	r-TR
2010-03-20 20:31:23 ----D---- C:\Windows\system32\wbem
2010-03-20 20:31:23 ----D---- C:\Windows\system32
l-NL
2010-03-20 20:31:23 ----D---- C:\Windows\system32
b-NO
2010-03-20 20:31:22 ----D---- C:\Windows\system32\lt-LT
2010-03-20 20:31:22 ----D---- C:\Windows\system32\ar-SA
2010-03-20 20:31:21 ----D---- C:\Windows\system32\pt-BR
2010-03-20 20:31:21 ----D---- C:\Windows\system32\migwiz
2010-03-20 20:30:54 ----RSD---- C:\Windows\Fonts
2010-03-20 20:30:54 ----D---- C:\Windows\AppPatch
2010-03-20 20:30:46 ----D---- C:\Windows\system32\Boot
2010-03-20 20:28:51 ----D---- C:\Windows\system32\RTCOM
2010-03-20 19:43:26 ----D---- C:\Users\Monia\AppData\Roaming\Azureus
2010-03-20 12:39:58 ----D---- C:\Program Files\Vuze
2010-03-16 22:58:49 ----D---- C:\Program Files\Full Tilt Poker
2010-03-15 21:25:47 ----D---- C:\Program Files\Lx_cats
2010-03-11 23:43:48 ----D---- C:\Windows\system32\Tasks
2010-03-02 06:30:12 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100211.001\BHDrvx86.sys [2010-02-11 536112]
R1 ccHP;Symantec Hash Provider; C:\Windows\system32\drivers\NIS\1105000.07F\ccHPx86.sys [2009-12-09 501888]
R1 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2006-11-02 20112]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2009-08-26 371248]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20100312.001\IDSvix86.sys [2009-10-28 343088]
R1 SRTSP;Symantec Real Time Storage Protection; C:\Windows\System32\Drivers\NIS\1105000.07F\SRTSP.SYS [2009-12-03 325168]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\Windows\system32\drivers\NIS\1105000.07F\SRTSPX.SYS [2009-12-03 43696]
R1 SymIRON;Symantec Iron Driver; C:\Windows\System32\Drivers\NIS\1105000.07F\Ironx86.SYS [2009-11-26 116272]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver; C:\Windows\System32\Drivers\NIS\1105000.07F\SYMTDIV.SYS [2009-11-22 340016]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2007-12-05 41456]
R2 Aspi32;Aspi32; C:\Windows\system32\drivers\Aspi32.sys [1999-09-10 25244]
R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERSimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERSimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERSixdptsk.sys [2007-03-21 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-01-30 8704]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-14 154624]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-02 21264]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 32256]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-08-26 102448]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-04-26 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-04-26 208384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-07-10 1792792]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100320.022\NAVENG.SYS [2010-02-04 84912]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100320.022\NAVEX15.SYS [2010-02-04 1324720]
R3 NETw4v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-12-29 2252800]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-12-25 6144]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS
vlddmkm.sys [2007-10-10 7629504]
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial.sys [2009-01-09 27136]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2008-01-19 8192]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-08-02 1749376]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2010-01-04 124976]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-04-26 660480]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 61883;Pilote d'unité 61883; C:\Windows\system32\DRIVERS\61883.sys [2008-01-19 45696]
S3 Avc;Périphérique AVC; C:\Windows\system32\DRIVERS\avc.sys [2008-01-19 40448]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 180736]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 MSDV;Microsoft DV Camera and VCR; C:\Windows\system32\DRIVERS\msdv.sys [2008-01-19 52608]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETw3v32;Pilote de carte Intel(R) PRO/Wireless 3945ABG pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
S3 RimUsb;Téléphone intelligent BlackBerry ; C:\Windows\System32\Drivers\RimUsb.sys [2008-05-20 22784]
S3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\NIS\1002000.007\SYMDNS.SYS []
S3 SYMFW;Symantec Network Filter Driver; C:\Windows\System32\Drivers\NIS\1007020.00B\SYMFW.SYS []
S3 SYMNDISV;Symantec Network Filter Driver; C:\Windows\System32\Drivers\NIS\1007020.00B\SYMNDISV.SYS []
S3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\NIS\1002000.007\SYMREDRV.SYS []
S3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]
S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ALaunchService;ALaunch Service; C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]
R2 eDataSecurity Service;eDSService.exe; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-04-25 457512]
R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-10-01 24576]
R2 eNet Service;eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-08-28 131072]
R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-09-10 57344]
R2 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-12-10 24576]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-07-12 354840]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 lxct_device;lxct_device; C:\Windows\system32\lxctcoms.exe [2007-03-19 537520]
R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 107008]
R2 NIS;Norton Internet Security; C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe [2009-12-09 126392]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-01-23 266343]
R2 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-10-30 167936]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-01-30 386560]
S2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe []
S2 Roxio Upnp Server 9;Roxio Upnp Server 9; C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe [2007-12-06 362992]
S2 RoxLiveShare9;LiveShare P2P Server 9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe [2009-04-11 313840]
S2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2009-04-11 170480]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Roxio UPnP Renderer 9;Roxio UPnP Renderer 9; C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe [2007-12-06 88560]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2009-04-11 1108464]

-----------------EOF-----------------

Moni@ · Answer

2eme rapport 
End of file - 11867 bytes

======Scheduled tasks folder======

C:\Windows	asks\Norton Internet Security - Effectuer une analyse complète du système - Monia.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll [2009-12-10 394608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\IPSBHO.DLL [2009-11-17 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}]
ShowBarObj Class - C:\Windows\system32\ActiveToolBand.dll [2007-04-25 299008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-04-25 151552]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll [2009-12-10 394608]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"ALaunch"=C:\Acer\ALaunch\AlaunchClient.exe []
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-07-06 4669440]
"eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-04-25 457216]
"Acer Tour"= []
"PLFSetL"=C:\Windows\PLFSetL.exe [2007-07-05 94208]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-07-12 178712]
"LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe [2007-10-17 768520]
"PlayMovie"=C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [2007-12-05 200704]
"eRecoveryService"= []
"WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-05 57344]
"Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-08-01 151552]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2007-06-06 159744]
"eAudio"=C:\Acer\Empowering Technology\eAudio\eAudio.exe [2007-08-31 1286144]
"lxctmon.exe"=C:\Program Files\Lexmark 5400 Series\lxctmon.exe [2007-03-19 291760]
"Lexmark 5400 Series Fax Server"=C:\Program Files\Lexmark 5400 Series\fm3032.exe [2007-03-19 304048]
"EzPrint"=C:\Program Files\Lexmark 5400 Series\ezprint.exe [2007-03-19 82864]
"LXCTCATS"=rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16 []
"Skytel"=C:\Windows\Skytel.exe [2007-06-15 1826816]
"NvSvc"=C:\Windows\system32
vsvc.dll [2007-10-10 86016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-10-10 8501792]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-10-10 81920]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OBealsched.exe [2008-07-20 185896]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-15 149280]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"BlackBerryAutoUpdate"=C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe [2009-05-12 623888]
""= []
"RoxWatchTray"=C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [2009-04-11 236016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"Acer Tour Reminder"= []
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"codecs"=C:\Program Files\Fr Codec\FFDShow\svcodecs.exe [2008-11-14 3325440]
"ISUSPM"=C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2008-10-24 206112]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\WudfUsbccidDriver]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoFolderOptions"=0
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{329001b6-28c1-11dd-834e-db09700afe71}]
shell\AutoRun\command - F:\
shell\explore\command - RECYCLED\INFO.exe
shell\open\command - RECYCLED\INFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb323154-5810-11dd-a559-001b38cfe883}]
shell\AutoRun\command - F:\
shell\explore\command - F:\RECYCLED\INFO.exe
shell\open\command - F:\RECYCLED\INFO.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-03-21 09:26:45 ----D---- C:sit
2010-03-21 09:26:45 ----D---- C:\Program Files	rend micro
2010-03-21 08:58:14 ----A---- C:\Ad-Report-CLEAN[1].txt
2010-03-21 08:40:01 ----A---- C:\Ad-Report-SCAN[1].txt
2010-03-21 08:39:44 ----D---- C:\Ad-Remover
2010-03-21 08:07:58 ----A---- C:\TB.txt
2010-03-21 08:06:51 ----D---- C:\ToolBar SD
2010-03-20 20:52:50 ----D---- C:\Users\Monia\AppData\Roaming\Malwarebytes
2010-03-20 20:52:44 ----D---- C:\ProgramData\Malwarebytes
2010-03-20 20:52:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-03-20 20:30:47 ----D---- C:\Windows\system32\eu-ES
2010-03-20 20:30:47 ----D---- C:\Windows\system32\ca-ES
2010-03-20 20:30:46 ----D---- C:\Windows\system32\vi-VN
2010-03-11 23:47:13 ----A---- C:\Windows\_MSRSTRT.EXE
2010-03-11 23:29:02 ----D---- C:\Program Files\Babylon
2010-03-11 23:18:09 ----D---- C:\Program Files\AutoShutdown
2010-03-10 10:45:21 ----A---- C:\Windows\system32
shhttp.dll
2010-03-10 10:45:18 ----A---- C:\Windows\system32\httpapi.dll
2010-03-09 21:40:01 ----A---- C:\Windows\system32
toskrnl.exe
2010-03-09 21:40:01 ----A---- C:\Windows\system32
tkrnlpa.exe
2010-02-23 21:10:48 ----A---- C:\Windows\system32\jscript.dll
2010-02-23 21:10:43 ----A---- C:\Windows\system32	zres.dll
2010-02-23 21:10:11 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-02-23 21:10:11 ----A---- C:\Windows\system32\RMActivate.exe
2010-02-23 21:10:10 ----A---- C:\Windows\system32\secproc_isv.dll
2010-02-23 21:10:10 ----A---- C:\Windows\system32\secproc.dll
2010-02-23 21:10:10 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-02-23 21:10:10 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-02-23 21:10:10 ----A---- C:\Windows\system32\msdrm.dll
2010-02-23 21:10:09 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-02-23 21:10:09 ----A---- C:\Windows\system32\secproc_ssp.dll

======List of files/folders modified in the last 1 months======

2010-03-21 09:27:58 ----D---- C:\Windows\Prefetch
2010-03-21 09:26:45 ----RD---- C:\Program Files
2010-03-21 09:26:37 ----D---- C:\Windows\Temp
2010-03-21 09:22:49 ----D---- C:\Windows\inf
2010-03-21 09:18:20 ----SHD---- C:\System Volume Information
2010-03-21 09:06:05 ----SD---- C:\Windows\Downloaded Program Files
2010-03-21 09:06:04 ----D---- C:\Programs
2010-03-21 08:31:01 ----SHD---- C:\Windows\Installer
2010-03-21 08:02:16 ----D---- C:\Windows\system32\catroot
2010-03-21 08:02:14 ----D---- C:\Windows\system32\catroot2
2010-03-21 08:02:12 ----D---- C:\Windows\winsxs
2010-03-20 21:06:56 ----D---- C:\Windows\Microsoft.NET
2010-03-20 21:06:47 ----RSD---- C:\Windows\assembly
2010-03-20 20:55:11 ----D---- C:\Windowsescache
2010-03-20 20:52:45 ----D---- C:\Windows\system32\drivers
2010-03-20 20:52:44 ----HD---- C:\ProgramData
2010-03-20 20:45:30 ----D---- C:\Windows\System32
2010-03-20 20:44:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-03-20 20:41:12 ----D---- C:\Windows
2010-03-20 20:41:03 ----SHD---- C:\Boot
2010-03-20 20:31:59 ----D---- C:\Program Files\Windows Mail
2010-03-20 20:31:59 ----D---- C:\Program Files\Windows Calendar
2010-03-20 20:31:59 ----D---- C:\Program Files\Movie Maker
2010-03-20 20:31:58 ----D---- C:\Program Files\Windows Sidebar
2010-03-20 20:31:58 ----D---- C:\Program Files\Windows Media Player
2010-03-20 20:31:58 ----D---- C:\Program Files\Windows Journal
2010-03-20 20:31:58 ----D---- C:\Program Files\Windows Collaboration
2010-03-20 20:31:58 ----D---- C:\Program Files\Internet Explorer
2010-03-20 20:31:56 ----D---- C:\Program Files\Windows Photo Gallery
2010-03-20 20:31:56 ----D---- C:\Program Files\Common Files\System
2010-03-20 20:31:53 ----D---- C:\Windows\servicing
2010-03-20 20:31:53 ----D---- C:\Program Files\Windows Defender
2010-03-20 20:31:52 ----D---- C:\Windows\ehome
2010-03-20 20:31:39 ----D---- C:\Windows\system32\XPSViewer
2010-03-20 20:31:39 ----D---- C:\Windows\system32\sk-SK
2010-03-20 20:31:39 ----D---- C:\Windows\system32\lv-LV
2010-03-20 20:31:39 ----D---- C:\Windows\system32\ko-KR
2010-03-20 20:31:39 ----D---- C:\Windows\system32\it-IT
2010-03-20 20:31:39 ----D---- C:\Windows\system32\hr-HR
2010-03-20 20:31:39 ----D---- C:\Windows\system32\et-EE
2010-03-20 20:31:39 ----D---- C:\Windows\system32\en-US
2010-03-20 20:31:39 ----D---- C:\Windows\system32\el-GR
2010-03-20 20:31:39 ----D---- C:\Windows\system32\de-DE
2010-03-20 20:31:39 ----D---- C:\Windows\system32\da-DK
2010-03-20 20:31:39 ----D---- C:\Windows\IME
2010-03-20 20:31:38 ----D---- C:\Windows\system32\oobe
2010-03-20 20:31:38 ----D---- C:\Windows\system32\migration
2010-03-20 20:31:38 ----D---- C:\Windows\system32\fr
2010-03-20 20:31:36 ----D---- C:\Windows\system32u-RU
2010-03-20 20:31:36 ----D---- C:\Windows\system32\AdvancedInstallers
2010-03-20 20:31:33 ----D---- C:\Windows\system32\fr-FR
2010-03-20 20:31:29 ----D---- C:\Windows\system32\sv-SE
2010-03-20 20:31:29 ----D---- C:\Windows\system32\setup
2010-03-20 20:31:29 ----D---- C:\Windows\system32\he-IL
2010-03-20 20:31:28 ----D---- C:\Windows\system32\SLUI
2010-03-20 20:31:28 ----D---- C:\Windows\system32\pt-PT
2010-03-20 20:31:28 ----D---- C:\Windows\system32\hu-HU
2010-03-20 20:31:28 ----D---- C:\Windows\system32\fi-FI
2010-03-20 20:31:28 ----D---- C:\Windows\system32\cs-CZ
2010-03-20 20:31:27 ----D---- C:\Windows\system32\zh-CN
2010-03-20 20:31:27 ----D---- C:\Windows\system32\sr-Latn-CS
2010-03-20 20:31:27 ----D---- C:\Windows\system32\manifeststore
2010-03-20 20:31:26 ----D---- C:\Windows\system32\zh-TW
2010-03-20 20:31:26 ----D---- C:\Windows\system32\uk-UA
2010-03-20 20:31:26 ----D---- C:\Windows\system32\sl-SI
2010-03-20 20:31:26 ----D---- C:\Windows\system32o-RO
2010-03-20 20:31:26 ----D---- C:\Windows\system32\pl-PL
2010-03-20 20:31:26 ----D---- C:\Windows\system32\ja-JP
2010-03-20 20:31:26 ----D---- C:\Windows\system32\es-ES
2010-03-20 20:31:26 ----D---- C:\Windows\system32\bg-BG
2010-03-20 20:31:25 ----D---- C:\Windows\system32	h-TH
2010-03-20 20:31:24 ----D---- C:\Windows\system32	r-TR
2010-03-20 20:31:23 ----D---- C:\Windows\system32\wbem
2010-03-20 20:31:23 ----D---- C:\Windows\system32
l-NL
2010-03-20 20:31:23 ----D---- C:\Windows\system32
b-NO
2010-03-20 20:31:22 ----D---- C:\Windows\system32\lt-LT
2010-03-20 20:31:22 ----D---- C:\Windows\system32\ar-SA
2010-03-20 20:31:21 ----D---- C:\Windows\system32\pt-BR
2010-03-20 20:31:21 ----D---- C:\Windows\system32\migwiz
2010-03-20 20:30:54 ----RSD---- C:\Windows\Fonts
2010-03-20 20:30:54 ----D---- C:\Windows\AppPatch
2010-03-20 20:30:46 ----D---- C:\Windows\system32\Boot
2010-03-20 20:28:51 ----D---- C:\Windows\system32\RTCOM
2010-03-20 19:43:26 ----D---- C:\Users\Monia\AppData\Roaming\Azureus
2010-03-20 12:39:58 ----D---- C:\Program Files\Vuze
2010-03-16 22:58:49 ----D---- C:\Program Files\Full Tilt Poker
2010-03-15 21:25:47 ----D---- C:\Program Files\Lx_cats
2010-03-11 23:43:48 ----D---- C:\Windows\system32\Tasks
2010-03-02 06:30:12 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100211.001\BHDrvx86.sys [2010-02-11 536112]
R1 ccHP;Symantec Hash Provider; C:\Windows\system32\drivers\NIS\1105000.07F\ccHPx86.sys [2009-12-09 501888]
R1 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2006-11-02 20112]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2009-08-26 371248]
R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20100312.001\IDSvix86.sys [2009-10-28 343088]
R1 SRTSP;Symantec Real Time Storage Protection; C:\Windows\System32\Drivers\NIS\1105000.07F\SRTSP.SYS [2009-12-03 325168]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\Windows\system32\drivers\NIS\1105000.07F\SRTSPX.SYS [2009-12-03 43696]
R1 SymIRON;Symantec Iron Driver; C:\Windows\System32\Drivers\NIS\1105000.07F\Ironx86.SYS [2009-11-26 116272]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver; C:\Windows\System32\Drivers\NIS\1105000.07F\SYMTDIV.SYS [2009-11-22 340016]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2007-12-05 41456]
R2 Aspi32;Aspi32; C:\Windows\system32\drivers\Aspi32.sys [1999-09-10 25244]
R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERSimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERSimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERSixdptsk.sys [2007-03-21 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-01-30 8704]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-14 154624]
R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-02 21264]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 32256]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-08-26 102448]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-04-26 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-04-26 208384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-07-10 1792792]
R3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
R3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100320.022\NAVENG.SYS [2010-02-04 84912]
R3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100320.022\NAVEX15.SYS [2010-02-04 1324720]
R3 NETw4v32;Pilote de carte Intel(R) Wireless WiFi Link pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-12-29 2252800]
R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-12-25 6144]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS
vlddmkm.sys [2007-10-10 7629504]
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial.sys [2009-01-09 27136]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2008-01-19 8192]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-08-02 1749376]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2010-01-04 124976]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-04-26 660480]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 61883;Pilote d'unité 61883; C:\Windows\system32\DRIVERS\61883.sys [2008-01-19 45696]
S3 Avc;Périphérique AVC; C:\Windows\system32\DRIVERS\avc.sys [2008-01-19 40448]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-22 180736]
S3 drmkaud;Filtre de décodeur DRM (Noyau Microsoft); C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Pilote de fonction UAA 1.1 Microsoft pour le service High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 MSDV;Microsoft DV Camera and VCR; C:\Windows\system32\DRIVERS\msdv.sys [2008-01-19 52608]
S3 MSKSSRV;Proxy de service de répartition Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Proxy d'horloge de répartition Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Proxy de gestion de qualité de répartition Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETw3v32;Pilote de carte Intel(R) PRO/Wireless 3945ABG pour Windows Vista 32 bits; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
S3 RimUsb;Téléphone intelligent BlackBerry ; C:\Windows\System32\Drivers\RimUsb.sys [2008-05-20 22784]
S3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\NIS\1002000.007\SYMDNS.SYS []
S3 SYMFW;Symantec Network Filter Driver; C:\Windows\System32\Drivers\NIS\1007020.00B\SYMFW.SYS []
S3 SYMNDISV;Symantec Network Filter Driver; C:\Windows\System32\Drivers\NIS\1007020.00B\SYMNDISV.SYS []
S3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\NIS\1002000.007\SYMREDRV.SYS []
S3 usbaudio;Pilote USB audio (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]
S3 usbscan;Pilote de scanneur USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 usbvideo;Périphérique vidéo USB (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ALaunchService;ALaunch Service; C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]
R2 eDataSecurity Service;eDSService.exe; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-04-25 457512]
R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-10-01 24576]
R2 eNet Service;eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-08-28 131072]
R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-09-10 57344]
R2 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-12-10 24576]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-07-12 354840]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 lxct_device;lxct_device; C:\Windows\system32\lxctcoms.exe [2007-03-19 537520]
R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 107008]
R2 NIS;Norton Internet Security; C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe [2009-12-09 126392]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-01-23 266343]
R2 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-10-30 167936]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-01-30 386560]
S2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe []
S2 Roxio Upnp Server 9;Roxio Upnp Server 9; C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe [2007-12-06 362992]
S2 RoxLiveShare9;LiveShare P2P Server 9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe [2009-04-11 313840]
S2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2009-04-11 170480]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Roxio UPnP Renderer 9;Roxio UPnP Renderer 9; C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe [2007-12-06 88560]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2009-04-11 1108464]

-----------------EOF-----------------

moment de grace · Answer

ok

deux infections encore...

1)

infection par support usb

Téléchargez USBFIX de El Desaparecido, C_xx

http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
ou
https://www.ionos.fr/?affiliate_id=77097

/!\ Utilisateur de vista et windows 7 :
ne pas oublier de désactiver Le contrôle des comptes utilisateurs 
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac 

/!\ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir 

* Double clic sur le raccourci UsbFix présent sur le bureau . 

* Choisir l'option2 suppression
(d'autres options disponibles, voir le tutoriel). 
* Laissez travailler l'outil.
Le menu démarrer et les icônes vont disparaître.. c'est normal. 

Si un message te demande de redémarrer l'ordinateur fais le ... 

? Au redémarrage, le fix se relance... laisses l'opération s'effectuer. 

? Le bloc note s'ouvre avec un rapport, envoies le dans la prochaine réponse

 
* Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt ) 

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller ) 

* Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 


* Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html


UsbFix peut te demander d'uploader un dossier compressé à cette adresse : https://www.ionos.fr/?affiliate_id=77097 

 Il est enregistré sur ton bureau. 

Merci de l'envoyer à l'adresse indiquée afin d'aider l'auteur de UsbFix dans ses recherches. 


..........................

2)

Télécharge ZHPDiag ( de? Nicolas coolman ). 
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html 

 Double clique sur le fichier d'installation, puis installe le avec les? paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )
 
Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin ( vista ) 

Clique sur la loupe? en haut à gauche, puis laisse l'outil scanner. 

Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau. 

Rend toi sur Cjoint :? http://www.cijoint.fr/ 

Clique sur "Parcourir " dans la partie " Joindre un fichier[...] " 

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau 

Clique ensuite sur "Créer le lien cjoint " et copie/colle le dans ton prochain message

Moni@ · Answer

rapport usbfix 


############################## | UsbFix V6.100 | 

User : Monia (Administrateurs) # PC-DE-MONIA 
Update on 18/03/2010 by El Desaparecido , C_XX & Chimay8 
Start at: 10:17:37 | 21/03/2010 
Website : http://pagesperso-orange.fr/NosTools/index.html 
Contact : FindyKill.Contact@gmail.com 

Intel(R) Core(TM)2 Duo CPU     T8100  @ 2.10GHz 
Microsoft® Windows Vista(TM) Édition Familiale Premium  (6.0.6002 32-bit) # Service Pack 2 
Internet Explorer 8.0.6001.18882 
Windows Firewall Status : Disabled 

C:\ -> Disque fixe local # 111,19 Go (29,57 Go free) [ACER] # NTFS 
D:\ -> Disque fixe local # 110,95 Go (33,66 Go free) [DATA] # NTFS 
E:\ -> Disque CD-ROM 
F:\ -> Disque fixe local # 372,51 Go (329,73 Go free) [CINEBOX400] # FAT32 

################## | Elements infectieux | 

Supprimé ! C:\$Recycle.Bin\S-1-5-21-1457282322-4121282045-452760430-1000  
Supprimé ! D:\$Recycle.Bin\S-1-5-21-1457282322-4121282045-452760430-1000  
F:\autorun.inf -> fichier appelé : "F:\RECYCLED\INFO.exe" ( Absent ! )   
F:\autorun.inf -> fichier appelé : "F:\RECYCLED\INFO.exe" ( Absent ! )   
Supprimé ! F:\autorun.inf  

################## | Registre | 

Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoFolderOptions"   

################## | Mountpoints2 | 

Supprimé ! HKCU\...\Explorer\MountPoints2\F\Shell\AutoRun\Command   
Supprimé ! HKCU\...\Explorer\MountPoints2\G\Shell\AutoRun\Command   
Supprimé ! HKCU\...\Explorer\MountPoints2\H\Shell\AutoRun\Command   
Supprimé ! HKCU\...\Explorer\MountPoints2\{329001b6-28c1-11dd-834e-db09700afe71}\Shell\AutoRun\Command   
Supprimé ! HKCU\...\Explorer\MountPoints2\{cb323154-5810-11dd-a559-001b38cfe883}\Shell\AutoRun\Command   

################## | Vaccination | 

# C:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).  
# D:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).  
# F:\autorun.inf -> Dossier créé par UsbFix (El Desaparecido).  

################## | Upload |  

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_PC-de-Monia.zip : https://www.ionos.fr/?affiliate_id=77097  
Merci pour votre contribution .   

################## | ! Fin du rapport # UsbFix V6.100 ! |

moment de grace · Answer

vu

==> ZHPDiag

Moni@ · Answer

http://www.cijoint.fr/cjlink.php?file=cj201003/cijssgD9Pg.txt

moment de grace · Answer

ok

ne réinstalles pas fr codec ni my web seach


Relance ZHPDiag ( Clic droit " Executer en tant qu'administrateur " sous vista ) , fais un scan puis cette fois-ci cliques sur l'icone en forme d'écusson vert " ZHPFix ". 

ZHPFix se lancera, clique maintenant sur le " H " bleu ( coller les lignes helper ) puis copie/colle ces lignes 

C:\Program Files\Fr Codec\FFDShow\svcodecs.exe 
O4 - HKCU\..\Run: [codecs] . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Fr Codec\FFDShow\svcodecs.exe 
O42 - Logiciel: Fast Browser Search (My Web Tattoo) - (.Make The Web Better, LLC.) 



Clique sur " Ok " , puis " Tous " et enfin " Nettoyer ". 

Copie/Colle le rapport à l'écran dans ton prochain message

Moni@ · Answer

fait 


ZHPFix v1.12.3078  by Nicolas Coolman - Rapport de suppression du 21/03/2010 15:07:24
Fichier d'export Registre : C:\ZHPExportRegistry-21-03-2010-15-07-27.txt
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html


Processus mémoire :
C:\Program Files\Fr Codec\FFDShow\svcodecs.exe  => Fichier supprimé au reboot

Module mémoire :
(Néant)

Clé du Registre :
(Néant)

Valeur du Registre :
O4 - HKCU\..\Run: [codecs] . (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Fr Codec\FFDShow\svcodecs.exe  => Valeur supprimée avec succès

Elément de données du Registre :
(Néant)

Dossier :
(Néant)

Fichier :
c:\program files\fr codec\ffdshow\svcodecs.exe  => Fichier supprimé au reboot

Logiciel :
O42 - Logiciel: Fast Browser Search (My Web Tattoo) - (.Make The Web Better, LLC.)  => Logiciel supprimé avec succès

Script Registre :
(Néant)

Autre :
(Néant)


Récapitulatif :
Processus mémoire : 1
Module mémoire : 0
Clé du Registre : 0
Valeur du Registre : 1
Elément de données du Registre : 0
Dossier : 0
Fichier : 1
Logiciel : 1
Autre : 0


End of the scan

moment de grace · Answer

ok

apres ce dernier, ca devrait être bon

 Téléchargez MalwareByte's Anti-Malware (que tu pourras garder)

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
 
. Enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation. 
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen complet (examen assez long)
. Cliques sur Rechercher
. Le scan démarre. 
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés. 
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur  Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine. 
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse. 
. Rends toi dans l'onglet rapport/log 
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous 
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller 


Si tu as besoin d'aide regarde ces tutoriels : 
 Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
 http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

moment de grace · Answer

ok

j'attends de tes nouvelles...

@+

Scan SEARCHSETTINS via Toolbar S&D, Merci!!

16 réponses

Discussions similaires