TROJAN TENACES Résolu

Question

Bonjour,

Avant tout ce post est une 1ere pour moi... qui manque de compétences en informatique !

Mon PC semble infecté par des virus que je n'arrive pas à enlever avec Norton 2002 ou Ad-aware :
A chaque connexions IE un message apparait m'indiquant un virus dans C:windows\system32\cisvvc.exe ou rdsndin.exe

J'ai aussi une fenetre qui s'affiche régulièrement au centre de l'écran " Windows Security Center"...

Enfin, apparait en bas à droite une autre fenetre "Your computer might be at risk"...

J'avoue que je suis perdu et qu'un scan en mode sans echec ne sert à rien.

P.S. : après chaque utilisation, Ad Aware detecte des virus que je supprime, mais qui ré-apparaisse la fois suivante.

J'utilise Windows XP edition familiale SP1 (le SP2 me plante le Wifi ?!) avec Norton 2002 et connexion freebox.

Par avance merci pour votre aide, un formatage n'est pas super envisageable pour moi

Merci

Afficher la suite

Utilisateur anonyme · Answer

salut

telecharge hijackthis:
http://www.merijn.org/files/hijackthis.zip
Dezippe le dans un dossier prévu a cet effet.
Par exemple C:\hijack
et surtout pas dans un dossier temporaire (temp)
lance le puis:
clic sur "do a system scan and save logfile" et pas autre chose
Le bloc note va s'ouvrir, copie tout le contenu et colle le ici a la suite de ton message.
Si tu as du mal, regarde ceci:
http://pageperso.aol.fr/balltrap34/demohijack.htm

et telecharge Silentrunners
http://www.silentrunners.org/Silent%20Runners.vbs

lance le, (si norton te demande si tu veux autoriser l'execution du script, autorise le) et poste le rapport qu'il va generer

a+

cnb · Answer

Voila le rapport de HijackThis :Logfile of HijackThis v1.99.1Scan saved at 20:56:27, on 23/08/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\alg.exec:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\wdfmgr.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\windows\system\hpsysdrv.exeC:\HP\KBD\KBD.EXEC:\WINDOWS\system32\dla	fswctrl.exeC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\ATI Technologies\Panneau de contrôle ATI\atiptaxx.exeC:\Program Files\Softwin\BitDefender8\bdoesrv.exeD:\Program files\System\mnyexpr.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeC:\Program Files\Sony Handheld\HOTSYNC.EXEC:\Program Files\Sony Handheld\USBSwt.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeD:\Nico\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/O1 - Hosts: localhost 127.0.0.1O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] atiptaxx.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MoneyAgent] "D:\Program files\System\mnyexpr.exe"O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe"O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXEO4 - Startup: PowerReg Scheduler.exeO4 - Startup: SonyPDA USB Switcher.lnk = C:\Program Files\Sony Handheld\USBSwt.exeO4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112646766326O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photoways.com/clients/ImageUploader3.cabO16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CCS\Services\Tcpip\..\{D101339D-4EC9-4454-BAEA-55AEE95630E1}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CCS\Services\Tcpip\..\{DB2F4DF2-C383-414D-BF85-D9329DF5A3FA}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CCS\Services\Tcpip\..\{EB0BD396-91DC-422B-B3D2-B4BE32C00727}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CS1\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CS2\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exeO23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeje telecharge pdt ce temps l'autre programme

cnb · Answer

Voici le 2eme rapport :

"Silent Runners.vbs", revision 40, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"MoneyAgent" = ""D:\Program files\System\mnyexpr.exe"" [MS]
"H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"" [MS]
"WareOut" = ""C:\Program Files\WareOut\WareOut.exe"" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]
"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]
"StorageGuard" = ""C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r" ["VERITAS Software, Inc."]
"dla" = "C:\WINDOWS\system32\dla\tfswctrl.exe" ["VERITAS Software, Inc."]
"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]
"NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"]
"NAV Agent" = "c:\PROGRA~1\NORTON~1\navapw32.exe" ["Symantec Corporation"]
"ATIModeChange" = "Ati2mdxx.exe" ["ATI Technologies, Inc."]
"ATIPTA" = "atiptaxx.exe" [file not found]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"Microsoft Works Update Detection" = "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [file not found]
"hclean32.exe" = "C:\WINDOWS\System32\hclean32.exe" [null data]
"BDOESRV" = "C:\Program Files\Softwin\BitDefender8\bdoesrv.exe" ["SOFTWIN SRL"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["VERITAS Software, Inc."]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Explorateur de Bureau"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{596AB062-B4D2-4215-9F74-E9109B0A8153}" = "Previous Versions Property Page"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found]
"{9DB7A13C-F208-4981-8353-73CC61AE2783}" = "Previous Versions"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{D653647D-D607-4DF6-A5B8-48D2BA195F7B}" = "BitDefender Antivirus v8"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
INFECTION WARNING! "System" = "csoqe.exe" [null data]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\Web\Wallpaper\HPi1-1024.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\PORSCH~1.SCR" [file not found]

Startup items in "Propriétaire" & "All Users" startup folders:
--------------------------------------------------------------

C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage
"HotSync Manager" -> shortcut to: "C:\Program Files\Sony Handheld\HOTSYNC.EXE" ["Palm, Inc."]
INFECTION WARNING! "PowerReg Scheduler.exe" [empty string]
"SonyPDA USB Switcher" -> shortcut to: "C:\Program Files\Sony Handheld\USBSwt.exe" ["Sony Corporation"]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]
"Wireless Configuration Utility" -> shortcut to: "C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exe" [empty string]

Enabled Scheduled Tasks:
------------------------

"Norton AntiVirus - Analyser mon ordinateur" -> launches: "c:\PROGRA~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"]
"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]
"XoftSpy" -> launches: "C:\Program Files\XoftSpy\XoftSpy.exe -t" [file not found]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

Missing lines (compared with English-language version):
[Strings]: 2 lines

HOSTS file
----------

C:\WINDOWS\System32\drivers\etc\HOSTS

maps: 1 domain name to an IP address,
1 of the IP addresses is *not* localhost!

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

BitDefender Communicator, XCOMM, "C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe /service" ["Softwin"]
Service Norton AntiVirus Auto-Protect, navapsvc, "c:\Program Files\Norton AntiVirus\navapsvc.exe" ["Symantec Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "Yes" at the first message box.
---------- (total run time: 85 seconds, including 2 seconds for message boxes)

y vois tu + clair ? merci

Utilisateur anonyme · Answer

ok, laisse moi quelque minutes le temps de verifier tout ca, si tu peux ne redemarre pas ton pc, avant ma reponse+

cnb · Answer

merci, pas de problème je laisse tout comme ca.
prends ton temps une urgence m'appelle (femme enceinte).
dès que je suis dispo je reprend le poste

toutes mes excuses pour cette interruption!

a tout à l'heure

Utilisateur anonyme · Answer

salutTelecharge: Pocket Killbox icihttp://www.downloads.subratam.org/KillBox.exel'aide détaillé de la manip est téléchargeable ici:http://get.yourfile.net/qn53063.zipou en video ici:http://pageperso.aol.fr/balltrap34/killbox.htm Imprime, ou fais un copier coller du post et enregistre dans le bloc note pour ne rien oublierDeconnecte toi d'internet c'est important Vide le cache de tous tes navigateurs et supprime les cookies:Pour Internet Explorer:* Panneau de configuration >> Options internet >> Onglet "Général"- Clic sur [supprimer les cookies]- Clic sur [Supprimer les fichiers] et coche la case "Supprimer tout le contenu hors connexion"Valide avec okPour Firefox:menu 'Outils' > Optionsicône 'Vie privée' rubrique Cache, appuyer sur le bouton "Vider le cache"rubrique Cookies appuyer sur le bouton "Effacer"valide okPour MozillaEdition > Préférences > Avancé > Cacheclic sur "Vider le cache"et pour les cookies:Outils > Gestionnaire de cookies > Gérer les cookies stockésclic sur "Supprimer les cookies"valider ok-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ Lance hijackthis et clic sur [do a system scan only]cocher la case au début des lignes suivantes:O1 - Hosts: localhost 127.0.0.1O4 - HKCU\..\Run: [WareOut] "C:\Program Files\WareOut\WareOut.exe" valider en cliquant sur [fix checked]-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ouvre le bloc note et fais un copier coller de ce qui est en gras ci-dessous:REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"=- "System"="" [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionuins] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WareOut] [-HKEY_LOCAL_MACHINE\SOFTWARE\WareOut] [-HKEY_CURRENT_USER\Software\WareOut] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoBandCustomize"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion] "Disabled"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hclean32.exe"=- Puis enregistrer sous et dans: Nom du fichier, met fix.reg Type de fichier: selectionne "tous les fichiers" clic sur enregistrer ensuite double clic sur fix.reg et accepte de fusionner-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- Double-clic sur KillBox.exe (sert toi de l'aide que tu as telechargé si tu as du mal avec cette manip)- ouvre le bloc notes et copie la liste en gras ci-dessous- Selectionne "Delete on Reboot"- reviens sur le bloc-notes et surligne toute la liste, puis clic droit dessus et clic sur copier- reviens sur killbox, et dans le menu du haut clic sur File, puis sur paste from clipboard- clic sur le rond rouge- une fenetre va apparaitre pour confirmation clic sur OUI- une seconde fenetre te demande si tu veux redemarrer clic sur OUIliste:C:\WINDOWS\SYSTEM32
tfsnlpa.exe C:\WINDOWS\System32\CISVVC.EXEC:\WINDOWS\SYSTEM32\CSVMC.EXE C:\WINDOWS\SYSTEM32dsndin.exe C:\WINDOWS\SYSTEM32\gpsresl32.exeC:\WINDOWS\SYSTEM32\LOADCTR.EXEC:\WINDOWS\SYSTEM32\loadctr32.exe  C:\WINDOWS\SYSTEM32\DRV2CLTR.DLLC:\WINDOWS\SYSTEM32\csoqe.exeC:\WINDOWS\system32\gpsresl32.exe C:\WINDOWS\system32\hclean32.exeC:\WINDOWS\SYSTEM32\GPSRESL.EXEle pc devrait redemarrer, si tu as un message de killbox à ce moment là et que le pc ne redemarre pas tout seul, redemarre le manuellement.une fois redemarré, fais ceci:demarrer > connection > clic droit sur ta connection > propriétésgestion de reseau assure toi que protocole internet tcp/ip est en surbrillance (attention, ne décoche pas la case)> clic sur propriétés > selectionne "obtenir les adresses des serveurs automatiquement"valide avec okreposte un hijackthis + un silentrunnersa+

cnb · Answer

Encore désolé (une fausse alerte !) :Voila après 3 essais j'ai réalisé la procédure et voici le rapport de Hijackthis :Logfile of HijackThis v1.99.1Scan saved at 22:39:27, on 23/08/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exec:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Softwin\BitDefender8\vsserv.exeC:\windows\system\hpsysdrv.exeC:\HP\KBD\KBD.EXEC:\Program Files\VERITAS Software\Update Manager\sgtray.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\ATI Technologies\Panneau de contrôle ATI\atiptaxx.exeC:\Program Files\Softwin\BitDefender8\bdoesrv.exeD:\Program files\System\mnyexpr.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeC:\Program Files\Sony Handheld\HOTSYNC.EXEC:\Program Files\Sony Handheld\USBSwt.exeC:\WINDOWS\System32\wuauclt.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeD:\Nico\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/O1 - Hosts: localhost 127.0.0.1O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] atiptaxx.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MoneyAgent] "D:\Program files\System\mnyexpr.exe"O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXEO4 - Startup: PowerReg Scheduler.exeO4 - Startup: SonyPDA USB Switcher.lnk = C:\Program Files\Sony Handheld\USBSwt.exeO4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112646766326O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photoways.com/clients/ImageUploader3.cabO16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CCS\Services\Tcpip\..\{DB2F4DF2-C383-414D-BF85-D9329DF5A3FA}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CCS\Services\Tcpip\..\{EB0BD396-91DC-422B-B3D2-B4BE32C00727}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CS1\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6O17 - HKLM\System\CS2\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exeO23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeje te poste dans la foulée le 2ndmerci

cnb · Answer

et voici silentrunners :"Silent Runners.vbs", revision 40, http://www.silentrunners.org/Operating System: Windows XPOutput limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]"MoneyAgent" = ""D:\Program files\System\mnyexpr.exe"" [MS]"H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"" [MS]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]"StorageGuard" = ""C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r" ["VERITAS Software, Inc."]"dla" = "C:\WINDOWS\system32\dla	fswctrl.exe" ["VERITAS Software, Inc."]"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]"NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"]"NAV Agent" = "c:\PROGRA~1\NORTON~1
avapw32.exe" ["Symantec Corporation"]"ATIModeChange" = "Ati2mdxx.exe" ["ATI Technologies, Inc."]"ATIPTA" = "atiptaxx.exe" [file not found]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"Microsoft Works Update Detection" = "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [file not found]"BDOESRV" = "C:\Program Files\Softwin\BitDefender8\bdoesrv.exe" ["SOFTWIN SRL"]en esperant que cela t'aide...

cnb · Answer

stop, voici le bon rapport (je n'ai pas attendu assez lgtps et le précédent post doit etre incomplet
Quand on est nul... on est nul !

voici :

"Silent Runners.vbs", revision 40, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"MoneyAgent" = ""D:\Program files\System\mnyexpr.exe"" [MS]
"H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]
"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]
"StorageGuard" = ""C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r" ["VERITAS Software, Inc."]
"dla" = "C:\WINDOWS\system32\dla\tfswctrl.exe" ["VERITAS Software, Inc."]
"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]
"NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"]
"NAV Agent" = "c:\PROGRA~1\NORTON~1\navapw32.exe" ["Symantec Corporation"]
"ATIModeChange" = "Ati2mdxx.exe" ["ATI Technologies, Inc."]
"ATIPTA" = "atiptaxx.exe" [file not found]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"Microsoft Works Update Detection" = "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [file not found]
"BDOESRV" = "C:\Program Files\Softwin\BitDefender8\bdoesrv.exe" ["SOFTWIN SRL"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["VERITAS Software, Inc."]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Explorateur de Bureau"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{596AB062-B4D2-4215-9F74-E9109B0A8153}" = "Previous Versions Property Page"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found]
"{9DB7A13C-F208-4981-8353-73CC61AE2783}" = "Previous Versions"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{D653647D-D607-4DF6-A5B8-48D2BA195F7B}" = "BitDefender Antivirus v8"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
INFECTION WARNING! "AppInit_DLLs" = "sockspy.dll" [null data]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\Web\Wallpaper\HPi1-1024.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\PORSCH~1.SCR" [file not found]

Startup items in "Propriétaire" & "All Users" startup folders:
--------------------------------------------------------------

C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage
"HotSync Manager" -> shortcut to: "C:\Program Files\Sony Handheld\HOTSYNC.EXE" ["Palm, Inc."]
INFECTION WARNING! "PowerReg Scheduler.exe" [empty string]
"SonyPDA USB Switcher" -> shortcut to: "C:\Program Files\Sony Handheld\USBSwt.exe" ["Sony Corporation"]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]
"Wireless Configuration Utility" -> shortcut to: "C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exe" [empty string]

Enabled Scheduled Tasks:
------------------------

"Norton AntiVirus - Analyser mon ordinateur" -> launches: "c:\PROGRA~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"]
"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]
"XoftSpy" -> launches: "C:\Program Files\XoftSpy\XoftSpy.exe -t" [file not found]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"

Missing lines (compared with English-language version):
[Strings]: 2 lines

HOSTS file
----------

C:\WINDOWS\System32\drivers\etc\HOSTS

maps: 1 domain name to an IP address,
1 of the IP addresses is *not* localhost!

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

BitDefender Communicator, XCOMM, "C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe /service" ["Softwin"]
BitDefender Virus Shield, VSSERV, "C:\Program Files\Softwin\BitDefender8\vsserv.exe /service" ["SOFTWIN S.R.L."]
Service Norton AntiVirus Auto-Protect, navapsvc, "c:\Program Files\Norton AntiVirus\navapsvc.exe" ["Symantec Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "Yes" at the first message box.
---------- (total run time: 105 seconds, including 4 seconds for message boxes)

Utilisateur anonyme · Answer

il reste celles ci à supprimer avec hijackthis :
(pour les 017 il faut etre connecté, sinon elles n'apparaissent pas)

O1 - Hosts: localhost 127.0.0.1

O17 - HKLM\System\CCS\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB2F4DF2-C383-414D-BF85-D9329DF5A3FA}: NameServer = 69.50.176.157,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB0BD396-91DC-422B-B3D2-B4BE32C00727}: NameServer = 69.50.176.157,85.255.112.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{41C99A1D-9E68-456C-ABB8-AA75BF304688}: NameServer = 69.50.176.157,85.255.112.6

une fois fais, redemarre ton pc et reposte un hijack et dis moi ou en sont tes soucis

a+

cnb · Answer

Après redemarrage du PC voici le hijack :Logfile of HijackThis v1.99.1Scan saved at 23:06:30, on 23/08/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exec:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Softwin\BitDefender8\vsserv.exeC:\windows\system\hpsysdrv.exeC:\HP\KBD\KBD.EXEC:\Program Files\VERITAS Software\Update Manager\sgtray.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\ATI Technologies\Panneau de contrôle ATI\atiptaxx.exeC:\Program Files\Softwin\BitDefender8\bdoesrv.exeD:\Program files\System\mnyexpr.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeC:\Program Files\Sony Handheld\HOTSYNC.EXEC:\Program Files\Sony Handheld\USBSwt.exeC:\WINDOWS\System32\wuauclt.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeD:\Nico\Depannage PC forum\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] atiptaxx.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MoneyAgent] "D:\Program files\System\mnyexpr.exe"O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXEO4 - Startup: PowerReg Scheduler.exeO4 - Startup: SonyPDA USB Switcher.lnk = C:\Program Files\Sony Handheld\USBSwt.exeO4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112646766326O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photoways.com/clients/ImageUploader3.cabO16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cabO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exeO23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeil semble que je n'ai plus ces messages de virusou trojan qui apparaissent.je vais rester connecté encore un peu pour voir et te tiens au couranten tout cas merci pour ta précieuse aide ! a priori tu viens de me sauver des heures d'enervement sur le WE !1000 mercia+

Utilisateur anonyme · Answer

reposte un log fait en etant connecté pour voir si les 017 ont changées

cnb · Answer

voici le log avec une connection :Logfile of HijackThis v1.99.1Scan saved at 23:13:01, on 23/08/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exec:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Softwin\BitDefender8\vsserv.exeC:\windows\system\hpsysdrv.exeC:\HP\KBD\KBD.EXEC:\Program Files\VERITAS Software\Update Manager\sgtray.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\ATI Technologies\Panneau de contrôle ATI\atiptaxx.exeC:\Program Files\Softwin\BitDefender8\bdoesrv.exeD:\Program files\System\mnyexpr.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeC:\Program Files\Sony Handheld\HOTSYNC.EXEC:\Program Files\Sony Handheld\USBSwt.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeD:\Nico\Depannage PC forum\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] atiptaxx.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MoneyAgent] "D:\Program files\System\mnyexpr.exe"O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXEO4 - Startup: PowerReg Scheduler.exeO4 - Startup: SonyPDA USB Switcher.lnk = C:\Program Files\Sony Handheld\USBSwt.exeO4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112646766326O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photoways.com/clients/ImageUploader3.cabO16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cabO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exeO23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exetu vois des choses à enlever ?

Utilisateur anonyme · Answer

ben normallement en étant connecté, il devrait y avoir une ligne 017 qui apparait dans hijackthis, sinon rien de suspect.

tu peux faire un scan de verif ici, quand tu auras un peu de temps devant toi:
http://www.bitdefender.fr

a++

cnb · Answer

un super grand merci pour tes competences.
juste 2 questions : faut il systematiquement supp les lignes 017 ?
d'ou venaient ces m..... ? (comment prévenir ?)

sinon je vais de ce pas faire un scan en ligne

Merci et re-merci !!!

A+

Utilisateur anonyme · Answer

non surtout pas, elle corresponde à ta connection et ton adresse ip
par exemple ton adresse ip avait était detournée au profit de celle là: 69.50.176.157,85.255.112.6
ce qui correspond apres verif à Atrivotechnologie, alias coolwebsearch, qui est responsable actuellement des pires spywares et trojans.
http://www.dnsstuff.com/tools/whois.ch?ip=69.50.176.157

poste le resultat du scan et on dicutera du reste demain
j'arrete pour ce soir demain lever tres tot :-(

à demain

cnb · Answer

pas de problème, d'ailleurs vu le tps que me demande le scan, je le stop et file aussi au lit.
je le relancerai demain soir après le boulot et te posterai le resultat.

Merci pour ta patience et ton savoir

A+

stephane · Answer

bonjour cnb et moe.

je m'excuse d'intervenir comme ça dans votre discussion, mais après de nombreuses recherches, j'ai l'impression que c'est ici que je trouverais la solution à mon problème.
je ne voulais pas ouvrir un nouveau topic, vu que cela me semble assez similaire.
Donc, le problème est un trojandownloader, que norton 2004 détecte dans winsocks5.exe, et que adaware détecte dans les H-KEYS comme un coolwebsearch, au nombre de 6, à chaque fois.
Adaware dit qu'il supprime le fichier ( ce qui n'est pas le cas puisqu'à chaque nouveau scan il redétecte les mêmes virus ) et Norton dit qu'il n'y arrive pas.

Donc ma question c'est dois-je suivre la même procédure que celle que tu indiques pour cnb? à savoir dwld de hijackthis et silentrunners.
et surtout à tu le temps et l'envie de te pencher encore sur ce problème ( qui peut être réglé après celui de cnb évidemment ) sinon, peux tu m'indiquer une autre personne du forum ou un autre forum où on saura m'aider aussi bien qu'ici?

dans tous les cas, merci d'avance!

ps: le pc infecté n'est pas celui à partir duquel je poste le msg. le pc infecté n'arrive plus à se connecter à internet, il n'y a que msn qui marche. et norton fait une boucle infernale disant qu'il a repéré le virus puis qu'il n'a pas réussi à s'en débarasser, je clique sur "ok", et il recommence...indéfiniment.
ps2: le pc infecté est en réseau avec celui à partir duquel je poste le msg, y a t'il un risque de contamination?

merci

Utilisateur anonyme · Answer

salut stephane

crée ton propre message, ce sera plus clair pour tout le monde.

dans ton nouveau message, poste un rapport hijackthis + un silentrunners et je regarderais volontier de quoi il en retourne

a+

cnb · Answer

Bonsoir moe31,

je reviens vers toi car ce soir, car après un scan complet Norton m'a trouvé 4 virus :
- cisvvc.exe (trojan adclicker)
- hclean32.exe (trojan horse)
- cstob.exe (trojan Dropper)
- mssosxrt.exe (trojan dropper)

Par ailleurs j'ai effectué le scan en ligne bitdefender qui m'a aussi trouvé des "trucs pas terribles". As-tu besoin du rapport qui est super long ? comment t'aider ?

par avance merci pour cette affaire qui devient un peu galère

Utilisateur anonyme · Answer

salutoui poste le pour voir

cnb · Answer

voila en esperant que ce soit pas trop long...BitDefender Online Scanner     Rapport d'analyse généré à: Wed, Aug 24, 2005 - 18:43:22       Voie d'analyse: A:\;C:\;D:\;E:\;F:\;G:\;J:\;           Statistiques Temps 00:30:37 Fichiers 155118 Directoires 3543 Secteurs de boot 6 Archives 1459 Paquets programmes 22931      Résultats Virus identifiés 3 Fichiers infectés 170 Fichiers suspects 1 Avertissements 0 Désinfectés 0 Fichiers effacés 271      Info sur les moteurs Définition virus 202467 Version des moteurs AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29) Analyse des plugins 13 Archive des plugins 39 Unpack des plugins 4 E-mail plugins 6 Système plugins 1      Paramètres d'analyse Première action Désinfecté Seconde Action Supprimé Heuristique Oui Acceptez les avertissements Oui Extensions analysées exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas; Excludez les extensions   Analyse d'emails Oui Analyse des Archives Oui Analyser paquets programmes Oui Analyse des fichiers Oui Analyse de boot Oui        Fichier analysé  Statut C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Troubleshootdifferingbalancesbetweenmoneyandmybank.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnaboutforeigncurrenciesandMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Correctanexchangerate.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/FRN HO2 HTML Link Checker.log Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangethedefaultcurrencyformyMoneyfile.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Changethedefaultcurrencyforanaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DisplayandentertheEurocurrencysymbol.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Convertatransactionfromaforeigncurrency.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Updatecurrencyexchangerates.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnabouttypesofaccountsIcancreateinMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnabouttypesofaccountsIcancreateinMoney.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutbankaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Createacheckingaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutcreditcardaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnwhytotrackacreditcardasanaccountandnotabill.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnthedifferencebetweencreditcardsanddebitcards.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Entercreditcardpayments.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Entercreditcardpayments.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Trackacreditcardthroughacheckingaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnaboutusingAutoBalanceforcreditcardaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnaboutusingAutoBalanceforcreditcardaccounts.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AutoBalancemycreditcardaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AutoBalancemycreditcardaccount.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutloanaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutloanaccounts.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Createaloanaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Createaloanaccount.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Linkaloanaccounttoitsasset.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EnterLoanpayments.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ItemizeaLoanpayment.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RecordExtraloanpayments.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RecordExtraloanpayments.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Balancealoanaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EnterLatefees.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangeLoanaccountinformation.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UpdateaninterestrateonanAdjustableRateMortgage.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/enterloanrefinanceinformation.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Payoffmyloan.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Understandloanreports.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Understandloanreports.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Figureloanaccountsintomynetworth.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Figureloanaccountsintomynetworth.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutassetaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Createanassetaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Createanassetaccount.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Updateanassetorliabilityaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Balanceanassetaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutliabilityaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Createaliabilityaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Balancealiabilityaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutinvestmentaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutinvestmentaccounts.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutcashaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/KeepTrackOfMyReimbursableExpenses.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UseThePayBillsPageForYourBillPayingRoutine.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UseThePayBillsPageForYourBillPayingRoutine.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutTrackingBillsandDeposits.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/seehowpayingbillsaffectsaccountbalance.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutSetupBillsandDeposits.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutSetupBillsandDeposits.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Customizeviewofbillsanddepositslist.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ScheduleaRecurringBillorDeposit.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ScheduleaRecurringBillorDeposit.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CreateTwoRecurringPaymentsforPayrollChecks.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ScheduleOneTimeFuturePayment.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ScheduleOneTimeFuturePayment.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ScheduleRecurringInvestmentPurchase.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ScheduleRecurringInvestmentPurchase.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AddExistingTransactiontoYourScheduledTransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AddExistingTransactiontoYourScheduledTransactions.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnaboutBillCalendar.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/WorkwithTransactionsfromBillCalendar.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Troubleshootsettingupandeditingscheduledtrans.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/PrintListofUpcomingBills.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EditDetailsofScheduledTransaction.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RecordScheduledInvestmentPurchase.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RecordScheduledInvestmentPurchase.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/SkipanUpcomingBillorDeposit.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/PermanentlyDeleteRecurringPayment.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/PermanentlyDeleteRecurringPayment.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnaboutPotentialRecurringTransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Viewscheduledbillsbyproperty.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Automaticallyenterbillsintoyourregisterbeforetheduedate.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Payascheduledbillorrecordascheduleddeposit.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Payascheduledbillorrecordascheduleddeposit.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ViewAccountBalancesWhenPayingBills.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/MakePaymentstoMultipleAccountsatSameCompany.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/MakePaymentstoMultipleAccountsatSameCompany.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnaboutoverduebillsanddepositsinMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Estimatebillamountsbasedonpreviouspayments.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Whatispaymentdate.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutRecentlyPaidBills.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutRecentlyPaidBills.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EditDetailsofRecentlyRecordedScheduledTransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ReviewMyRecentlyPaidBills.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/learnaboutcategorydetails.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AutomaticallyDisplayCategoryLists.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AutomaticallyDisplayCategoryLists.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UseSingleCategoryLists.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RequireaCategoryforeachTransaction.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AddInformationtoaCategoryorSubcategory.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RenameCategoryorSubcategory.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RenameCategoryorSubcategory.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangeaCategoryType.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangeaCategoryType.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CombineCategories.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CombineCategories.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RestoreMoneysStandardCategories.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RestoreMoneysStandardCategories.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteUnusedCategories.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteUnusedCategories.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteaCategoryorSubcategory.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteaCategoryorSubcategory.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/changethecategorygroupassignedtoacategory.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/changethecategorygroupassignedtoacategory.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RenameClassificationorSubClassification.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteaClassificationorSubclassification.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteaClassificationorSubclassification.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CreateaClassorSubclass.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CreateaClassorSubclass.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AddInformationAboutClassesandSubclasses.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EditClassesAndSubClasses.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RenameClassorSubclass.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteClassorSubClass.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteClassorSubClass.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CreateaNewPayee.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CreateaNewPayee.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EditPayeeInformation.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ManagePayeesWithSameNameButDifferentAccountNumbers.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/combinepayees.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/combinepayees.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RenameAPayee.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RenameAPayee.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteaPayee.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteaPayee.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/sortpayeesbynameordate.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UseMoney'sBillsPlacetoManageCashFlow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UseMoney'sBillsPlacetoManageCashFlow.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutcashflowinmoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnhowmoneyforecastscashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutchanginghowmoneyforecastscashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnhowchangingcashflowitemschangesyourmoneyfile.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Selectparticularaccountstoviewincashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Selectparticulardatestoviewincashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangeMyBalanceForecast.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Addanitemtoyourcashflowforecast.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Editaniteminyourcashflowforecast.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Changehowmoneyforecastscashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Changehowmoneyforecastsatrendeditem.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Removeanitemfromyourcashflowforecast.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Specifyaninterestrateforanaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Assignbudgetamountstoaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutdifferencebetweennecessaryanddiscretionarycategories.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Markitemsasnecessaryordiscretionary.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutplayingwhatifwithcashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Tryawhatifscenarioincashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnabouttipstooptimizecashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Viewcashflowoptimizationtips.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnaboutBalanceForecast.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnaboutBalanceForecast.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/PrintBalanceForecast.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Troubleshootcashflow.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutTheInvestingCenter.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Researchinvestmentsonline.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Viewinvestmentperformance.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChooseWhichInvestmentAccountsToSetUp.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChooseWhichInvestmentAccountsToSetUp.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Createaninvestmentaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Addsharestoaninvestmentaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/changeinvestmentaccountdetails.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Removesharesfromaninvestmentaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Removesharesfromaninvestmentaccount.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/learnaboutyourinvestmentaccountsummary.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Fixanegativebalanceinanassociatedcashaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutTheCashTransactionsSectionInYourInvestmentAccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutTheCashTransactionsSectionInYourInvestmentAccount.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CreateACashTransactionsSectionInYourInvestmentAccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Deleteanassociatedcashaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/learnaboutretirementaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/learnaboutretirementaccounts.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/TrackTaxDeferredInvestmentsThatArentTaxDeductible.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/TrackTaxDeferredInvestmentsThatArentTaxDeductible.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CreateARetirementAccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CreateARetirementAccount.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/convertaninvestmentaccounttoaretirementaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/convertaninvestmentaccounttoaretirementaccount.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutBondReports.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutBondReports.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutBonds.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutBonds.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EnterABond.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Enterasavingsbond.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/TrackThePerformanceOfMyBonds.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UpdateThePriceOfMyBonds.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/TroubleshootEnteringBondInformation.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EnterAStockOrMutualFundPurchaseSaleOrOtherActivity.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EnterAStockOrMutualFundPurchaseSaleOrOtherActivity.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EnterATransactionInTheCashTransactionsSectionOfAnInvestmentAccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutPositionTracking.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Modifyaninvestmenttransaction.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangeTheCategoryAssignedToAnInvestmentActivity.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/HaveMoneyAlertMeWhenTheTransferFieldIsLeftBlank.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/TransferAnInvestmentTransactionToADifferentAccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Verifyinvestmentpurchaseprice.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutOnlineTrading.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Setaremindertobuyorsellaninvestmentonacertaindate.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutLots.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutLots.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Trackputsandcalls.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Trackputsandcalls.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutMarginsAndMarginInterest.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutMarginsAndMarginInterest.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ConvertForeignCurrenciesForInvestments.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutThePortfolio.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutTheDifferenceBetweenThePortfolioAndTheInvestmentAccountsAreas.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/HowToCustomizeWhatYouSeeInYourPortfolio.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/HowToCustomizeWhatYouSeeInYourPortfolio.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/learnaboutstocks.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Updateinvestmentholdings.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DownloadMarketPricesUsingOnlineQuotes.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Cleardownloadedquotesforunusedstocks.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Automaticallyclearunuseddownloadeddata.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/activateatickersymbolforonlinedownloads.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Deactivateatickersymbolfromonlinedownloads.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnHowGainAndPercentageGainAreCalculated.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Vieworeditinvestmenttransactionsintheportfolio.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutWatchAccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutWatchAccounts.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AddaninvestmentorindextoInvestmentstoWatch.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RemoveaninvestmentorindexfromInvestmentstoWatch.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ViewAnInvestmentAllocationReport.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/PrintMyPortfolio.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutPortfolioReview.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/WhydidntmystocksplitshowupwhenIdownloadedonlinequotes.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Enterastocksplit.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/FindOutWhyMyStockSplitHasTheWrongNumberOfShares.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteAStockSplit.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DeleteAStockSplit.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Enterashortsell.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Enterashortsell.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutCostBasis.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defclass.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defclass.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defclass.htm=>(JAVASCRIPT 3) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/dummy.xml Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnHowToRecordASpinoff.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/RecordAMerger.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutstockoptiongrants.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutstockoptiongrants.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Enterastockoptiongrant.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangeStockOptionDetails.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ConvertstockoptionsfromearlierversionsofMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ConvertstockoptionsfromearlierversionsofMoney.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Exerciseanstockoptiongrant.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Exerciseanstockoptiongrant.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Deleteastockoptiongrant.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ViewallstockoptionsharesgrantedintheInvestmentPortfolio.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/StockoptionFrequentlyAskedQuestions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/StockoptionFrequentlyAskedQuestions.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/coutglobal.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnabouthandlingReturnofCapitaltransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnabouthandlingReturnofCapitaltransactions.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EnterCapitalGainsDistributions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/EnterCapitalGainsDistributions.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Enterinterestreceiveddividendsorcapitalgainsdistributions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutthedistributionmethodforshares.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ViewCapitalGainsTaxSummary.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutInvestmentReports.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutInvestmentReports.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/troubleshootinvesting.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnthebenefitsofusingOnlineServices.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnthebenefitsofusingOnlineServices.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangeDialUpConnectionSettings.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ChangeDialUpConnectionSettings.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DisableCallWaiting.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DisableCallWaiting.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UseProxyServer.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UseProxyServer.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/GetanInternetServiceProvider.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/GetanInternetServiceProvider.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/WhattoaskyourInternetserviceprovidertogetsetup.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/WhattoaskyourInternetserviceprovidertogetsetup.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/SetUpYourComputertoUsetheInternet.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/SetUpYourComputertoUsetheInternet.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ConfigureMoneyToConnectToTheInternet.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ConfigureMoneyToConnectToTheInternet.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Authorizeonlinepaymentsfrommyaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/entermydataontheweb.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/UpdateOnlineAccountsWhenYouOpenMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/FindoutaboutsecurityinMicrosoftMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutonlinepasswords.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutonlinepasswords.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/SetconnectionoptionsforMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/SetupmultipleconnectionmethodsinInternetExplorer5.0.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/SetupmultipleconnectionmethodsinInternetExplorer5.0.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Troubleshootonlineservicessetup.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Backgroundbankingrequirements.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Setupbackgroundbanking.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Setuponlineservices.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Seewhichaccountsaresetupforonlineservices.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Manageaccountswithdifferentonlinepasswordsatthemsamebank.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CustomizeOnlineServicesInMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ManageAllThePINsIHaveStoredInMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ManageAllThePINsIHaveStoredInMoney.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Cancelonlineservicesthroughmybankswebsite.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CancelOnlineServicesformyaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/CancelOnlineServicesformyaccount.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/FindoutwhysomeaccountsmaynotbelistedbyOnlineSetup.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/FindoutwhysomeaccountsmaynotbelistedbyOnlineSetup.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Keeptrackofmybankorbrokercontactinformation.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Findoutifmybankorbrokersonlineserviceofferingshavechanged.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Findoutifmybankorbrokersonlineserviceofferingshavechanged.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Usemybankswebsiteinsteadofmoneysonlineservices.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Usemybankswebsiteinsteadofmoneysonlineservices.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defARM.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defARM.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defARM.htm=>(JAVASCRIPT 3) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnwhotocallforhelpwhenusingWebBanking.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnwhotocallforhelpwhenusingWebBanking.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutthemoneyshoppingcenter.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutonlinestatements.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnthebenefitsofdownloadingstatements.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnthebenefitsofdownloadingstatements.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defARRCO.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defARRCO.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/defARRCO.htm=>(JAVASCRIPT 3) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DownloadastatementviamybankorbrokersWebsite.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Connectanddownloadstatementsforallmyonlineaccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Connectanddownloadstatementsforallmyonlineaccounts.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnWhatDateRangeToUseWhenDownloadingTransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/DisassociateadownloadedstatementwithaMoneyaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/FindOutWhatHappensToIntelliChargeAccounts.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Troubleshootonlinestatements.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnwhytheAccountRegisteranddownloadedstatementbalancesdiffer.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Matchdownloadedtransactionstothoseinyouraccountregister.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AssociatedownloadedstatementswithaMoneyaccount.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutverifyingdownloadedstatements.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutverifyingdownloadedstatements.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/TellMeAboutAcceptingDownloadedTransfers.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AcceptDownloadedTransactionsInTheAccountRegister.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Acceptalldownloadeddefinitetransactionmatches.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Acceptalldownloadeddefinitetransactionmatches.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AcceptAllUnreadTransactionsInTheAccountRegisterAtOnce.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ViewOnlyUnacceptedTransactionsInTheAccountRegister.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AutomaticallymarkacceptedtransactionsasR.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/AutomaticallymarkacceptedtransactionsasR.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Undoalltransactionmatches.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Changehowmoneynavigatesafteryouacceptatransaction.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutMoneyCentral.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnWhatBoldTextMeansInTheAccountRegister.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnWhatAQuestionMarkMeansInTheAccountRegister.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutBrowsers.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutBrowsers.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutunassignedamountsindownloadedtransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/NavigateWebinMoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hcDropDown.htc Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hcDropDown.htc=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hcGlossary.htc Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hcGlossary.htc=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hcToc.htc Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hcToc.htc=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hhGlossary.xsl Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hhLocConvert.xsl Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hhLocConvert.xsl=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hhOnstart.xsl Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hhPreprocess.xsl Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hhPreprocess.xsl=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hhPreprocess.xsl=>(JAVASCRIPT 2) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/hhPreprocess.xsl=>(JAVASCRIPT 3) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Editanentryforanunassignedamountinadownloadedstatement.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Matchadownloadedtransactiontomultipletransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutMatchingTransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnAboutRenamingPayeesInADownloadedStatement.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Unmatchatransactioninthemanualmatchingdialogbox.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnwhythedateschangeafterirecordadownloadedstatement.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/MatchTransactionsManuallyWhenReadingDownloadedStatements.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Matchvariationsofpayeenames.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Choosewhichwordstoignoreinpayeenamevariations.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Showstandardizedpayeenames.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Troubleshootpayeenamematching.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Learnaboutwarningsfordownloadedtransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/NonReplaceableTransactions.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/ViewMyFinancialinstitutionshomepage.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/learnaboutfavoritesinmoney.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/learnaboutfavoritesinmoney.htm=>(JAVASCRIPT 1) Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/LearnHowMoneyCanUseTheInternetToKeepYourFinancialDataCurrent.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=>/Sendemailtomyfinancialinstitution.htm Nettoyé C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm=&g

Utilisateur anonyme · Answer

il manque une partie du rapport non ?(la fin)il trouve d'autres choses à part:C:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chm ?

cnb · Answer

excuse moi j'avais pas fais gaffe, la fin est pas passée (trop long ?)voici la fin qui contient d'ailleurs les fichiers douteux :C:\Program Files\Norton AntiVirus\Quarantine\01C86A33.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\01C86A33.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\01C86A33.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\07611067.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\07611067.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\07611067.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\08F95843.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\08F95843.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\08F95843.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\0E816263.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\0E816263.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\0E816263.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\148A1442.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\148A1442.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\148A1442.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\14BF02B7.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\14BF02B7.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\14BF02B7.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\15A1345F.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\15A1345F.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\15A1345F.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\1A195354.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\1A195354.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\1A195354.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\1CC2065B.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\1CC2065B.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\1CC2065B.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\201A5040.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\201A5040.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\201A5040.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\20804648.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\20804648.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\20804648.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\2C100247.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\2C100247.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\2C100247.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\326A3C76.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\326A3C76.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\326A3C76.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\36CC71BA.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\36CC71BA.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\36CC71BA.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\37A13E45.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\37A13E45.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\37A13E45.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\3DEC43B6.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\3DEC43B6.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\3DEC43B6.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\3E923106.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\3E923106.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\3E923106.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\43317A44.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\43317A44.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\43317A44.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\450C15B2.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\450C15B2.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\450C15B2.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\4EC13643.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\4EC13643.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\4EC13643.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\512617F0.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\512617F0.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\512617F0.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\563E3AAB.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\563E3AAB.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\563E3AAB.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\573D0AA2.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\573D0AA2.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\573D0AA2.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\5A527241.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\5A527241.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\5A527241.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\5AB86849.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\5AB86849.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\5AB86849.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\5D4F0C81.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\5D4F0C81.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\5D4F0C81.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\5F160111.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\5F160111.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\5F160111.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\6637530D.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\6637530D.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\6637530D.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\66482447.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\66482447.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\66482447.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\69770111.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\69770111.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\69770111.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\6D572508.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\6D572508.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\6D572508.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\71D96046.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\71D96046.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\71D96046.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\74777704.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\74777704.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\74777704.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\75A075A2.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\75A075A2.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\75A075A2.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\783F2609.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\783F2609.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\783F2609.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\78435005.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\78435005.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\78435005.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\78467A02.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\78467A02.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\78467A02.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\784923FE.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\784923FE.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\784923FE.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\784C4DFB.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\784C4DFB.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\784C4DFB.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\785077F7.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\785077F7.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\785077F7.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\785321F3.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\785321F3.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\785321F3.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\78564BF0.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\78564BF0.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\78564BF0.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\785975EC.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\785975EC.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\785975EC.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\785D1FE9.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\785D1FE9.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\785D1FE9.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\786049E5.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\786049E5.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\786049E5.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\786373E1.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\786373E1.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\786373E1.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\78671DDE.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\78671DDE.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\78671DDE.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\786A47DA.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\Program Files\Norton AntiVirus\Quarantine\786A47DA.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\786A47DA.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\786D71D7.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\786D71D7.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\786D71D7.exe=>(Quarantine-1) Supprimé C:\Program Files\Norton AntiVirus\Quarantine\7D691C45.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\Program Files\Norton AntiVirus\Quarantine\7D691C45.exe=>(Quarantine-1) Echec de la désinfection C:\Program Files\Norton AntiVirus\Quarantine\7D691C45.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0011861.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0011861.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0011861.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0012861.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0012861.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0012861.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0012889.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0012889.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0012889.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013889.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013889.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013889.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013897.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013897.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013897.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013930.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013930.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013930.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013939.exe Infecté par: Trojan.Click.526 C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013939.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013939.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013940.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013940.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013940.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013943.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013943.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013943.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013944.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013944.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013944.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013945.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013945.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013945.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013946.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013946.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013946.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013947.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013947.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013947.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013948.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013948.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013948.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013949.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013949.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013949.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013950.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013950.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013950.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013951.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013951.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013951.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013952.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013952.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013952.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013953.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013953.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013953.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013954.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013954.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013954.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013955.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013955.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013955.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013956.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013956.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013956.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013957.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013957.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013957.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013958.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013958.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013958.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013959.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013959.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013959.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013960.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013960.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013960.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013961.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013961.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013961.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013962.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013962.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013962.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013963.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013963.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013963.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013964.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013964.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013964.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013965.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013965.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013965.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013966.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013966.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013966.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013967.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013967.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013967.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013968.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013968.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013968.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013969.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013969.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013969.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013970.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013970.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013970.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013971.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013971.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013971.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013972.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013972.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013972.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013973.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013973.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013973.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013974.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013974.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013974.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013975.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013975.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013975.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013976.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013976.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013976.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013977.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013977.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013977.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013978.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013978.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013978.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013979.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013979.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013979.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013980.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013980.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013980.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013981.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013981.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013981.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013982.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013982.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013982.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013983.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013983.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013983.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013984.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013984.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013984.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013985.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013985.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013985.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013986.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013986.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013986.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013987.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013987.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013987.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013988.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013988.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013988.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013989.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013989.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013989.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013990.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013990.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013990.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013991.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013991.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013991.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013992.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013992.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP13\A0013992.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014005.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014005.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014005.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014054.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014054.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014054.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014082.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014082.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014082.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014088.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014088.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014088.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014089.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014089.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014089.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014090.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014090.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014090.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014091.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014091.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014091.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014092.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014092.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014092.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014093.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014093.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014093.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014094.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014094.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014094.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014095.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014095.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014095.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014096.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014096.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014096.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014097.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014097.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014097.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014098.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014098.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014098.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014099.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014099.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014099.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014100.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014100.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014100.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014101.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014101.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014101.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014102.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014102.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014102.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014103.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014103.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014103.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014104.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014104.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014104.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014105.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014105.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014105.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014106.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014106.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014106.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014107.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014107.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014107.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014108.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014108.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014108.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014109.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014109.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014109.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014110.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014110.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014110.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014111.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014111.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014111.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014112.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014112.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014112.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014113.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014113.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014113.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014114.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014114.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014114.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014115.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014115.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014115.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014116.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014116.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014116.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014117.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014117.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014117.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014118.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014118.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014118.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014119.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014119.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014119.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014120.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014120.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014120.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014121.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014121.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014121.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014122.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014122.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014122.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014123.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014123.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014123.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014124.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014124.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014124.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014125.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014125.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014125.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014126.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014126.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014126.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014127.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014127.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014127.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014128.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014128.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014128.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014129.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014129.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014129.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014130.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014130.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014130.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014131.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014131.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014131.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014132.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014132.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014132.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014133.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014133.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014133.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014134.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014134.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014134.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014135.exe=>(Quarantine-1) Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014135.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014135.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014136.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014136.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014136.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014137.exe=>(Quarantine-1) Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014137.exe=>(Quarantine-1) Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP14\A0014137.exe=>(Quarantine-1) Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP9\A0009767.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP9\A0009767.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP9\A0009767.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP9\A0009773.exe Infecté par: Trojan.Dropper.Agent.NJ C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP9\A0009773.exe Echec de la désinfection C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP9\A0009773.exe Supprimé C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP9\A0009785.exe Infecté par: Trojan.Clicker.Agent.DB C:\System Volume Information\_restore{5C1DC89A-9FE9-48CF-90DE-1EAEB9DEE399}\RP9\A0009

Utilisateur anonyme · Answer

celui ci a été nettoyé par bitdefC:\Documents and Settings\All Users\Application Data\Microsoft\Money\12.0\Webcache\msmoney.chmles autres se trouvent dans la quarantaine de norton et dans la restauration systemereposte un hijack et un silentrunners pour voir car si norton detectecisvvc.exe hclean32.exe  cstob.exe mssosxrt.exe  l'infection doit etre revenue

cnb · Answer

voici le hijack :Logfile of HijackThis v1.99.1Scan saved at 21:42:26, on 24/08/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEc:\Program Files\Norton AntiVirus\navapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Softwin\BitDefender8\vsserv.exeC:\windows\system\hpsysdrv.exeC:\HP\KBD\KBD.EXEC:\WINDOWS\system32\dla\tfswctrl.exeC:\PROGRA~1\NORTON~1\navapw32.exeC:\Program Files\ATI Technologies\Panneau de contrôle ATI\atiptaxx.exeC:\Program Files\Softwin\BitDefender8\bdoesrv.exeD:\Program files\System\mnyexpr.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeC:\Program Files\Sony Handheld\HOTSYNC.EXEC:\Program Files\Sony Handheld\USBSwt.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeD:\Nico\Depannage PC forum\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exeO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] atiptaxx.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exeO4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MoneyAgent] "D:\Program files\System\mnyexpr.exe"O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXEO4 - Startup: PowerReg Scheduler.exeO4 - Startup: SonyPDA USB Switcher.lnk = C:\Program Files\Sony Handheld\USBSwt.exeO4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112646766326O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photoways.com/clients/ImageUploader3.cabO16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cabO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exeO23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeet silentrunner :"Silent Runners.vbs", revision 40, http://www.silentrunners.org/Operating System: Windows XPOutput limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]"MoneyAgent" = ""D:\Program files\System\mnyexpr.exe"" [MS]"H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"" [MS]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]"StorageGuard" = ""C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r" ["VERITAS Software, Inc."]"dla" = "C:\WINDOWS\system32\dla\tfswctrl.exe" ["VERITAS Software, Inc."]"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]"NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"]"NAV Agent" = "c:\PROGRA~1\NORTON~1\navapw32.exe" ["Symantec Corporation"]"ATIModeChange" = "Ati2mdxx.exe" ["ATI Technologies, Inc."]"ATIPTA" = "atiptaxx.exe" [file not found]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"Microsoft Works Update Detection" = "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [file not found]"BDOESRV" = "C:\Program Files\Softwin\BitDefender8\bdoesrv.exe" ["SOFTWIN SRL"]"RegSvr32" = "C:\WINDOWS\System32\msmsgs.exe" [file not found]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["VERITAS Software, Inc."]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Explorateur de Bureau"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]"{596AB062-B4D2-4215-9F74-E9109B0A8153}" = "Previous Versions Property Page"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found]"{9DB7A13C-F208-4981-8353-73CC61AE2783}" = "Previous Versions"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{D653647D-D607-4DF6-A5B8-48D2BA195F7B}" = "BitDefender Antivirus v8"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\INFECTION WARNING! "AppInit_DLLs" = "sockspy.dll" [null data]HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Active Desktop and Wallpaper:-----------------------------Active Desktop is disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Control Panel\Desktop\"Wallpaper" = "C:\WINDOWS\Web\Wallpaper\HPi1-1024.bmp"Enabled Screen Saver:---------------------HKCU\Control Panel\Desktop\"SCRNSAVE.EXE" = "C:\WINDOWS\System32\PORSCH~1.SCR" [file not found]Startup items in "Propriétaire" & "All Users" startup folders:--------------------------------------------------------------C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage"HotSync Manager" -> shortcut to: "C:\Program Files\Sony Handheld\HOTSYNC.EXE" ["Palm, Inc."]INFECTION WARNING! "PowerReg Scheduler.exe" [empty string]"SonyPDA USB Switcher" -> shortcut to: "C:\Program Files\Sony Handheld\USBSwt.exe" ["Sony Corporation"]C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]"Wireless Configuration Utility" -> shortcut to: "C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exe" [empty string]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur" -> launches: "c:\PROGRA~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]"XoftSpy" -> launches: "C:\Program Files\XoftSpy\XoftSpy.exe -t" [file not found]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Extensions (Tools menu items, main toolbar menu buttons)HKLM\Software\Microsoft\Internet Explorer\Extensions\{85D1F590-48F4-11D9-9669-0800200C9A66}\"MenuText" = "Uninstall BitDefender Online Scanner v8""Exec" = "%windir%\bdoscandel.exe" [null data]Miscellaneous IE Hijack Points------------------------------C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 2 linesRunning Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------BitDefender Communicator, XCOMM, "C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe /service" ["Softwin"]BitDefender Virus Shield, VSSERV, "C:\Program Files\Softwin\BitDefender8\vsserv.exe /service" ["SOFTWIN S.R.L."]Service Norton AntiVirus Auto-Protect, navapsvc, "c:\Program Files\Norton AntiVirus\navapsvc.exe" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]----------+ This report excludes default entries except where indicated.+ To see *everywhere* the script checks and *everything* it finds,  launch it from a command prompt or a shortcut with the -all parameter.+ To search all directories of local fixed drives for DESKTOP.INI  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,  use the -supp parameter or answer "Yes" at the first message box.---------- (total run time: 91 seconds, including 3 seconds for message boxes)merci !

Utilisateur anonyme · Answer

juste une question:pourcisvvc.exe hclean32.exe il te les trouvent ou exactement ? ce serait pas dans le dossier C:\Submit! par hasard ?

cnb · Answer

non il les trouve dans C:windows\system32...

Utilisateur anonyme · Answer

bon, silentrunner ne detecte rien, mais par contre un petit nouveau dans ton hijack. Désactive la restauration systéme.Clic droit sur poste de travail > propriétés > onglet restauration système puis cocher "désactiver la restauration système".clic sur ok pour validerredemarre en en mode sans echec:supprime avec hijackthis:O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe rend visible tous les fichiers (cachés et systeme)recherche et supprime :C:\WINDOWS\System32\msmsgs.exe <- celui dans system32 pas celui dans le dossier de messengerC:\WINDOWS\System32\cisvvc.exe C:\WINDOWS\System32\hclean32.exe C:\WINDOWS\System32\cstob.exe C:\WINDOWS\System32\mssosxrt.exe passe nortonredemarre normallement et reposte un hijacka+

cnb · Answer

tout va bien jusqu'au moment de chercher et de sup les 4fichiers...je trouve rien sauf cisvvc mais dans le repertoire suivant : C:windows\prefetech\CISVVC.EXE-2D6BC2FC.pfdans le doute je l'ai pas sup.comment fairemerci

Utilisateur anonyme · Answer

tu utilise la fonction rechercher ou tu vas directement dans system32 ?

cnb · Answer

j'ai tenté les 2 sans succes.

Utilisateur anonyme · Answer

tu as passé norton en mode sans echec, pour voir s'il les detectent ?tu peut vider tout le contenu du dossier prefetch sauf le fichier layout.ini, pas de probleme de ce coté là

cnb · Answer

je vais passer norton en mode sans echec et te tient au courantmercia+

Utilisateur anonyme · Answer

ok, s'il les detecte, il pourra peut etre les supprimer en mode sans echec et restau systeme désactivée.sinon, faudra reessayer avec killboxje repasse demain pour la suitea+

cnb · Answer

Salut moe31 !hier soir avant de m'écrouler de sommeil j'ai donc lancé le scan norton en mode sans echec... et bah pas rapide (fin vers minuit !!)donc cela dit il n'a rien détecté.est ce que je te repost un scan hijack et un silentrunner pour valider la bonne désinfection ?a+

Utilisateur anonyme · Answer

c'est bon signeremet un rapport des 2 progs (lance hijack apres que tu te soit connecté au net).a+

cnb · Answer

si on pouvait toucher au but !!!voici hijack :Logfile of HijackThis v1.99.1Scan saved at 18:54:53, on 25/08/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exec:\Program Files\Norton AntiVirus\navapsvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeC:\Program Files\Softwin\BitDefender8\vsserv.exeC:\windows\system\hpsysdrv.exeC:\HP\KBD\KBD.EXEC:\WINDOWS\system32\dla\tfswctrl.exeC:\PROGRA~1\NORTON~1\navapw32.exeC:\Program Files\ATI Technologies\Panneau de contrôle ATI\atiptaxx.exeC:\Program Files\Softwin\BitDefender8\bdoesrv.exeD:\Program files\System\mnyexpr.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeC:\Program Files\Sony Handheld\HOTSYNC.EXEC:\Program Files\Sony Handheld\USBSwt.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\Internet Explorer\iexplore.exeD:\Nico\Depannage PC forum\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /rO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exeO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exeO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [ATIPTA] atiptaxx.exeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [BDOESRV] C:\Program Files\Softwin\BitDefender8\bdoesrv.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MoneyAgent] "D:\Program files\System\mnyexpr.exe"O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXEO4 - Startup: PowerReg Scheduler.exeO4 - Startup: SonyPDA USB Switcher.lnk = C:\Program Files\Sony Handheld\USBSwt.exeO4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Wireless Configuration Utility.lnk = C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112646766326O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.photoways.com/clients/ImageUploader3.cabO16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f001.mail.caramail.lycos.fr/app/uploader/FileUploader.cabO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exeO23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeet silentrunner :"Silent Runners.vbs", revision 40, http://www.silentrunners.org/Operating System: Windows XPOutput limited to non-default values, except where indicated by "{++}"Startup items buried in registry:---------------------------------HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]"MoneyAgent" = ""D:\Program files\System\mnyexpr.exe"" [MS]"H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"" [MS]HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]"IgfxTray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]"StorageGuard" = ""C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r" ["VERITAS Software, Inc."]"dla" = "C:\WINDOWS\system32\dla\tfswctrl.exe" ["VERITAS Software, Inc."]"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]"NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS]"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]"PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"]"NAV Agent" = "c:\PROGRA~1\NORTON~1\navapw32.exe" ["Symantec Corporation"]"ATIModeChange" = "Ati2mdxx.exe" ["ATI Technologies, Inc."]"ATIPTA" = "atiptaxx.exe" [file not found]"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]"Microsoft Works Update Detection" = "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [file not found]"BDOESRV" = "C:\Program Files\Softwin\BitDefender8\bdoesrv.exe" ["SOFTWIN SRL"]HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["VERITAS Software, Inc."]"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Explorateur de Bureau"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"  -> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]"{596AB062-B4D2-4215-9F74-E9109B0A8153}" = "Previous Versions Property Page"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found]"{9DB7A13C-F208-4981-8353-73CC61AE2783}" = "Previous Versions"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\twext.dll" [file not found]"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]"{D653647D-D607-4DF6-A5B8-48D2BA195F7B}" = "BitDefender Antivirus v8"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\INFECTION WARNING! "AppInit_DLLs" = "sockspy.dll" [null data]HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]HKLM\Software\Classes\*\shellex\ContextMenuHandlers\BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"  -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Softwin\BitDefender8\bdshelxt.dll" ["SOFTWIN S.R.L."]Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Active Desktop and Wallpaper:-----------------------------Active Desktop is disabled at this entry:HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellStateHKCU\Control Panel\Desktop\"Wallpaper" = "C:\WINDOWS\Web\Wallpaper\HPi1-1024.bmp"Enabled Screen Saver:---------------------HKCU\Control Panel\Desktop\"SCRNSAVE.EXE" = "C:\WINDOWS\System32\PORSCH~1.SCR" [file not found]Startup items in "Propriétaire" & "All Users" startup folders:--------------------------------------------------------------C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage"HotSync Manager" -> shortcut to: "C:\Program Files\Sony Handheld\HOTSYNC.EXE" ["Palm, Inc."]INFECTION WARNING! "PowerReg Scheduler.exe" [empty string]"SonyPDA USB Switcher" -> shortcut to: "C:\Program Files\Sony Handheld\USBSwt.exe" ["Sony Corporation"]C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage"Adobe Gamma Loader.exe" -> shortcut to: "C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]"Wireless Configuration Utility" -> shortcut to: "C:\Program Files\802.11 Wireless LAN\802.11g Wireless Cardbus & PCI Adapter HW.21 V1.10\WlanCU.exe" [empty string]Enabled Scheduled Tasks:------------------------"Norton AntiVirus - Analyser mon ordinateur" -> launches: "c:\PROGRA~1\NORTON~1\NAVW32.exe /task:C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\NORTON~1\Tasks\mycomp.sca" ["Symantec Corporation"]"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]"XoftSpy" -> launches: "C:\Program Files\XoftSpy\XoftSpy.exe -t" [file not found]Winsock2 Service Provider DLLs:-------------------------------Namespace Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]Transport Service ProvidersHKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05Toolbars, Explorer Bars, Extensions:------------------------------------ToolbarsHKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]HKLM\Software\Microsoft\Internet Explorer\Toolbar\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"  -> {CLSID}\InProcServer32\(Default) = "c:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]Extensions (Tools menu items, main toolbar menu buttons)HKLM\Software\Microsoft\Internet Explorer\Extensions\{85D1F590-48F4-11D9-9669-0800200C9A66}\"MenuText" = "Uninstall BitDefender Online Scanner v8""Exec" = "%windir%\bdoscandel.exe" [null data]Miscellaneous IE Hijack Points------------------------------C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")Added lines (compared with English-language version):[Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"Missing lines (compared with English-language version):[Strings]: 2 linesRunning Services (Display Name, Service Name, Path {Service DLL}):------------------------------------------------------------------BitDefender Communicator, XCOMM, "C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe /service" ["Softwin"]BitDefender Virus Shield, VSSERV, "C:\Program Files\Softwin\BitDefender8\vsserv.exe /service" ["SOFTWIN S.R.L."]Service Norton AntiVirus Auto-Protect, navapsvc, "c:\Program Files\Norton AntiVirus\navapsvc.exe" ["Symantec Corporation"]Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]----------+ This report excludes default entries except where indicated.+ To see *everywhere* the script checks and *everything* it finds,  launch it from a command prompt or a shortcut with the -all parameter.+ To search all directories of local fixed drives for DESKTOP.INI  DLL launch points and all Registry CLSIDs for dormant Explorer Bars,  use the -supp parameter or answer "Yes" at the first message box.---------- (total run time: 112 seconds, including 3 seconds for message boxes)a+

Utilisateur anonyme · Answer

je ne vois plus rien de suspect, ni dans hijack, ni dans silent runnerpour info, c'est toi qui à verrouillé la page de demarrage d'IE ?(IE > outils > tous les onglets dans page de demarrage grisées)a+

gabygab · Answer

désolé d intervenir dans votre discussion mais g un pb de virus et il me semble que moe31 aété le seul à le regler chez les autres...virus tojan.gen avec fichier msdirectx.exeplease help

Utilisateur anonyme · Answer

salut gabygabFait ton propre post, ensuite telecharge hijackthis:http://www.merijn.org/files/hijackthis.zip Dezippe le dans un dossier prévu a cet effet.Par exemple C:\hijacket surtout pas dans un dossier temporaire (temp)lance le puis:clic sur "do a system scan and save logfile" et pas autre choseLe bloc note va s'ouvrir, copie tout le contenu et colle le ici a la suite de ton message.Si tu as du mal, regarde ceci:http://pageperso.aol.fr/balltrap34/demohijack.htm a+

cnb · Answer

salut moe 31,désolé de mettre du temps à répondre mais j'ai galéré avec le forum : temps de chargement super long ! j'ai cru que j'y arriverai jamais...sinon le PC semble bien tourner mais il doit qd mm y avoir qques restes pas clean car spybot me trouve le truc suivant :HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\uuid ->valeur de registrequ'est ce que c'est ?mercia+

cnb · Answer

au fait j'ai pas tres bien compris ton histoire de verrouillage de page de démarrage de IE ???P.S. : mon PC est super lent pour surfer, j'suis super inquiet...

Utilisateur anonyme · Answer

salutil te dis quoi exactement spybot ?fais ceci pour voir:demarrer>executer tape cmddans la fenetre dos, copie et colle ceci:reg query "HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\Currentversion\uuid">>%systemdrive%\log.txtvalide, puis va dans poste de travail, double clic sur l'icone de ton disque dur, tu devrais trouver le fichier log.txtouvre le et copie et colle le resultat icia+

cnb · Answer

dans la fenetre DOS j'ai une erreur :"le systeme n'a pas pu trouver la clef ou la valeur de registre spécifié"sachant qu'après le scan je l'avais supprimé ce truca+

Utilisateur anonyme · Answer

ok, c'est normal que la commande ne trouve rien alorsest ce que spybot à donné quelques infos sur cette clé ?un nom de spyware ou autre ?

cnb · Answer

je crois que c'était "Smitfrand-C" ???

Utilisateur anonyme · Answer

smitfraud c ?tu as dejà eu à faire à smitfraud ?

cnb · Answer

a priori non ?tu connais ?

Utilisateur anonyme · Answer

oui un peupar acquis de conscience, telecharge smitfraudfix ici:http://siri.urz.free.fr/Fix/SmitfraudFix.zipdezippe le et lance smitfradfix.cmd et choisis l'option 1 (rechercher)poste le rapport

cnb · Answer

merci moe 31 !je dois m'absenter pour la soirée, je ferais tout demain et post le rapport.bonne soirée à toi et à bientot !merci

Utilisateur anonyme · Answer

ok, bonne soirée ;-)a+

cnb · Answer

Hello moe 31tout d'abord je viens d'installer Mozilla en navigateur par défaut!Sinon voici le rapport préconisé, sachant que Norton et Spybot n'ont rien trouvé. Ad aware à juste trouvé ca :cookie:propietaire@bluestreak.com & prpriétaire@imrworlwide.com/cgi-binType : IE cache entryFournisseur : tracking cookieCategory : data minerje suis pas bcp + avancé;le rapport :SmitFraudFix v1.81Rapport fait à 18:49:38,84 le 27/08/2005Executé à partir de D:\Nico\Depannage PC forum\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Propri‚taire\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de la clé HKLM\SOFTWARE\SHUDDERLTDHKLM\SOFTWARE\SHUDDERLTD non trouvé.»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapporta+

Utilisateur anonyme · Answer

salutaucunes traces de smitfraud, ou en sont tes soucis ?

cnb · Answer

salutplus de soucis particuliers, tout semble clean.ad aware trouve tjs 1 fichier de type cookie mais bon je n'ai pas concretement de prb lors de l'utilisation du PC.je vais surveiller, passer régulièrement antivirus, adaware & spybot et tout devrait rouler on va dire que tt est okUn super grand merci pour ta patience, le tps passé à m'aider et tes grandes compétences.bonne continuation !A bientot

Utilisateur anonyme · Answer

salutok, merci d'avoir préciséa+

Utilisateur anonyme · Answer

salutben, j'aimerais bien t'aider, mais je ne connait pas la freebox ni le freeplayer, mais apparement il y a une bonne explication ici étapes par étapes:http://adsl.free.fr/tv/freeplayer/a+

nausica · Answer

SOS Logfile of HijackThis v1.99.1Scan saved at 19:51:54, on 02/07/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\Explorer.EXEC:\Documents and Settings\corinne\Mes documents\Mes téléchargements\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.comR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.comR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXEO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -uO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [ExtraFilmHemmaAgent] "C:\Program Files\WistitiSoft\Agent.exe"O4 - HKLM\..\Run: [defender] C:\dfndrb_3.exeO4 - HKLM\..\Run: [keyboard] C:\kybrdb_3.exeO4 - HKLM\..\Run: [newname] C:\nwnmb_3.exeO4 - HKLM\..\Run: [Windows MS Update 32] sucker.exeO4 - HKLM\..\Run: [tlh94ea6] RUNDLL32.EXE w0067d23.dll,n 00194ea50000000a0067d23O4 - HKLM\..\RunServices: [Windows MS Update 32] sucker.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [Windows MS Update 32] sucker.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin
pjpi150_02.dllO16 - DPF: {983AB2CC-3D50-11D9-ADFE-00062919A34C} (ActiveXUpload.UserCtrl) - http://www.photoservice.com/activeX/newUpload.CABO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Y29yaW5uZQ\command.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor
etmon.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Microsoft Windows Protection (Windows Protection Service) - Unknown owner - C:\WINDOWS\winlogon.exeMERCI!désolée d'être si rapide, mais je ne peux pas rester longtemps sur une pagelog de Hijack thismerci merci

Regis59 · Answer

Salut----------------------------------------------------------------------------Télécharge ceci: (merci a S!RI pour ce programme).http://siri.urz.free.fr/Fix/SmitfraudFix.zipExécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapportCopie/colle le sur le poste stp.------------------------------------------------------------------

nausica · Answer

voilà:SmitFraudFix v2.65Rapport fait à 20:30:36,45, 02/07/2006Executé à partir de C:\Documents and Settings\corinne\Mes documents\Mes t‚l‚chargements\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600] - Windows_NTFix executé en mode normal»»»»»»»»»»»»»»»»»»»»»»»» C:\C:\drsmartload?.exe PRESENT !C:\drsmartload??.exe PRESENT !C:\drsmartload???.exe PRESENT !C:\drsmartload????.exe PRESENT !C:\MTE3NDI6ODoxNg.exe PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWSC:\WINDOWS\drsmartload2.dat PRESENT !C:\WINDOWS\keyboard1.dat PRESENT !C:\WINDOWS\icont.exe PRESENT !C:\WINDOWS
ewname.dat PRESENT !C:\WINDOWS	eller2.chk PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\corinne\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\corinne\Favoris»»»»»»»»»»»»»»»»»»»»»»»» Bureau»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]"Source"="About:Home""SubscribedURL"="About:Home""FriendlyName"="Ma page d'accueil" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!SrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» Fin

Regis59 · Answer

ReDémarre en mode sans échec : Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! (Si F8 ne marche pas utilise la touche F5).  ----------------------------------------------------------------------------Relance le programme Smitfraud,Cette fois choisit l’option 2, répond oui a tous ;Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forumA+

nausica · Answer

reje ne sais pas ou est passé le log, mais je n'ai pas pu redémarrer normalement après la manipPage bleue avecsession5_initialization_failedlà, je suis en "dernière bonne session connue" et le virus est toujours làque faire? merci

Regis59 · Answer

SalutRemet un Hijack this !a+

nausica · Answer

Salutc'est très compliqué à traiter ce problème. Le programme qui a pris possession de mon ordinateur m'empêche de lancer les antivirus.Le nom du fichier qui revient tout le temps est: q1win3 ou q1win32. D'ailleurs il s'est réinstallé.Je crois qu'il va me falloir réinstaller Windows...

Regis59 · Answer

SalutOu en sont tes soucis, tu as reinstallé?a+

Regis59 · Answer

OkTu as acces a Windows et Internet avec ton PC?Si oui, on peut peut etre t aider !a+

TROJAN TENACES

66 réponses

Votre réponse

Discussions similaires

Newsletters