Rapport BitDefender. J'ai besoin d'aide !

Bonsoir,

* Télécharge HijackThis et poste le rapport stp

http://pchelpbordeaux.free.fr/logiciels.html
Tutorial
http://pchelpbordeaux.free.fr/tuto.html
Démo en image
http://pageperso.aol.fr/balltrap34/demohijack.htm
et

* télécharge AVG Anti-Spyware (ewido)

https://www.avg.com/en-ww/free-antivirus-download

* tu l'installes

* lance AVG Anti-Spyware et clique sur le bouton Mise à jour.<g/ras> Patiente

puis

Lance <gras>AVG Anti-Spyware

Clique sur le bouton Analyse (de la barre d'outils)

Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.

Reviens à l'onglet Analyse. Clique sur Analyse complète du système.

A la fin du scan, choisis l'option 3

"Appliquer toutes les actions " en bas.

Clique sur "Enregistrer le rapport".

Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.

Poste le.

hi,

voici les rapports demandés :

HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 01:48:37, on 15/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\STDSB.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Packard Bell EverSafe\TrayControl.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\RALINK\RT2500 Wireless LAN Card\Installer\WINXP\RaConfig2500.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
c:\progra~1\softwin\bitdef~1\bdmcon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sab\Bureau\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://outlook.live.com/owa/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\System32\STDSB.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NovaNet-WEB Tray Control] C:\Program Files\Packard Bell EverSafe\TrayControl.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "c:\progra~1\softwin\bitdef~1\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "c:\progra~1\softwin\bitdef~1\bdswitch.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Packard Bell EverSafe Tray Control.lnk = C:\Program Files\Packard Bell EverSafe\TrayControl.exe
O4 - Global Startup: RaConfig2500.lnk = C:\Program Files\RALINK\RT2500 Wireless LAN Card\Installer\WINXP\RaConfig2500.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

ewido :

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 04:26:29 15/01/2007

+ Scan result:

C:\Documents and Settings\Sab\Cookies\sab@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@2o7[3].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@dupont.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@etronics.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@highbeam.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@meijer.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@atdmt[3].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@bluestreak[3].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@estat[1].txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@ehg-bestbuy.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@ehg-samsungusa.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@sales.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@stat.onestat[2].txt -> TrackingCookie.Onestat : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@perf.overture[2].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@www.smartadserver[3].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@weborama[1].txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@weborama[2].txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

::Report end

J'aimerai vraiment comprendre un jour comment ce charabia peut vous parler! Respect.

J'attends les instructions pour tuer les envahisseurs ...

Merqui
Sabrina

bonjour,

* Télécharge LopXPMH sur ton Bureau.
http://perso.numericable.fr/~altshift/Info/Fichiers/lopxpMH2.zip

* Dézippe-le (clic droit >> Extraire ici) et double clique sur le fichier lopxpMH.bat.
* Poste le contenu du rapport qui va s'ouvrir.

Bonjour,

Voilà le rapport demandé :

Rapport fait à 16:03:24,49 le 15/01/2007

******************************************
## Répertoires Application Data

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\All Users\Application Data

30/09/2002 11:54 <REP> .
30/09/2002 11:54 <REP> ..
19/09/2006 09:43 <REP> Adobe
25/07/2006 20:53 <REP> Apple Computer
24/07/2006 21:39 <REP> CyberLink
10/10/2006 17:32 <REP> Google
30/09/2002 11:54 <REP> Microsoft
31/08/2006 19:38 <REP> MSN6
24/07/2006 20:12 <REP> QuickTime
30/09/2002 13:00 <REP> SBSI
06/01/2007 23:20 <REP> Skype
25/07/2006 18:06 <REP> ViGUARD
30/09/2006 11:23 <REP> Windows Genuine Advantage
19/09/2006 17:22 <REP> Yahoo! Companion
30/09/2002 11:55 62 desktop.ini
1 fichier(s) 62 octets
14 R‚p(s) 8ÿ864ÿ096ÿ256 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\Default User\Application Data

30/09/2002 11:54 <REP> .
30/09/2002 11:54 <REP> ..
24/07/2006 21:55 <REP> Adobe
24/07/2006 21:55 <REP> Identities
24/07/2006 21:55 <REP> InterTrust
30/09/2002 11:54 <REP> Microsoft
24/07/2006 21:55 <REP> Real
30/09/2002 11:55 62 desktop.ini
1 fichier(s) 62 octets
7 R‚p(s) 8ÿ864ÿ096ÿ256 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\Default User\Local Settings\Application Data

30/09/2002 11:55 <REP> .
30/09/2002 11:55 <REP> ..
24/07/2006 21:55 <REP> Microsoft
24/07/2006 21:55 2ÿ687ÿ090 IconCache.db
1 fichier(s) 2ÿ687ÿ090 octets
3 R‚p(s) 8ÿ864ÿ096ÿ256 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\LocalService\Application Data

30/09/2002 12:09 <REP> .
30/09/2002 12:09 <REP> ..
29/08/2006 19:24 <REP> BitDefender
30/09/2002 12:09 <REP> Microsoft
25/07/2006 18:06 <REP> Webroot
0 fichier(s) 0 octets
5 R‚p(s) 8ÿ864ÿ096ÿ256 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data

30/09/2002 12:09 <REP> .
30/09/2002 12:09 <REP> ..
30/09/2002 12:09 <REP> Microsoft
0 fichier(s) 0 octets
3 R‚p(s) 8ÿ864ÿ096ÿ256 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\NetworkService\Application Data

30/09/2002 12:09 <REP> .
30/09/2002 12:09 <REP> ..
30/09/2002 12:09 <REP> Microsoft
0 fichier(s) 0 octets
3 R‚p(s) 8ÿ864ÿ096ÿ256 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data

30/09/2002 12:09 <REP> .
30/09/2002 12:09 <REP> ..
30/09/2002 12:09 <REP> Microsoft
0 fichier(s) 0 octets
3 R‚p(s) 8ÿ864ÿ096ÿ256 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\Propri‚taire

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\Sab\Application Data

24/07/2006 21:56 <REP> .
24/07/2006 21:56 <REP> ..
24/07/2006 21:56 <REP> Adobe
19/09/2006 09:47 <REP> AdobeUM
25/07/2006 20:56 <REP> Apple Computer
28/08/2006 20:41 <REP> BitDefender
21/10/2006 21:22 <REP> CyberLink
02/09/2006 23:29 <REP> dvdcss
10/10/2006 17:53 <REP> Google
14/09/2006 20:28 <REP> Help
24/07/2006 21:56 <REP> Identities
24/07/2006 21:56 <REP> InterTrust
04/10/2006 18:30 <REP> Leadertech
29/08/2006 19:58 <REP> Macromedia
12/09/2006 21:42 <REP> Media Player Classic
24/07/2006 21:56 <REP> Microsoft
13/09/2006 17:20 <REP> Microsoft Web Folders
31/08/2006 19:38 <REP> MSN6
24/07/2006 21:56 <REP> Real
10/10/2006 17:33 <REP> Skype
30/08/2006 22:12 <REP> vlc
19/09/2006 09:32 1ÿ697 AdobeDLM.log
24/07/2006 21:56 62 desktop.ini
19/09/2006 09:32 0 dm.ini
05/09/2006 12:09 18ÿ392 GDIPFONTCACHEV1.DAT
4 fichier(s) 20ÿ151 octets
21 R‚p(s) 8ÿ864ÿ092ÿ160 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Documents and Settings\Sab\Local Settings\Application Data

24/07/2006 21:56 <REP> .
24/07/2006 21:56 <REP> ..
20/09/2006 23:31 <REP> Adobe
25/07/2006 20:56 <REP> Apple Computer
10/10/2006 17:53 <REP> Google
14/09/2006 20:28 <REP> Help
03/09/2006 15:24 <REP> Identities
24/07/2006 21:56 <REP> Microsoft
24/07/2006 21:59 236ÿ544 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
21/10/2006 13:49 21ÿ416 GDIPFONTCACHEV1.DAT
24/07/2006 21:56 4ÿ809ÿ594 IconCache.db
3 fichier(s) 5ÿ067ÿ554 octets
8 R‚p(s) 8ÿ864ÿ092ÿ160 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\WINDOWS\system32\config\systemprofile\Application Data

30/09/2002 12:08 <REP> .
30/09/2002 12:08 <REP> ..
24/07/2006 21:55 <REP> Adobe
24/07/2006 21:55 <REP> Identities
24/07/2006 21:55 <REP> InterTrust
30/09/2002 12:08 <REP> Microsoft
24/07/2006 21:55 <REP> Real
30/09/2002 12:08 62 desktop.ini
1 fichier(s) 62 octets
7 R‚p(s) 8ÿ864ÿ092ÿ160 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data

30/09/2002 12:08 <REP> .
30/09/2002 12:08 <REP> ..
24/07/2006 21:43 <REP> Microsoft
24/07/2006 21:55 2ÿ687ÿ090 IconCache.db
1 fichier(s) 2ÿ687ÿ090 octets
3 R‚p(s) 8ÿ864ÿ092ÿ160 octets libres

******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\WINDOWS\Tasks

14/09/2006 19:05 284 AppleSoftwareUpdate.job
24/07/2006 21:55 258 Rappel d'enregistrement 3.job
24/07/2006 21:55 258 Rappel d'enregistrement 2.job
24/07/2006 21:54 192 HDReg.job
30/09/2002 12:04 6 SA.DAT
30/09/2002 12:02 <REP> ..
30/09/2002 12:02 <REP> .
30/09/2002 11:49 65 desktop.ini
6 fichier(s) 1ÿ063 octets
2 R‚p(s) 8ÿ864ÿ092ÿ160 octets libres

******************************************
## Répertoires de Program files

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\Program Files

12/01/2007 03:20 <REP> .
12/01/2007 03:20 <REP> ..
11/10/2006 22:23 <REP> Adobe
19/09/2006 09:36 <REP> Adobe reader
11/01/2007 17:59 <REP> Adverts
28/10/2006 20:41 <REP> Apple Software Update
16/09/2006 00:27 <REP> Atomix
16/10/2006 13:33 <REP> AviSynth 2.5
31/10/2006 11:38 <REP> CCleaner
30/09/2002 12:01 <REP> ComPlus Applications
24/07/2006 21:39 <REP> CyberLink
18/11/2006 11:51 <REP> eMule
15/01/2007 02:01 <REP> ewido anti-spyware 4.0
06/01/2007 23:20 <REP> Fichiers communs
06/01/2007 23:38 <REP> Google
26/10/2006 10:13 <REP> Illustrate
29/08/2006 19:24 901 INSTALL.LOG
11/10/2006 22:24 <REP> InterActual
06/01/2007 14:05 <REP> Internet Explorer
14/11/2006 12:08 <REP> iPod
14/11/2006 12:08 <REP> iTunes
12/09/2006 21:41 <REP> K-Lite Codec Pack
30/08/2006 11:45 <REP> log locks build
22/10/2006 02:01 <REP> Messenger
13/09/2006 17:20 <REP> microsoft frontpage
13/09/2006 17:20 <REP> Microsoft Office
24/07/2006 21:34 <REP> Microsoft Visual Studio
21/10/2006 11:27 <REP> Movie Maker
31/08/2006 19:44 <REP> MSN
30/09/2002 12:00 <REP> MSN Gaming Zone
21/10/2006 13:52 <REP> MSN Messenger
21/10/2006 11:19 <REP> NetMeeting
20/09/2006 22:58 <REP> Nouveau dossier
22/10/2006 01:57 <REP> Outlook Express
15/01/2007 15:43 <REP> Packard Bell EverSafe
02/11/2006 18:54 <REP> PDFCreator
02/11/2006 18:50 <REP> PDFCreator Toolbar
14/11/2006 11:55 <REP> QuickTime
05/01/2007 22:09 <REP> RALINK
24/07/2006 20:13 <REP> Real
23/10/2006 14:20 <REP> ri4m encodeur
30/09/2002 12:00 <REP> Services en ligne
06/01/2007 23:20 <REP> Skype
28/08/2006 20:37 <REP> Softwin
30/09/2006 15:29 <REP> SuperCopier2
24/07/2006 20:05 <REP> Synaptics
24/07/2006 20:03 <REP> VIA
30/08/2006 22:12 <REP> VideoLAN
25/08/2006 15:54 <REP> ViGUARD
24/07/2006 21:36 <REP> Virtual CD v4 SDK
21/10/2006 11:27 <REP> Windows Media Player
21/10/2006 11:19 <REP> Windows NT
14/09/2006 20:28 <REP> WinRAR
14/09/2006 20:28 <REP> WinZip
30/09/2002 12:05 <REP> xerox
19/09/2006 09:42 <REP> Yahoo!
1 fichier(s) 901 octets
55 R‚p(s) 8ÿ864ÿ088ÿ064 octets libres

******************************************
## Popups autorisées

* Internet Explorer

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
www.romware.net REG_BINARY
www.freitag.ch REG_BINARY
webmessenger.msn.com REG_BINARY

* Mozilla Firefox (1 autorisé 2 interdit)

******************************************
## Registre

******************************************
## Zones de sécurité

* HKCU Domains (4)

* P3P History (5)

******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\WINDOWS

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 6C74-2A81

R‚pertoire de C:\WINDOWS

*************** Fin du rapport ****************

A suivre ...
Sabrina

re
rien de bien flagrant.

supprime

c:\ProgramFiles\Adverts

et

* Télécharge WinPFind
https://www.bleepingcomputer.com/download/linux/
* Dézippe-le dans C:\

* Redémarre en mode sans échec.

* Double-clique sur le fichier c:\winpfind\winpfind.exe,

clique ensuite sur le bouton "Start Scan button"

Patiente le temps du scan.

Quand c'est terminé,

* redémarre normalement et

poste le contenu du fichier WinPFind.Txt qui se trouve dans le répertoire c:\winpfind

rebonjour,

voilà le rapport :

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows sometimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Logfile created on: 15/01/2007 20:55:09
WinPFind v1.5.0 Folder = C:\WinPFind\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...

Checking %System% folder...
WSUD 24/04/2003 15:53:22 6842880 C:\WINDOWS\SYSTEM32\ALSNDMGR.CPL (Realtek Semiconductor Corp.)
UPX! 07/10/2005 18:14:52 308224 C:\WINDOWS\SYSTEM32\avisynth.dll (The Public)
PEC2 30/08/2002 12:00:00 41131 C:\WINDOWS\SYSTEM32\dfrg.msc ()
PEC2 03/07/2006 22:40:50 620180 C:\WINDOWS\SYSTEM32\divx.dll (DivX, Inc.)
PECompact2 03/07/2006 22:40:50 620180 C:\WINDOWS\SYSTEM32\divx.dll (DivX, Inc.)
PTech 12/12/2006 10:45:04 1474864 C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL (Microsoft Corporation)
PECompact2 04/10/2006 12:03:46 9639336 C:\WINDOWS\SYSTEM32\MRT.exe (Microsoft Corporation)
aspack 04/10/2006 12:03:46 9639336 C:\WINDOWS\SYSTEM32\MRT.exe (Microsoft Corporation)
aspack 20/08/2004 00:09:14 733184 C:\WINDOWS\SYSTEM32\ntdll.dll (Microsoft Corporation)
WSUD 20/08/2004 00:10:06 261120 C:\WINDOWS\SYSTEM32\nusrmgr.cpl (Microsoft Corporation)
Umonitor 20/08/2004 00:09:40 685056 C:\WINDOWS\SYSTEM32\rasdlg.dll (Microsoft Corporation)
UPX! 27/04/2006 16:49:30 288417 C:\WINDOWS\SYSTEM32\SrchSTS.exe (S!Ri)
UPX! 29/08/2006 18:43:54 135168 C:\WINDOWS\SYSTEM32\swreg.exe (SteelWerX)
UPX! 09/01/2006 09:36:06 40960 C:\WINDOWS\SYSTEM32\swsc.exe ()
winsync 30/08/2002 12:00:00 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu ()

Checking %System%\Drivers folder and sub-folders...
PTech 05/02/2003 18:25:00 1290760 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys ( )

Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts

Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
15/01/2007 20:54:12 S 2048 C:\WINDOWS\bootstat.dat ()
17/11/2006 19:30:16 S 42340 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ie7.cat ()
15/01/2007 20:53:58 H 8192 C:\WINDOWS\system32\config\default.LOG ()
15/01/2007 20:54:30 H 1024 C:\WINDOWS\system32\config\SAM.LOG ()
15/01/2007 20:54:14 H 16384 C:\WINDOWS\system32\config\SECURITY.LOG ()
15/01/2007 20:54:36 H 65536 C:\WINDOWS\system32\config\software.LOG ()
15/01/2007 20:54:22 H 1081344 C:\WINDOWS\system32\config\system.LOG ()
06/01/2007 13:48:46 H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG ()
15/01/2007 20:53:00 H 6 C:\WINDOWS\Tasks\SA.DAT ()

Checking for CPL files...
20/08/2004 00:10:06 71680 C:\WINDOWS\SYSTEM32\access.cpl (Microsoft Corporation)
24/04/2003 15:53:22 6842880 C:\WINDOWS\SYSTEM32\ALSNDMGR.CPL (Realtek Semiconductor Corp.)
20/08/2004 00:10:06 555008 C:\WINDOWS\SYSTEM32\appwiz.cpl (Microsoft Corporation)
20/08/2004 00:10:06 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl (Microsoft Corporation)
20/08/2004 00:10:06 138240 C:\WINDOWS\SYSTEM32\desk.cpl (Microsoft Corporation)
20/08/2004 00:10:06 80384 C:\WINDOWS\SYSTEM32\firewall.cpl (Microsoft Corporation)
20/08/2004 00:10:06 157184 C:\WINDOWS\SYSTEM32\hdwwiz.cpl (Microsoft Corporation)
17/10/2006 12:05:48 1817088 C:\WINDOWS\SYSTEM32\inetcpl.cpl (Microsoft Corporation)
20/08/2004 00:10:06 134144 C:\WINDOWS\SYSTEM32\intl.cpl (Microsoft Corporation)
20/08/2004 00:10:06 380928 C:\WINDOWS\SYSTEM32\irprops.cpl (Microsoft Corporation)
20/08/2004 00:10:06 70144 C:\WINDOWS\SYSTEM32\joy.cpl (Microsoft Corporation)
30/08/2002 12:00:00 189952 C:\WINDOWS\SYSTEM32\main.cpl (Microsoft Corporation)
20/08/2004 00:10:06 626176 C:\WINDOWS\SYSTEM32\mmsys.cpl (Microsoft Corporation)
30/08/2002 12:00:00 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl (Microsoft Corporation)
20/08/2004 00:10:06 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl (Microsoft Corporation)
20/08/2004 00:10:06 261120 C:\WINDOWS\SYSTEM32\nusrmgr.cpl (Microsoft Corporation)
20/08/2004 00:10:06 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl (Microsoft Corporation)
20/08/2004 00:10:06 118272 C:\WINDOWS\SYSTEM32\powercfg.cpl (Microsoft Corporation)
17/01/2003 00:55:36 397312 C:\WINDOWS\SYSTEM32\slcpappl.cpl ()
20/08/2004 00:10:06 305152 C:\WINDOWS\SYSTEM32\sysdm.cpl (Microsoft Corporation)
30/08/2002 12:00:00 28160 C:\WINDOWS\SYSTEM32\telephon.cpl (Microsoft Corporation)
20/08/2004 00:10:06 94208 C:\WINDOWS\SYSTEM32\timedate.cpl (Microsoft Corporation)
20/08/2004 00:10:06 148480 C:\WINDOWS\SYSTEM32\wscui.cpl (Microsoft Corporation)
26/05/2005 03:16:32 175896 C:\WINDOWS\SYSTEM32\wuaucpl.cpl (Microsoft Corporation)
17/10/2006 12:05:48 1817088 C:\WINDOWS\SYSTEM32\dllcache\inetcpl.cpl (Microsoft Corporation)
30/08/2002 12:00:00 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl (Microsoft Corporation)

Checking for Downloaded Program Files...
{17492023-C23A-453E-A040-C7C580BBF700} - Windows Genuine Advantage Validation Tool - CodeBase = http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} - - CodeBase = http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DirectAnimation Java Classes - - CodeBase = file://C:\WINDOWS\Java\classes\dajava.cab
Microsoft XML Parser for Java - - CodeBase = file://C:\WINDOWS\Java\classes\xmldso.cab

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
30/09/2002 12:04:54 HS 84 C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini ()
11/01/2007 17:44:22 1760 C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk ()
25/08/2006 16:06:16 1665 C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Packard Bell EverSafe Tray Control.lnk ()
05/01/2007 22:11:10 1950 C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\RaConfig2500.lnk ()

Checking files in %ALLUSERSPROFILE%\Application Data folder...
30/09/2002 11:55:18 HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini ()

Checking files in %USERPROFILE%\Startup folder...
30/09/2002 12:04:54 HS 84 C:\Documents and Settings\Sab\Menu Démarrer\Programmes\Démarrage\desktop.ini ()

Checking files in %USERPROFILE%\Application Data folder...
19/09/2006 09:44:24 1697 C:\Documents and Settings\Sab\Application Data\AdobeDLM.log ()
30/09/2002 11:55:18 HS 62 C:\Documents and Settings\Sab\Application Data\desktop.ini ()
19/09/2006 09:44:24 0 C:\Documents and Settings\Sab\Application Data\dm.ini ()
05/09/2006 12:09:16 18392 C:\Documents and Settings\Sab\Application Data\GDIPFONTCACHEV1.DAT ()

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

>>> Internet Explorer Settings <<<

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
\\Start Page - https://www.msn.com/fr-fr/?ocid=iehp
\\Search Page - https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
\\Default_Page_URL - https://www.msn.com/fr-fr/?ocid=iehp
\\Default_Search_URL - https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
\\Local Page - %SystemRoot%\system32\blank.htm

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main]
\\Start Page - https://www.google.com/?gws_rd=ssl
\\Search Bar - http://www.google.com/toolbar/ie8/sidebar.html
\\Search Page - https://www.google.com/?gws_rd=ssl
\\Local Page - C:\WINDOWS\system32\blank.htm

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
\\CustomizeSearch - https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
\\SearchAssistant - http://www.google.com/toolbar/ie8/sidebar.html

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search]
\\SearchAssistant - http://www.google.com/toolbar/ie8/sidebar.html

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
\\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Microsoft Url Search Hook = C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

>>> BHO's <<<
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - = ()
\{22BF413B-C6D2-4d91-82A9-A0F997BA588C} - Skype add-on (mastermind) = C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL (Skype Technologies S.A.)
\{9030D464-4C02-4ABF-8ECC-5164760863C6} - Windows Live Sign-in Helper = C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
\{AA58ED58-01DD-4d91-8333-CF10577473F7} - Google Toolbar Helper = c:\program files\google\googletoolbar2.dll (Google Inc.)
\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - = ()
\{C451C08A-EC37-45DF-AAAD-18B51AB5E837} - PDFCreator Toolbar Helper = C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll ()

>>> Internet Explorer Bars, Toolbars and Extensions <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
\{4D5C8C25-D075-11d0-B416-00C04FB90376} - &Astuce du jour = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation)

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
\{32683183-48a0-441b-a342-7c2a440a9478} - = ()
\{EFA24E61-B078-11D0-89E4-00C04FC9E26E} - Favorites Band = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation)
\{EFA24E64-B078-11D0-89E4-00C04FC9E26E} - Explorer Band = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up = C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
\\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar = C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll ()
\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google = c:\program files\google\googletoolbar2.dll (Google Inc.)

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
\WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} - &Adresse = %SystemRoot%\System32\browseui.dll (Microsoft Corporation)
\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383} - &Liens = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation)
\WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - = ()
\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar avec bloqueur de fenêtres pop-up = C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
\WebBrowser\\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - PDFCreator Toolbar = C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll ()
\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} - &Google = c:\program files\google\googletoolbar2.dll (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\CmdMapping]
\\NEXTID - 8194
\\{FB5F1910-F110-11d2-BB9E-00C04F795683} - 8193 = Windows Messenger

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
\{77BF5300-1474-4EC7-9980-D32B190E9B07} - ButtonText: Skype =
\{FB5F1910-F110-11d2-BB9E-00C04F795683} - ButtonText: Messenger = C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

>>> Approved Shell Extensions (Non-Microsoft Only) <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
\\{42071714-76d4-11d1-8b24-00a0c9068ff3} - Extension Affichage Panorama du Panneau de configuration = deskpan.dll ()
\\{764BF0E1-F219-11ce-972D-00AA00A14F56} - Extensions de l'environnement de compression de fichiers = ()
\\{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} - Menu contextuel de cryptage = ()
\\{88895560-9AA2-1069-930E-00AA0030EBC8} - Extension icône HyperTerminal = C:\WINDOWS\System32\hticons.dll (Hilgraeve, Inc.)
\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} - Barre des tâches et menu Démarrer = ()
\\{32683183-48a0-441b-a342-7c2a440a9478} - Media Band = ()
\\{7A9D77BD-5403-11d2-8785-2E0420524153} - Comptes d'utilisateurs = ()
\\{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - Shell Extensions for RealOne Player = C:\Program Files\Real\RealOne Player\rpshellext.dll (RealNetworks)
\\{E0D79304-84BE-11CE-9641-444553540000} - WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing LP)
\\{E0D79305-84BE-11CE-9641-444553540000} - WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing LP)
\\{E0D79306-84BE-11CE-9641-444553540000} - WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing LP)
\\{E0D79307-84BE-11CE-9641-444553540000} - WinZip = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing LP)
\\{B41DB860-8EE4-11D2-9906-E49FADC173CA} - WinRAR shell extension = C:\Program Files\WinRAR\rarext.dll ()
\\{FED7043D-346A-414D-ACD7-550D052499A7} - dBpowerAMP Music Converter 1 = ()
\\{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5} - dBpowerAMP Music Converter = ()

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

>>> Context Menu Handlers (Non-Microsoft Only) <<<
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers]
\ewido anti-spyware - {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll (Anti-Malware Development a.s.)
\WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll ()
\WinZip - {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing LP)
\{D653647D-D607-4DF6-A5B8-48D2BA195F7B} - = C:\Program Files\Softwin\BitDefender9\bdshelxt.dll ()

[HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers]

[HKEY_LOCAL_MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers]
\ewido anti-spyware - {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll (Anti-Malware Development a.s.)
\WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll ()
\WinZip - {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing LP)

[HKEY_LOCAL_MACHINE\Software\Classes\Directory\BackGround\shellex\ContextMenuHandlers]

[HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers]
\WinRAR - {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll ()
\WinZip - {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL (WinZip Computing LP)
\{D653647D-D607-4DF6-A5B8-48D2BA195F7B} - = C:\Program Files\Softwin\BitDefender9\bdshelxt.dll ()

>>> Column Handlers (Non-Microsoft Only) <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
\{F9DB5320-233E-11D1-9F84-707F02C10627} - PDF Column Info = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll (Adobe Systems, Inc.)

>>> Registry Run Keys <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
STDSB - C:\WINDOWS\System32\STDSB.exe ()
SoundMan - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
SynTPLpr - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
SynTPEnh - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
NovaNet-WEB Tray Control - C:\Program Files\Packard Bell EverSafe\TrayControl.exe (NovaStor Corporation)
BDMCon - C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe (SOFTWIN S.R.L.)
BDOESRV - C:\Program Files\Softwin\BitDefender9\bdoesrv.exe (SOFTWIN SRL)
BDNewsAgent - c:\progra~1\softwin\bitdef~1\bdnagent.exe (SOFTWIN S.R.L)
BDSwitchAgent - c:\progra~1\softwin\bitdef~1\bdswitch.exe ()
QuickTime Task - C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe (Microsoft Corporation)
Skype - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
updateMgr - C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe ()
ctfmon.exe - C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

>>> Startup Links <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\\Common Startup]
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini ()
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Packard Bell EverSafe Tray Control.lnk - C:\Program Files\Packard Bell EverSafe\TrayControl.exe (NovaStor Corporation)
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\RaConfig2500.lnk - C:\Program Files\RALINK\RT2500 Wireless LAN Card\Installer\WINXP\RaConfig2500.exe (Ralink Technology, Corp.)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\\Startup]
C:\Documents and Settings\Sab\Menu Démarrer\Programmes\Démarrage\desktop.ini ()

>>> MSConfig Disabled Items <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[All Users Startup Folder Disabled Items]

[Current User Startup Folder Disabled Items]

>>> User Agent Post Platform <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

>>> AppInit Dll's <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs]

>>> Image File Execution Options <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
\Your Image File Name Here without a path - Debugger = ntsd -d

>>> Shell Service Object Delay Load <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
\\PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation)
\\CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll (Microsoft Corporation)
\\WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
\\SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll (Microsoft Corporation)

>>> Shell Execute Hooks <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} - URL Exec Hook = shell32.dll (Microsoft Corporation)
\\{57B86673-276A-48B2-BAE7-C6DBB3020EB8} - CShellExecuteHookImpl Object = C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll (Anti-Malware Development a.s.)

>>> Shared Task Scheduler <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
\\{438755C2-A8BA-11D1-B96B-00A0C90312E1} - Pré-chargeur Browseui = %SystemRoot%\System32\browseui.dll (Microsoft Corporation)
\\{8C7461EF-2B13-11d2-BE35-3078302C2030} - Démon de cache des catégories de composant = %SystemRoot%\System32\browseui.dll (Microsoft Corporation)

>>> Winlogon <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
\\UserInit = C:\WINDOWS\system32\userinit.exe,
\\Shell = Explorer.exe
\\System =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
\crypt32chain - crypt32.dll = (Microsoft Corporation)
\cryptnet - cryptnet.dll = (Microsoft Corporation)
\cscdll - cscdll.dll = (Microsoft Corporation)
\ScCertProp - wlnotify.dll = (Microsoft Corporation)
\Schedule - wlnotify.dll = (Microsoft Corporation)
\sclgntfy - sclgntfy.dll = (Microsoft Corporation)
\SensLogn - WlNotify.dll = (Microsoft Corporation)
\termsrv - wlnotify.dll = (Microsoft Corporation)
\wlballoon - wlnotify.dll = (Microsoft Corporation)
\WRNotifier - WRLogonNTF.dll = ()

>>> DNS Name Servers <<<
{138EAD9F-B93A-4720-97E4-B5E60271EFBE} - (Carte Fast Ethernet compatible VIA)
{66BC03F9-1DAC-4F17-8D41-658CA055A669} - (802.11g Wireless LAN CardBus)
{8FAC17F8-A0CF-4D70-BF3D-36543A18B924} - (Carte réseau 1394)
{DFC5E764-8C15-4F0F-85E6-66EFA86B719D} - ()

>>> All Winsock2 Catalogs <<<
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries]
\000000000001\\LibraryPath - %SystemRoot%\System32\mswsock.dll (Microsoft Corporation)
\000000000002\\LibraryPath - %SystemRoot%\System32\winrnr.dll (Microsoft Corporation)
\000000000003\\LibraryPath - %SystemRoot%\System32\mswsock.dll (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries]
\000000000001\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000002\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000003\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000004\\PackedCatalogItem - %SystemRoot%\system32\rsvpsp.dll (Microsoft Corporation)
\000000000005\\PackedCatalogItem - %SystemRoot%\system32\rsvpsp.dll (Microsoft Corporation)
\000000000006\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000007\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000008\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000009\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000010\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000011\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000012\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000013\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000014\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000015\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000016\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)
\000000000017\\PackedCatalogItem - %SystemRoot%\system32\mswsock.dll (Microsoft Corporation)

>>> Protocol Handlers (Non-Microsoft Only) <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler]
\ipp - ()
\msdaipp - ()
\skype4com - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL (Skype Technologies)

>>> Protocol Filters (Non-Microsoft Only) <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter]

>>> Selected AddOn's <<<

»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

J'espère que tu vas y trouver quelque chose d'interessant.

Sabrina

Bonjour,

ras,
refait un scan avec AVG et reposte le rapport
refait un scan chez bitdefender et reposte le rapport

bonjour,

les rapports :

BitDefender :

//-----------------------------------------------------------------
//
// Product: BitDefender 9 Internet Security
// Version: 9.0
//
// Créé le: 16/01/2007 19:19:17
//
//-----------------------------------------------------------------

Statistiques

Chemin cible: C:\
Dossiers : 4682
Fichiers : 307786
Archives : 7109
Fichiers empaquetés : 36353
Virus trouvés : 0
Fichiers infectés : 0
Alertes : 0
Fichiers suspects : 0
Fichiers désinfectés : 0
Fichiers effacés : 0
Fichiers copiés : 0
Fichiers déplacés : 0
Fichiers renommés : 0
Erreurs I/O : 27
Temps d'analyse := 01:44:39
Fichiers/seconde :49

Définitions virus : 400236
Plugins d'analyse : 16
Plugins archives : 41
Plug-ins décompression : 6
Plug-ins messagerie : 6
Plug-ins système : 5

Options d'analyse

Détection
[X] Analyser le secteur de boot
[X] Analyser les archives
[X] Analyser les fichiers en paquets
[X] Analyser la messagerie

Masque fichiers
[ ] Programmes
[X] Tous les fichiers
[ ] Extensions définies par l'utilisateur:
[ ] Exclure les extensions: ;

Action

Objets infectés
[ ] Ignorer
[X] Désinfecter
[ ] Effacer
[ ] Copier
[ ] Déplacer dans le dossier infectés
[ ] Renommer
[ ] Demander l'action

Seconde action
[ ] Ignorer
[ ] Effacer
[ ] Copier
[X] Déplacer dans le dossier infectés
[ ] Renommer
[ ] Demander l'action

Options d'analyse
[X] Activer les alertes
[X] Activer l'heuristique
[ ] Afficher tous les fichiers dans le journal
[X] Fichier journal : C:\Program Files\Softwin\BitDefender9\Logs\vscan_1168971557.log

ewido :

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 02:16:31 17/01/2007

+ Scan result:

C:\Documents and Settings\Sab\Cookies\sab@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@dupont.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@com[1].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@sales.liveperson[1].txt -> TrackingCookie.Liveperson : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).
C:\Documents and Settings\Sab\Cookies\sab@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).

::Report end

La fonction redémarrer à refonctionner un instant aujourd hui et ne fonctionne plus de nouveau.
Je ne comprends vraiment pas d'où ca peut venir et franchement ca commence limite à m'inquiéter.

J'ai remarqué aussi que mon ordi peut se bloquer sans raison apparente mais il le fait aussi au moindre petit choc (une pichenette lui suffit emplement à se bloquer). c'est possible qu'un truc là dedans ne soit plus bien à sa place et court circuite le tout ??

je dis peut etre des conneries ... j'essaye simplement de faire avancer le chmilblique et de sauver cet appareil auquel je tiens tant !

merci en tt cas pr prendre le tps de lire ts ces rapports indigestes.

Sabrina

Bonjour,

je me demande si c'est un problème infectieux, tout a l'air propre maintenant

Bonjour,

on va dire qu on en reste là parce je t avoue que j'ai aussi cru comprendre des derniers rapports que tt était ok... au prochain pb, mon petit pc part en réparation ...

juste une dernière question qui me turlupine : tu bosses pr commentcamarche.com? j'ai fait ce genre de truc pr ebay qd j'habitais à barcelone (on me turait si on savait que je balance que ebay est à barca ... ainsi que télé2, expedia ... oups j'en dis trop !) dc j'aime bien comprendre comment marchent ce genre de boites maintenant .... Si c'est pas le cas, merci pr ton tps que tu donnes aux petits novices comme moi !!

Bonne route.
Sab

les mistères de l'informatique ... pas de blocage de l'ordi depuis 2 jours ... wouhou !

Bonsoir,

ravie d'apprendre que ton pc se porte bien. Croisons les doigts.

pour répondre à ta question, ici, nous ne sommes que des bénévoles.

bonne soirée