[trojan] trojan clicker.cm

Résolu
jefff78370 -  
 gino -
bonsoir j ais un soucis avec un trojan je n arrive pas a l enlever si quelqu un pouvait m aider merci
Virus Statistics

Scan path : C:\
Folders : 3035
Files : 207635
Archives : 3885
Packed files : 16954
Identified viruses : 1
Infected files : 2
Warnings : 0
Suspect files : 0
Disinfected files : 0
Deleted files : 0
Copied files : 0
Moved files : 2
Renamed files : 0
I/O errors : 36
Scan time : 00:29:09
Scan speed (files/sec) : 118

Spyware Statistics

Memory processes scanned : 37
Memory processes infected : 0
Registry keys scanned : 1724
Registry keys infected : 0
Cookies scanned : 493
Cookies infected : 0
Spyware files infected : 0
Spyware threats detected : 0

Virus definitions : 562360
Scan plugins : 16
Archive plugins : 41
Unpack plugins : 6
Mail plugins : 6
System plugins : 5

Virus scan options

Detection
[X] Scan boot sectors
[X] Scan archives
[X] Scan packed files
[X] Scan email

File mask
[ ] Programs
[X] All files
[ ] User defined extensions:
[ ] Exclude extensions: ;

Action

Infected objects
[ ] Ignore
[X] Disinfect
[ ] Delete
[ ] Copy to quarantine
[ ] Move to quarantine
[ ] Rename
[ ] Prompt user

Second action
[ ] Ignore
[ ] Delete
[ ] Copy to quarantine
[X] Move to quarantine
[ ] Rename
[ ] Prompt user

Virus scan options
[X] Enable warnings
[X] Enable heuristics
[ ] Show all files in log
[X] Report file: C:\Program Files\Softwin\BitDefender9\Logs\vscan_1182184316.log

Spyware scan options

[X] Memory Processes
[X] Registry keys
[X] Cookies

Summary:

C:\Documents and Settings\dragon\Local Settings\Temporary Internet Files\Content.IE5\O789ABCD\popup[1].htm Infected: Trojan.Clicker.CM
C:\Documents and Settings\dragon\Local Settings\Temporary Internet Files\Content.IE5\O789ABCD\popup[1].htm Disinfection failed
C:\Documents and Settings\dragon\Local Settings\Temporary Internet Files\Content.IE5\O789ABCD\popup[1].htm Moved
C:\Documents and Settings\dragon\Local Settings\Temporary Internet Files\Content.IE5\Y769QVKX\popup[1].1 Infected: Trojan.Clicker.CM
C:\Documents and Settings\dragon\Local Settings\Temporary Internet Files\Content.IE5\Y769QVKX\popup[1].1 Disinfection failed
C:\Documents and Settings\dragon\Local Settings\Temporary Internet Files\Content.IE5\Y769QVKX\popup[1].1 Moved
avec hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 19:23:05, on 18/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Softwin\BitDefender9\bdoesrv.exe
C:\program files\softwin\bitdefender9\bdnagent.exe
C:\program files\softwin\bitdefender9\bdswitch.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\themeGold55\CursorXP\CursorXP.exe
C:\valve\steam\steam.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\PyGrenouille\pygrenouille.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
c:\program files\softwin\bitdefender9\bdmcon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\dragon\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Windows Tilehome] Tilehome.com
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunServices: [Windows Tilehome] Tilehome.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\themeGold55\CursorXP\CursorXP.exe -s
O4 - HKCU\..\Run: [Steam] "c:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: PyGrenouille.lnk = C:\Program Files\PyGrenouille\pygrenouille.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://casinoclassic.microgaming.com/casinoclassic/FlashAX2.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

j ais aussi un probleme a l ouverture d une page internet j ais une perte de connection je suis obliger de rafraichire pour pouvoir voir le site merci de votre aide
Configuration: Windows XP
Internet Explorer 6.0

21 réponses

  • 1
  • 2
  1. Utilisateur anonyme
     
    Bonjour

    - ton pare-feu est inclu dans Bitdefender ?

    ***

    ¤ Fais ce nettoyage: à faire réguliérement

    *Télécharge et installe CCleaner (n'installe pas la barre d'outil Yahoo)
    ---> http://www.infos-du-net.com/telecharger/CCleaner,0301-1039.html

    - Dans la colonne de gauche clic sur "erreurs" coches toutes les cases, puis clic en bas sur "chercher des erreurs" une fois terminé, clic sur "reparer les erreurs" et tu auras un message pour sauvegarder ta base de registre tu clic "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs.
    Les sauvegardes que tu aura faites, tu pourras les supprimer si ton ordinateur n'a plus de problémes.

    - Relance Ccleaner, vas dans l'onglet "nettoyeur" présent sur la gauche, decoches la derniere case (Avancé si elle est cochée) puis clic sur "lancer le nettoyage"

    Si tu as besoin d'aide avec Ccleaner, regarde ce tutoriel :
    http://redir.fr/gmll

    ET

    Télécharge ComboScan sur ton Bureau.
    ---> http://www.techsupportforum.com/sectools/Deckard/dss.exe
    Ferme toutes les applications en cours ; antivirus, pare-feu, etc ..
    Double-clic sur comboscan.exe A la fenêtre qui s'affiche, clic sur OK.
    Soit patient ..
    Le rapport Comboscan.txt s'affichera, copie et colle le contenu de ce fichier ici.
    Attention, il peut avoir deux, trois rapports mets les tous ici stp
    0
  2. jefff78370
     
    bonsoir merci de ta reponse voila le resultat
    Deckard's System Scanner v20070611.50
    Run by dragon on 2007-06-18 at 21:47:53
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- HijackThis (run as dragon.exe) ----------------------------------------------

    Logfile of HijackThis v1.99.1
    Scan saved at 21:47:54, on 18/06/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
    C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
    C:\Program Files\Softwin\BitDefender9\vsserv.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\dragon\Bureau\dss.exe
    C:\DOCUME~1\dragon\Bureau\dragon.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
    O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
    O4 - HKLM\..\Run: [BDOESRV] "C:\Program Files\Softwin\BitDefender9\bdoesrv.exe"
    O4 - HKLM\..\Run: [BDNewsAgent] "c:\program files\softwin\bitdefender9\bdnagent.exe"
    O4 - HKLM\..\Run: [BDSwitchAgent] "c:\program files\softwin\bitdefender9\bdswitch.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\RunServices: [Windows Tilehome] Tilehome.com
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game08.zylom.com/activex/zylomgamesplayer.cab
    O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://gamenextfr.oberon-media.com/online/online2/diner_dash/DinerDash.1.0.0.80.cab
    O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://casinoclassic.microgaming.com/casinoclassic/FlashAX2.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
    O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

    -- Files created between 2007-05-18 and 2007-06-18 -----------------------------

    2007-06-18 21:37:46 0 dr-h----- C:\Documents and Settings\dragon\Recent
    2007-06-18 21:20:32 0 d-------- C:\Program Files\CCleaner
    2007-06-18 19:45:02 3524 --a------ C:\WINDOWS\system32\tmp.reg
    2007-06-18 19:44:06 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
    2007-06-18 19:44:06 51200 --a------ C:\WINDOWS\system32\dumphive.exe
    2007-06-18 19:12:09 0 d-------- C:\!KillBox
    2007-06-18 16:30:58 0 d-------- C:\Documents and Settings\dragon\Application Data\Grisoft
    2007-06-18 16:30:48 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-06-18 16:14:12 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-06-18 15:52:03 0 d-------- C:\Program Files\AxBx
    2007-06-16 13:25:17 0 d-------- C:\Program Files\Windows Media Connect 2
    2007-06-16 13:24:16 0 d-------- C:\21d6bdbb9d6a5b467a16
    2007-06-16 13:24:11 0 d-------- C:\WINDOWS\system32\LogFiles
    2007-06-16 13:24:11 0 d-------- C:\WINDOWS\system32\drivers\UMDF
    2007-06-16 13:23:41 0 d-------- C:\26e7fbc620155a361ccac4c416bdfe
    2007-06-13 00:35:00 0 d-------- C:\Program Files\messenger
    2007-06-13 00:34:00 0 d-------- C:\WINDOWS\provisioning
    2007-06-13 00:27:15 0 d-------- C:\WINDOWS\ServicePackFiles
    2007-06-13 00:14:54 0 d-------- C:\WINDOWS\EHome
    2007-06-13 00:03:52 0 d-------- C:\WINDOWS\system32\appmgmt
    2007-06-12 22:50:21 0 d-------- C:\WINDOWS\BDOSCAN8
    2007-06-08 17:29:42 0 d-------- C:\Program Files\Navilog1
    2007-06-08 16:54:08 0 d--hs---- C:\WINDOWS\CSC
    2007-06-05 21:08:59 81984 --a------ C:\WINDOWS\system32\bdod.bin
    2007-06-05 20:16:15 0 d-------- C:\Documents and Settings\dragon\.housecall6.6
    2007-06-05 20:03:11 14 --a------ C:\WINDOWS\system32\getfile.dat
    2007-06-05 19:56:48 0 d-------- C:\Program Files\Fichiers communs\Softwin
    2007-05-29 17:09:44 0 d-------- C:\Program Files\QuickPar
    2007-05-29 14:12:36 1176 --a------ C:\WINDOWS\ImpTableL.bin
    2007-05-25 22:39:31 0 d-------- C:\Program Files\Maketorrent 2
    2007-05-25 16:27:12 0 d-------- C:\Program Files\Casino Classic Flash Casino
    2007-05-25 16:27:10 0 d-------- C:\WINDOWS\system32\FlashAX2
    2007-05-25 16:11:46 0 d-------- C:\WINDOWS\system32\FlashAX
    2007-05-24 21:56:08 0 d-------- C:\Program Files\PyGrenouille
    2007-05-24 21:23:19 0 d-------- C:\Documents and Settings\dragon\Application Data\Google
    2007-05-24 21:12:41 0 d-------- C:\WINDOWS\Sun
    2007-05-24 21:12:41 0 d-------- C:\Documents and Settings\dragon\Application Data\Sun
    2007-05-24 21:11:45 0 d-------- C:\Program Files\Google
    2007-05-24 21:11:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Google
    2007-05-24 21:11:22 0 d-------- C:\Program Files\Java
    2007-05-24 21:09:33 0 d-------- C:\Program Files\Fichiers communs\Java
    2007-05-23 19:08:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Zylom

    -- Find3M Report ---------------------------------------------------------------

    2007-06-17 22:13:59 0 d-------- C:\Program Files\3DBELOTE
    2007-06-17 22:06:29 0 d-------- C:\Documents and Settings\dragon\Application Data\GrabIt
    2007-06-15 19:34:57 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
    2007-06-15 18:17:21 0 d-------- C:\Documents and Settings\dragon\Application Data\AdobeUM
    2007-06-14 09:33:48 0 d-------- C:\Documents and Settings\dragon\Application Data\uTorrent
    2007-06-14 00:36:21 0 d-------- C:\Program Files\MSN Messenger
    2007-06-13 00:48:49 461364 --a------ C:\WINDOWS\system32\perfh00C.dat
    2007-06-13 00:48:49 72274 --a------ C:\WINDOWS\system32\perfc00C.dat
    2007-06-13 00:34:03 0 d-------- C:\Program Files\movie maker
    2007-06-13 00:26:20 0 d-------- C:\Program Files\Windows NT
    2007-06-13 00:26:08 0 d-------- C:\Program Files\Fichiers communs\System
    2007-06-08 13:59:22 21840 --a-----t C:\WINDOWS\system32\SIntfNT.dll
    2007-06-08 13:59:22 17212 --a-----t C:\WINDOWS\system32\SIntf32.dll
    2007-06-08 13:59:22 12067 --a-----t C:\WINDOWS\system32\SIntf16.dll
    2007-06-05 20:03:44 461 --a------ C:\Program Files\INSTALL.LOG
    2007-06-05 19:56:48 0 d-------- C:\Program Files\Fichiers communs
    2007-05-17 23:52:12 0 d-------- C:\Program Files\GrabIt
    2007-05-17 09:45:44 723 --a------ C:\raztwtspro.exe
    2007-05-14 13:00:23 0 d-------- C:\Program Files\Won
    2007-05-14 13:00:23 0 d-------- C:\Program Files\Sierra On-Line
    2007-05-11 20:18:06 1101904 --a------ C:\WINDOWS\vsapi32.dll <Not Verified; Trend Micro Inc.; VSAPI>
    2007-05-11 20:18:06 86094 --a------ C:\WINDOWS\BPMNT.dll <Not Verified; Trend Micro Inc.; VSAPI>
    2007-05-11 16:37:00 267845 --a------ C:\WINDOWS\tsc.exe <Not Verified; Trend Micro Inc.; TrendSystemCleaner>
    2007-05-11 16:37:00 71749 --a------ C:\WINDOWS\hcextoutput.dll
    2007-05-11 16:36:37 507904 --a------ C:\WINDOWS\TMUPDATE.DLL <Not Verified; Trend Micro Inc.; ActiveUpdate Module>
    2007-05-11 16:36:36 69689 --a------ C:\WINDOWS\UNZIP.DLL <Not Verified; Trend Micro Inc.; Trend Active Update 1.32>
    2007-05-11 16:36:36 286720 --a------ C:\WINDOWS\PATCH.EXE <Not Verified; Trend Micro Inc.; ActiveUpdate Module>
    2007-05-11 16:23:36 828 --a------ C:\neroV1.exe
    2007-05-11 16:19:17 828 --a------ C:\neroV2.exe
    2007-04-29 23:39:52 0 d-------- C:\Program Files\ImTOO
    2007-04-18 19:36:04 0 d-------- C:\Program Files\Intel
    2007-04-18 19:32:25 0 d-------- C:\Program Files\Fichiers communs\InstallShield
    2007-04-18 19:24:19 0 d-------- C:\Program Files\HardwareDetection
    2007-04-09 17:55:36 62 --ahs---- C:\Documents and Settings\dragon\Application Data\desktop.ini
    2007-04-09 17:15:34 30 --a------ C:\AUTOEXEC.BAT
    2007-04-09 17:12:55 5920 --a------ C:\plus.reg
    2007-04-09 16:59:57 0 -rahs---- C:\MSDOS.SYS
    2007-04-09 16:59:57 0 -rahs---- C:\IO.SYS
    2007-04-09 16:59:57 0 --a------ C:\CONFIG.SYS
    2007-04-09 16:58:10 21892 --a------ C:\WINDOWS\system32\emptyregdb.dat

    -- Registry Dump ---------------------------------------------------------------

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
    "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
    "nwiz"="nwiz.exe /install"
    "HPHmon04"="C:\\WINDOWS\\System32\\hphmon04.exe"
    "HPHUPD04"="\"C:\\Program Files\\HP Photosmart 11\\hphinstall\\UniPatch\\hphupd04.exe\""
    "Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
    "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
    "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe"
    "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
    "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
    "BDMCon"="\"C:\\Program Files\\Softwin\\BitDefender9\\bdmcon.exe\""
    "BDOESRV"="\"C:\\Program Files\\Softwin\\BitDefender9\\bdoesrv.exe\""
    "BDNewsAgent"="\"c:\\program files\\softwin\\bitdefender9\\bdnagent.exe\""
    "BDSwitchAgent"="\"c:\\program files\\softwin\\bitdefender9\\bdswitch.exe\""
    "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
    "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
    "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
    "Windows Tilehome"="Tilehome.com"

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"=dword:00000000

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"=dword:00000001
    "NoLowDiskSpaceChecks"=dword:00000001
    "NoLowDiskSpaceCheck"=dword:00000001
    "NoCDBurning"=dword:00000001

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"=dword:00000001
    "NoLowDiskSpaceChecks"=dword:00000001
    "NoLowDiskSpaceCheck"=dword:00000001
    "NoCDBurning"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "appinit_dlls"="sockspy.dll"

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
    Authentication Packages REG_MULTI_SZ msv1_0\0\0
    Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
    Notification Packages REG_MULTI_SZ scecli\0\0

    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver
    HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
    LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
    NetworkService REG_MULTI_SZ DnsCache\0\0
    rpcss REG_MULTI_SZ RpcSs\0\0
    imgsvc REG_MULTI_SZ StiSvc\0\0
    termsvcs REG_MULTI_SZ TermService\0\0
    HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
    DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
    WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

    -- End of Deckard's System Scanner: finished at 2007-06-18 at 21:48:22 ---------
    0
  3. jefff78370
     
    Deckard's System Scanner v20070611.50
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Professionnel (build 2600) SP 2.0
    Architecture: X86; Language: French

    CPU 0: Intel(R) Pentium(R) 4 CPU 3.20GHz
    CPU 1: Intel(R) Pentium(R) 4 CPU 3.20GHz
    Percentage of Memory in Use: 34%
    Physical Memory (total/avail): 1023.23 MiB / 668.78 MiB
    Pagefile Memory (total/avail): 1436.96 MiB / 1195.69 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1965.61 MiB

    A: is Removable (No Media)
    C: is Fixed (NTFS) - 149.04 GiB total, 129.33 GiB free.
    D: is CDROM (No Media)
    E: is CDROM (No Media)

    -- Security Center -------------------------------------------------------------

    AUOptions is disabled.
    Windows Internal Firewall is enabled.

    FW: BitDefender 9 Professional Plus v7.2 (Softwin)
    AV: BitDefender 9 Professional Plus v7.2 (Softwin)

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\\Valve\\Steam\\steamapps\\polak78370\\counter-strike\\hl.exe"="C:\\Valve\\Steam\\steamapps\\polak78370\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:µTorrent"
    "C:\\Valve\\Steam\\steamapps\\polak78370\\condition zero\\hl.exe"="C:\\Valve\\Steam\\steamapps\\polak78370\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"

    -- Environment Variables -------------------------------------------------------

    absent=absent !
    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\dragon\Application Data
    audesktop=C:\DOCUME~1\ALLUSE~1\Bureau
    aufavorites=C:\DOCUME~1\ALLUSE~1\Favoris
    austartm=C:\DOCUME~1\ALLUSE~1\MENUDM~1
    austartprg=C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1
    austartup=C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1
    chemin=C:\Program Files\navilog1
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Fichiers communs
    comptreg=0
    COMPUTERNAME=TEST
    ComSpec=C:\WINDOWS\system32\cmd.exe
    cop=Copie
    dans=dans
    desktop=C:\DOCUME~1\dragon\Bureau
    dossback=vers dossier Backupnavi
    dossier=dossiers
    dupli=réalise avec succes !
    echec=Echec
    errsup=!!ERREUR SUPPRESSION!!
    favorites=C:\DOCUME~1\dragon\Favoris
    fichier=fichiers
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\dragon
    langue=fra
    LOGONSERVER=\\TEST
    modechec=Executé en mode sans échec
    modnormal=Executé en mode normal
    non=non
    NUMBER_OF_PROCESSORS=2
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    patient=Veuillez patienter
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 3, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0403
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    rapp=Rapport réalisé le
    reche=Recherche
    rechin=Recherche dans
    rechter=Recherche terminee
    SESSIONNAME=Console
    smiseajour=08.06.2007 a 17h00
    sourcesdk=c:\valve\steam\steamapps\polak78370\sourcesdk
    ssupp=supprimé !
    startm=C:\DOCUME~1\dragon\MENUDM~1
    startprg=C:\DOCUME~1\dragon\MENUDM~1\PROGRA~1
    startup=C:\DOCUME~1\dragon\MENUDM~1\PROGRA~1\DMARRA~1
    strouv=trouvé !
    supdos=Suppression
    sver=version 2.0.3
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\dragon\LOCALS~1\Temp
    tentsup=...suppression...
    TMP=C:\DOCUME~1\dragon\LOCALS~1\Temp
    USERDOMAIN=TEST
    USERNAME=dragon
    USERPROFILE=C:\Documents and Settings\dragon
    var=S-1-5-21-789336058-1979792683-682003330-1003
    VProject=c:\valve\steam\steamapps\polak78370\half-life 2\hl2
    windir=C:\WINDOWS

    -- User Profiles ---------------------------------------------------------------

    dragon [I](admin)[/I]
    Administrateur [I](admin)[/I]

    -- Add/Remove Programs ---------------------------------------------------------

    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
    Adobe Flash Player Plugin --> C:\WINDOWS\System32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 6.0.1 - Français --> MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A00000000001}
    Archiveur WinRAR --> C:\Program Files\WinRAR\uninstall.exe
    µTorrent --> "C:\Program Files\uTorrent\uninstall.exe"
    AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
    BitDefender 9 Professional Plus --> MsiExec.exe /I{0F7F74EE-0EB4-4133-A9C4-C242C6EFD087}
    C-Media High Definition Audio Driver --> C:\WINDOWS\system32\cmirmdrv.exe
    CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
    CleanUp! --> C:\Program Files\CleanUp!\uninstall.exe
    Condition Zero --> "C:\valve\steam\steam.exe" steam://uninstall/80
    Condition Zero Deleted Scenes --> "C:\valve\steam\steam.exe" steam://uninstall/100
    Counter-Strike --> "C:\valve\steam\steam.exe" steam://uninstall/10
    Counter-Strike: Condition Zero --> C:\Valve\CONDIT~1\UNWISE.EXE C:\Valve\CONDIT~1\INSTALL.LOG
    CursorXP --> C:\themeGold55\CursorXP\CurXPUtil.exe -u
    Dedicated Server --> "C:\valve\steam\steam.exe" steam://uninstall/5
    GrabIt 1.7.1 Beta (build 960) --> "C:\Program Files\GrabIt\unins000.exe"
    Half-Life 2 --> "C:\Valve\Steam\steam.exe" steam://uninstall/220
    Half-Life 2: Lost Coast --> "C:\Valve\Steam\steam.exe" steam://uninstall/340
    HardwareDetection --> "C:\Program Files\HardwareDetection\Uninstall.exe" "C:\Program Files\HardwareDetection\install.log" -u
    HijackThis 1.99.1 --> C:\Documents and Settings\dragon\Bureau\HijackThis.exe /uninstall
    HP Photo and Imaging 1.0 - HP Photosmart Printer Series --> MsiExec.exe /I{0D396571-7BBD-44CE-ABB3-518BF86B72F7}
    Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
    Jeux pour tous - Tarot --> C:\WINDOWS\IsUn040c.exe -f"C:\Sierra\Jeux pour tous\Tarot\Uninst.isu"
    KiddiesBarre 1.0 --> "C:\Program Files\KiddiesBarre\unins000.exe"
    MakeTorrent v2.1 --> "C:\Program Files\Maketorrent 2\uninstall.exe"
    Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
    Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
    Mozilla Firebird --> "C:\Program Files\Mozilla.org\Firebird\Uninstall-MozillaFirebird.exe"
    Multi Virus Cleaner 2007 --> "C:\Program Files\AxBx\Multi Virus Cleaner 2007\unins000.exe"
    Navilog1 Version 2.0.3 --> "C:\Program Files\Navilog1\uninstall.exe"
    Nero 6 Ultra Edition --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
    NVIDIA Drivers --> C:\WINDOWS\System32\nvudisp.exe UninstallGUI
    Photosmart 130,230,7150,7345,7350,7550 (Remove only) --> C:\Program Files\HP Photosmart 11\Printer\hphuni04.exe
    PyGrenouille version 1.11 --> "C:\Program Files\PyGrenouille\unins000.exe"
    QuickPar 0.9 --> C:\Program Files\QuickPar\uninst.exe
    Shockwave --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Source Dedicated Server --> "C:\valve\steam\steam.exe" steam://uninstall/205
    Source SDK --> "C:\valve\steam\steam.exe" steam://uninstall/211
    Source SDK Base --> "C:\valve\steam\steam.exe" steam://uninstall/215
    Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
    Steam --> C:\Valve\Steam\UNWISE.EXE C:\Valve\Steam\INSTALL.LOG
    Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe"
    Windows Live Messenger --> MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
    Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"

    -- End of Deckard's System Scanner: finished at 2007-06-18 at 21:40:43 ---------

    Directories/Files moved to C:\Deckard\System Scanner\backup

    2004-12-07 17:07:08 32 --a------ C:\WINDOWS\Downloaded Program Files\bdcore.dll
    2006-05-25 01:21:00 118784 --a------ C:\WINDOWS\Downloaded Program Files\bdupd.dll
    2006-03-31 15:30:34 145000 --a------ C:\WINDOWS\Downloaded Program Files\DinerDash.1.0.0.80.dll <Verified; PlayFirst, Inc.; DinerDash.1.0.0.80>
    2006-05-25 01:21:14 53248 --a------ C:\WINDOWS\Downloaded Program Files\ipsupd.dll
    2004-12-07 17:07:08 32 --a------ C:\WINDOWS\Downloaded Program Files\libfn.dll
    2006-08-29 14:17:22 161976 --a------ C:\WINDOWS\Downloaded Program Files\zylomgamesplayer.dll <Verified; Zylom Games; Zylom Games Player>
    2006-06-01 02:54:16 471040 --a------ C:\WINDOWS\Downloaded Program Files\oscan8.ocx <Not Verified; SOFTWIN; bdscanonline>
    2006-05-31 04:15:16 10 --a------ C:\WINDOWS\Downloaded Program Files\oscan81.ocx_x
    2005-11-02 18:07:08 435712 --a------ C:\WINDOWS\Downloaded Program Files\xscan53.ocx <Not Verified; Trend Micro Inc.; Trend Micro HouseCall v5.70.0>

    -*- End of Logfile -*-
    0
  4. Utilisateur anonyme
     
    Rends toi sur se site
    http://www.virustotal.com/en/virustotalx.html

    En haut à droite clic sur "choisir"
    Tu vas dans C:, windows, tu cherches le processus ci-dessous et tu clic sur "ouvrir"

    C:\raztwtspro.exe

    dès que c'est fait, clic sur "send"
    Tu attends un peu qu'il analyse ton fichier ça peut duré plusieurs minutes et colle le rapport ici une fois qu'il a terminé stp

    Fais la même chose avec ceux là :

    C:\neroV1.exe
    C:\neroV2.exe
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. jefff78370
     
    bonjours j ais un soucis je sais pas si c est normal mais il me stop mon scan des que j ais un scan je le met en tout cas merci de ton aide
    0
  7. jefff78370
     
    Service is stopped in this moments. Scanning of your sample has not been finalized and results has been lost. If you wish to scan it, please send it again.
    0
  8. jefff78370
     
    STATUS: FINISHEDComplete scanning result of "raztwtspro.exe", received in VirusTotal at 06.19.2007, 16:00:02 (CET).

    Antivirus Version Update Result
    AhnLab-V3 2007.6.16.0 06.19.2007 no virus found
    AntiVir 7.4.0.34 06.19.2007 no virus found
    Authentium 4.93.8 06.18.2007 no virus found
    Avast 4.7.997.0 06.19.2007 no virus found
    AVG 7.5.0.467 06.18.2007 no virus found
    BitDefender 7.2 06.19.2007 no virus found
    CAT-QuickHeal 9.00 06.18.2007 no virus found
    ClamAV devel-20070416 06.19.2007 no virus found
    DrWeb 4.33 06.19.2007 no virus found
    eSafe 7.0.15.0 06.19.2007 no virus found
    eTrust-Vet 30.7.3727 06.19.2007 no virus found
    Ewido 4.0 06.19.2007 no virus found
    FileAdvisor 1 06.19.2007 no virus found
    Fortinet 2.91.0.0 06.19.2007 no virus found
    F-Prot 4.3.2.48 06.18.2007 no virus found
    F-Secure 6.70.13030.0 06.19.2007 no virus found
    Ikarus T3.1.1.8 06.19.2007 no virus found
    Kaspersky 4.0.2.24 06.19.2007 no virus found
    McAfee 5055 06.18.2007 no virus found
    Microsoft 1.2607 06.19.2007 no virus found
    NOD32v2 2338 06.19.2007 no virus found
    Norman 5.80.02 06.19.2007 no virus found
    Panda 9.0.0.4 06.19.2007 no virus found
    Sophos 4.18.0 06.12.2007 no virus found
    Sunbelt 2.2.907.0 06.16.2007 no virus found
    Symantec 10 06.19.2007 no virus found
    TheHacker 6.1.6.134 06.18.2007 no virus found
    VBA32 3.12.0.2 06.19.2007 no virus found
    VirusBuster 4.3.23:9 06.18.2007 no virus found
    Webwasher-Gateway 6.0.1 06.19.2007 no virus found

    Aditional Information
    File size: 723 bytes
    MD5: f75a060f25225d1c920f85a946818301
    SHA1: 42deb92e7041c0b02e6900b1d23419fc4eb579aa

    VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

    STATUS: FINISHEDComplete scanning result of "neroV1.exe", received in VirusTotal at 06.19.2007, 16:07:43 (CET).

    Antivirus Version Update Result
    AhnLab-V3 2007.6.16.0 06.19.2007 no virus found
    AntiVir 7.4.0.34 06.19.2007 no virus found
    Authentium 4.93.8 06.18.2007 no virus found
    Avast 4.7.997.0 06.19.2007 no virus found
    AVG 7.5.0.467 06.18.2007 no virus found
    BitDefender 7.2 06.19.2007 no virus found
    CAT-QuickHeal 9.00 06.18.2007 no virus found
    ClamAV devel-20070416 06.19.2007 no virus found
    DrWeb 4.33 06.19.2007 no virus found
    eSafe 7.0.15.0 06.19.2007 no virus found
    eTrust-Vet 30.7.3727 06.19.2007 no virus found
    Ewido 4.0 06.19.2007 no virus found
    FileAdvisor 1 06.19.2007 no virus found
    Fortinet 2.91.0.0 06.19.2007 no virus found
    F-Prot 4.3.2.48 06.18.2007 no virus found
    F-Secure 6.70.13030.0 06.19.2007 no virus found
    Ikarus T3.1.1.8 06.19.2007 no virus found
    Kaspersky 4.0.2.24 06.19.2007 no virus found
    McAfee 5055 06.18.2007 no virus found
    Microsoft 1.2607 06.19.2007 no virus found
    NOD32v2 2338 06.19.2007 no virus found
    Norman 5.80.02 06.19.2007 no virus found
    Panda 9.0.0.4 06.19.2007 no virus found
    Sophos 4.18.0 06.12.2007 no virus found
    Sunbelt 2.2.907.0 06.16.2007 no virus found
    Symantec 10 06.19.2007 no virus found
    TheHacker 6.1.6.134 06.18.2007 no virus found
    VBA32 3.12.0.2 06.19.2007 no virus found
    VirusBuster 4.3.23:9 06.18.2007 no virus found
    Webwasher-Gateway 6.0.1 06.19.2007 no virus found

    Aditional Information
    File size: 828 bytes
    MD5: b81fac6a992b08991ffb1730ffcf3277
    SHA1: c1de866d94b5dff86e4b0aa80853512611acf759

    VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

    STATUS: FINISHEDComplete scanning result of "neroV2.exe", received in VirusTotal at 06.19.2007, 16:17:09 (CET).

    Antivirus Version Update Result
    AhnLab-V3 2007.6.16.0 06.19.2007 no virus found
    AntiVir 7.4.0.34 06.19.2007 no virus found
    Authentium 4.93.8 06.18.2007 no virus found
    Avast 4.7.997.0 06.19.2007 no virus found
    AVG 7.5.0.467 06.18.2007 no virus found
    BitDefender 7.2 06.19.2007 no virus found
    CAT-QuickHeal 9.00 06.19.2007 no virus found
    ClamAV devel-20070416 06.19.2007 no virus found
    DrWeb 4.33 06.19.2007 no virus found
    eSafe 7.0.15.0 06.19.2007 no virus found
    eTrust-Vet 30.7.3727 06.19.2007 no virus found
    Ewido 4.0 06.19.2007 no virus found
    FileAdvisor 1 06.19.2007 no virus found
    Fortinet 2.91.0.0 06.19.2007 no virus found
    F-Prot 4.3.2.48 06.18.2007 no virus found
    F-Secure 6.70.13030.0 06.19.2007 no virus found
    Ikarus T3.1.1.8 06.19.2007 no virus found
    Kaspersky 4.0.2.24 06.19.2007 no virus found
    McAfee 5055 06.18.2007 no virus found
    Microsoft 1.2607 06.19.2007 no virus found
    NOD32v2 2338 06.19.2007 no virus found
    Norman 5.80.02 06.19.2007 no virus found
    Panda 9.0.0.4 06.19.2007 no virus found
    Prevx1 V2 06.19.2007 no virus found
    Sophos 4.18.0 06.12.2007 no virus found
    Sunbelt 2.2.907.0 06.09.2007 no virus found
    Symantec 10 06.19.2007 no virus found
    TheHacker 6.1.6.134 06.18.2007 no virus found
    VBA32 3.12.0.2 06.19.2007 no virus found
    VirusBuster 4.3.23:9 06.18.2007 no virus found
    Webwasher-Gateway 6.0.1 06.19.2007 no virus found

    Aditional Information
    File size: 828 bytes
    MD5: b81fac6a992b08991ffb1730ffcf3277
    SHA1: c1de866d94b5dff86e4b0aa80853512611acf759

    VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
    0
  9. Utilisateur anonyme
     
    Oki, c'est correct.

    Vas dans ajouter/supprimer des programmes et désinstalle : Navilog1 et Multi Virus Cleaner 2007 (inutile ton anti-virus et à jour je suppose)

    ¤ Ad-Aware SE Personal : gratuit en anglais disponible en français voir tutoriel
    ----> https://www.clubic.com/telecharger-fiche12797-ad-aware-free-antivirus.html (prends la version 1.06 pas l'autre)

    Si tu as besoin d'aide pour Ad-aware regarde ce tutoriel :
    --> http://redir.fr/gfll

    Et

    Fais ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X; la barre anti-popup du SP2(en haut) va se mettre à clignoter, clique dessus et choisit "accepter l'active X" pour faire fonctionner le scan anti-virus.
    Une fois qu'il a terminé colle le rapport ici stp

    ---> https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

    - Démarrer Online Scanner
    - Accept
    - Scanne complétement ton (tes) disques dur
    0
  10. jefff78370
     
    voila

    C:\Documents and Settings\dragon\Mes documents\$^$$.html
    0
  11. jefff78370
     
    Tuesday, June 19, 2007 10:30:39 PM
    Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version : 5.0.83.0
    Dernière mise à jour de la base antivirus Kaspersky : 19/06/2007
    Enregistrements dans la base antivirus Kaspersky : 327785

    Paramètres d'analyse
    Analyser avec la base antivirus suivante standard
    Analyser les archives vrai
    Analyser les bases de messagerie vrai

    Cible de l'analyse Poste de travail
    A:\
    C:\
    D:\
    E:\

    Statistiques de l'analyse
    Total d'objets analysés 53552
    Nombre de virus trouvés 0
    Nombre d'objets infectés 0 / 0
    Nombre d'objets suspects 0
    Durée de l'analyse 00:36:56

    Nom de l'objet infecté Nom du virus Dernière action
    C:\Documents and Settings\dragon\Cookies\index.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Messenger\jefff83@hotmail.com\SharingMetadata\Logs\Dfsr00005.log L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Messenger\jefff83@hotmail.com\SharingMetadata\pending.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Messenger\jefff83@hotmail.com\SharingMetadata\Working\database_1332_766A_960C_8759\dfsr.db L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Messenger\jefff83@hotmail.com\SharingMetadata\Working\database_1332_766A_960C_8759\fsr.log L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Messenger\jefff83@hotmail.com\SharingMetadata\Working\database_1332_766A_960C_8759\fsrtmp.log L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Messenger\jefff83@hotmail.com\SharingMetadata\Working\database_1332_766A_960C_8759\tmp.edb L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Windows Live Contacts\jefff83@hotmail.com\real\members.stg L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Application Data\Microsoft\Windows Live Contacts\jefff83@hotmail.com\shadow\members.stg L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Historique\History.IE5\MSHist012007061920070620\index.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Temp\~DF28D2.tmp L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Temp\~DF2A8D.tmp L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Temp\~DFB6B9.tmp L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Temp\~DFB712.tmp L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\NTUSER.DAT L'objet est verrouillé ignoré

    C:\Documents and Settings\dragon\ntuser.dat.LOG L'objet est verrouillé ignoré

    C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

    C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré

    C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

    C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré

    C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\BWDocMap.pht L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\BWInfopakMap.pht L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\chandir.dat L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\chandir.idx L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\chn.dat L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\chn.idx L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\D0000000.FCS L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\inuse.txt L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\L0000001.FCS L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\main.log L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs.dat L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs.idx L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs_die.dat L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs_die.idx L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs_dnd.dat L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs_dnd.idx L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs_ext.dat L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs_ext.idx L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs_rcv.dat L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\prs_rcv.idx L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\storydb.dat L'objet est verrouillé ignoré

    C:\Program Files\Logitech\Desktop Messenger\8876480\Users\dragon\Data\storydb.idx L'objet est verrouillé ignoré

    C:\Program Files\Softwin\BitDefender9\asdict.dat L'objet est verrouillé ignoré

    C:\Program Files\Softwin\BitDefender9\aspdict.dat L'objet est verrouillé ignoré

    C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

    C:\System Volume Information\_restore{736304A0-649E-48E1-97E0-6B27AE5DB4A5}\RP3\change.log L'objet est verrouillé ignoré

    C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

    C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré

    C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

    C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

    C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré

    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré

    C:\WINDOWS\Temp\tmp000051b6\tmp00000000 L'objet est verrouillé ignoré

    C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

    Analyse terminée.
    0
  12. Utilisateur anonyme
     
    ça semble propre où en est ton problème ?
    0
  13. JEFFF78370
     
    bin mon probleme c est qu il me trouve toujours le trojan citer et l ouverture et le surf sur le net sont horrible
    0
  14. Utilisateur anonyme
     
    Que se passe t'-il lors de ton surf sur le net ? !

    J'ai zappé une bestiole !
    ----------

    Télécharge SDFix sur ton bureau
    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
    Redémarre ton ordinateur en mode sans échec (redemarrage + tapotte sans arret sur F8 des que l'ordi s'allume)
    Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script.
    Appuie sur Y pour commencer le processus de nettoyage.
    Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
    Appuie sur une touche pour redémarrer le PC.
    Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
    Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
    Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
    Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.

    Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum.

    ¤¤ Effectue de nouveau un nettoyage avec CCleaner (en mode sans échec de préférence !)

    ¤ Clic sur démarrer, rechercher, tous les fichiers et dossiers, cherche et supprime si présent :

    - temp.wsf
    - 14125929733.tmp
    - IeHelperEx.dll (C:/WINDOWS/system/)

    **Si un fichier/dossier persiste lors de la suppression fait ceci:
    - Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu..
    Puis va supprimer les fichiers/dossiers, vide ta corbeille et redémarre ton PC normalement.

    ¤ Télécharge et double-clic sur ce fichier et accepte la fusion au registre ça servira pour supprimer des traces laissès par l'infection
    ---> https://www.cjoint.com/?gubuPEsOsE
    0
  15. JEFFF78370
     
    bonjours voila le rapport

    SDFix: Version 1.88

    Run by dragon on mer. 20/06/2007 at 15:25

    Microsoft Windows XP [version 5.1.2600]

    Running From: C:\DOCUME~1\dragon\Bureau\SDFix

    Safe Mode:
    Checking Services:

    Name:
    Microsoft Agent
    Microsoft Agent

    ImagePath:

    Microsoft Agent - Deleted

    Restoring Windows Registry Values
    Restoring Windows Default Hosts File
    Restoring Missing Security Center Service
    Restoring Missing SharedAccess Service
    Restoring Missing Security Center Service
    Restoring Missing SharedAccess Service

    Rebooting...

    Normal Mode:
    Checking Files:

    Below files will be copied to Backups folder then removed:

    C:\WINDOWS\system32\install.exe - Deleted

    Removing Temp Files...

    ADS Check:

    Checking C:\WINDOWS
    C:\WINDOWS
    No streams found.

    Checking C:\WINDOWS\system32
    C:\WINDOWS\system32
    No streams found.

    Checking C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    No streams found.

    Checking C:\WINDOWS\system32\ntoskrnl.exe
    C:\WINDOWS\system32\ntoskrnl.exe
    No streams found.

    Final Check:

    Remaining Services:
    ------------------

    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\\Valve\\Steam\\steamapps\\polak78370\\counter-strike\\hl.exe"="C:\\Valve\\Steam\\steamapps\\polak78370\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
    "C:\\Valve\\Steam\\steamapps\\polak78370\\condition zero\\hl.exe"="C:\\Valve\\Steam\\steamapps\\polak78370\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Disabled:Logitech Desktop Messenger"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"

    Remaining Files:
    ---------------

    Backups Folder: - C:\DOCUME~1\dragon\Bureau\SDFix\backups\backups.zip

    Listing Files with Hidden Attributes:

    C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp

    Listing User Accounts:

    Administrateur dragon HelpAssistant
    Invit‚ SUPPORT_388945a0
    La commande s'est termin‚e correctement.

    Finished
    0
  16. Utilisateur anonyme
     
    Tu peux jeter SDFix

    Cic sur démarrer, rechercher, cherche et supprime si présent :

    - Tilehome.com

    ¤ ¤ Télécharge ce programme puis double clic dessus (ferme ton antivirus s'il te détecte quoi que ce soit)
    http://www.suspectfile.com/systemscan/

    * Coche uniquement ces cases, décoche tout le reste :

    - Recent Files, 30 days
    - Hidden objects
    - suspucious files

    Puis clic sur scan now, soit patient.
    Une fois qu'il aura terminé, un rapport va s'ouvrir, copie et colle son contenu ici et vérifie qu'il soit bien en entier, si besoin crée deux messages.
    0
  17. JEFFF78370
     
    SystemScan - www.suspectfile.com - ver. 3.1.2

    Running on: Windows XP PROFESSIONAL Edition, Service Pack 2 (2600.5.1)
    System directory: C:\WINDOWS

    Date: 20/06/2007
    Time: 20:30:40

    Output limited to:
    -Recent files
    -Hidden objects
    -Suspicious Files

    ===================== Recent files (30 days old)=====================

    ----- recent files in C:\
    25/05/2007 16:26:08 201 byte 26 days old -- INSTALL.LOG
    13/06/2007 00:21:53 47564 byte 7 days old -- NTDETECT.COM
    13/06/2007 00:21:53 251712 byte 7 days old -- ntldr
    13/06/2007 00:36:30 212 byte 7 days old -- boot.ini
    15/06/2007 18:17:51 7693 byte 5 days old -- hph7150.log
    16/06/2007 13:24:15 (DIR) 0 byte 4 days old -- 26e7fbc620155a361ccac4c416bdfe
    16/06/2007 13:24:49 (DIR) 0 byte 4 days old -- 21d6bdbb9d6a5b467a16
    18/06/2007 19:12:09 (DIR) 0 byte 2 days old -- !KillBox
    18/06/2007 19:54:31 1952 byte 2 days old -- rapport.txt
    18/06/2007 20:00:41 1413 byte 2 days old -- cleannavi.txt
    18/06/2007 21:39:32 (DIR) 0 byte 2 days old -- Deckard
    18/06/2007 21:39:36 (DIR) 0 byte 2 days old -- System Volume Information
    19/06/2007 21:25:05 (DIR) 0 byte 1 days old -- Program Files
    20/06/2007 15:46:20 (DIR) 0 byte 0 days old -- RECYCLER
    20/06/2007 15:51:02 (DIR) 0 byte 0 days old -- WINDOWS
    20/06/2007 15:54:57 (DIR)536870912 byte 0 days old -- pagefile.sys
    20/06/2007 20:30:40 (DIR) 0 byte 0 days old -- suspectfile

    ----- recent files in C:\WINDOWS\
    24/05/2007 21:12:41 (DIR) 0 byte 27 days old -- Sun
    28/05/2007 19:03:02 6121 byte 23 days old -- Ascd_tmp.ini
    29/05/2007 14:13:01 1176 byte 22 days old -- ImpTableL.bin
    29/05/2007 22:37:59 386 byte 22 days old -- 3DBELOTE2.INI
    05/06/2007 15:56:16 (DIR) 0 byte 15 days old -- nview
    08/06/2007 16:54:08 (DIR) 0 byte 12 days old -- CSC
    12/06/2007 23:02:58 (DIR) 0 byte 8 days old -- BDOSCAN8
    13/06/2007 00:19:07 (DIR) 0 byte 7 days old -- $NtServicePackUninstall$
    13/06/2007 00:22:19 (DIR) 0 byte 7 days old -- Web
    13/06/2007 00:25:31 (DIR) 0 byte 7 days old -- system
    13/06/2007 00:26:36 (DIR) 0 byte 7 days old -- srchasst
    13/06/2007 00:26:40 (DIR) 0 byte 7 days old -- msagent
    13/06/2007 00:27:15 (DIR) 0 byte 7 days old -- ServicePackFiles
    13/06/2007 00:34:00 (DIR) 0 byte 7 days old -- Media
    13/06/2007 00:34:00 (DIR) 0 byte 7 days old -- provisioning
    13/06/2007 00:34:05 (DIR) 0 byte 7 days old -- PeerNet
    13/06/2007 00:34:56 (DIR) 0 byte 7 days old -- ime
    13/06/2007 00:35:00 (DIR) 0 byte 7 days old -- EHome
    13/06/2007 00:35:07 (DIR) 0 byte 7 days old -- WinSxS
    13/06/2007 00:46:43 (DIR) 0 byte 7 days old -- Fonts
    13/06/2007 15:46:04 (DIR) 0 byte 7 days old -- security
    16/06/2007 13:24:07 (DIR) 0 byte 4 days old -- $NtUninstallWudf01000$
    16/06/2007 13:24:37 (DIR) 0 byte 4 days old -- $NtUninstallWMFDist11$
    16/06/2007 13:24:46 316640 byte 4 days old -- WMSysPr9.prx
    16/06/2007 13:25:41 (DIR) 0 byte 4 days old -- $NtUninstallMSCompPackV1$
    16/06/2007 13:25:50 (DIR) 0 byte 4 days old -- $NtUninstallKB926239$
    17/06/2007 20:27:38 (DIR) 0 byte 3 days old -- AppPatch
    17/06/2007 22:15:09 (DIR) 0 byte 3 days old -- Installer
    17/06/2007 22:16:09 (DIR) 0 byte 3 days old -- Help
    17/06/2007 22:18:34 733 byte 3 days old -- win.ini
    18/06/2007 19:32:07 342 byte 2 days old -- msnfix.txt
    18/06/2007 21:32:16 (DIR) 0 byte 2 days old -- Minidump
    18/06/2007 21:32:23 (DIR) 0 byte 2 days old -- Debug
    18/06/2007 21:39:41 (DIR) 0 byte 2 days old -- ERDNT
    18/06/2007 23:01:28 118784 byte 2 days old -- bwUnin-7.2.0.137-8876480SL.exe
    19/06/2007 01:51:27 129 byte 1 days old -- winamp.ini
    19/06/2007 21:46:18 (DIR) 0 byte 1 days old -- inf
    19/06/2007 21:46:19 (DIR) 0 byte 1 days old -- Downloaded Program Files
    20/06/2007 15:55:04 2048 byte 0 days old -- bootstat.dat
    20/06/2007 15:55:29 5286 byte 0 days old -- WindowsUpdate.log
    20/06/2007 15:55:45 0 byte 0 days old -- 0.log
    20/06/2007 20:14:11 (DIR) 0 byte 0 days old -- system32
    20/06/2007 20:14:33 (DIR) 0 byte 0 days old -- Temp

    ----- recent files in C:\WINDOWS\Downloaded Program Files\
    23/05/2007 19:18:43 (DIR) 0 byte 28 days old -- DinerDash.1.0.0.80

    ----- recent files in C:\WINDOWS\system\
    29/05/2007 14:29:11 327 byte 22 days old -- cmicnfg.ini

    ----- recent files in C:\WINDOWS\system32\
    24/05/2007 21:11:32 4136 byte 27 days old -- jupdate-1.6.0_01-b06.log
    25/05/2007 16:11:46 (DIR) 0 byte 26 days old -- FlashAX
    25/05/2007 16:27:10 (DIR) 0 byte 26 days old -- FlashAX2
    05/06/2007 15:53:40 (DIR) 0 byte 15 days old -- DirectX
    08/06/2007 13:59:22 12067 byte 12 days old -- SIntf16.dll
    08/06/2007 13:59:22 21840 byte 12 days old -- SIntfNT.dll
    08/06/2007 13:59:22 17212 byte 12 days old -- SIntf32.dll
    13/06/2007 00:03:52 (DIR) 0 byte 7 days old -- appmgmt
    13/06/2007 00:20:26 (DIR) 0 byte 7 days old -- ReinstallBackups
    13/06/2007 00:25:34 (DIR) 0 byte 7 days old -- usmt
    13/06/2007 00:26:28 (DIR) 0 byte 7 days old -- Com
    13/06/2007 00:26:40 (DIR) 0 byte 7 days old -- npp
    13/06/2007 00:34:11 (DIR) 0 byte 7 days old -- oobe
    13/06/2007 00:34:57 (DIR) 0 byte 7 days old -- inetsrv
    13/06/2007 00:34:59 (DIR) 0 byte 7 days old -- Setup
    13/06/2007 00:44:16 (DIR) 0 byte 7 days old -- CatRoot
    13/06/2007 00:46:46 189792 byte 7 days old -- FNTCACHE.DAT
    13/06/2007 00:47:18 247 byte 7 days old -- spupdwxp.log
    13/06/2007 00:47:21 (DIR) 0 byte 7 days old -- wbem
    13/06/2007 00:48:48 59556 byte 7 days old -- perfc009.dat
    13/06/2007 00:48:48 1000454 byte 7 days old -- PerfStringBackup.INI
    13/06/2007 00:48:49 461364 byte 7 days old -- perfh00C.dat
    13/06/2007 00:48:49 395508 byte 7 days old -- perfh009.dat
    13/06/2007 00:48:49 72274 byte 7 days old -- perfc00C.dat
    15/06/2007 19:34:57 43520 byte 5 days old -- CmdLineExt03.dll
    16/06/2007 13:24:11 (DIR) 0 byte 4 days old -- LogFiles
    17/06/2007 22:01:39 2206 byte 3 days old -- wpa.dbl
    17/06/2007 22:18:12 23392 byte 3 days old -- nscompat.tlb
    17/06/2007 22:18:12 16832 byte 3 days old -- amcompat.tlb
    18/06/2007 19:54:13 3524 byte 2 days old -- tmp.reg
    18/06/2007 19:54:13 0 byte 2 days old -- tmp.txt
    18/06/2007 21:39:36 (DIR) 0 byte 2 days old -- Restore
    18/06/2007 23:00:56 (DIR) 0 byte 2 days old -- dllcache
    18/06/2007 23:01:01 (DIR) 0 byte 2 days old -- drivers
    19/06/2007 21:46:18 (DIR) 0 byte 1 days old -- Kaspersky Lab
    20/06/2007 15:54:02 3888 byte 0 days old -- BMXCtrlState-{00000001-00000000-0000000A-00001102-00000002-80651102}.rfx
    20/06/2007 15:54:02 3888 byte 0 days old -- BMXBkpCtrlState-{00000001-00000000-0000000A-00001102-00000002-80651102}.rfx
    20/06/2007 15:55:48 17555 byte 0 days old -- nvapps.xml
    20/06/2007 16:16:30 (DIR) 0 byte 0 days old -- CatRoot2
    20/06/2007 20:14:11 14 byte 0 days old -- getfile.dat
    20/06/2007 20:29:40 81984 byte 0 days old -- bdod.bin

    ----- recent files in C:\WINDOWS\system32\drivers\
    30/05/2007 14:10:42 10872 byte 21 days old -- AvgAsCln.sys
    05/06/2007 20:16:21 76560 byte 15 days old -- tmcomm.sys
    16/06/2007 13:24:43 (DIR) 0 byte 4 days old -- UMDF
    20/06/2007 15:25:53 (DIR) 0 byte 0 days old -- etc

    ----- recent files in C:\WINDOWS\temp\
    20/06/2007 20:24:56 (DIR) 0 byte 0 days old -- tmp000039b1

    ----- recent files in C:\Program Files\
    24/05/2007 21:11:32 (DIR) 0 byte 27 days old -- Java
    24/05/2007 21:56:35 (DIR) 0 byte 27 days old -- PyGrenouille
    25/05/2007 16:27:12 (DIR) 0 byte 26 days old -- Casino Classic Flash Casino
    25/05/2007 22:47:29 (DIR) 0 byte 26 days old -- Maketorrent 2
    29/05/2007 17:09:59 (DIR) 0 byte 22 days old -- QuickPar
    05/06/2007 19:57:03 (DIR) 0 byte 15 days old -- Softwin
    05/06/2007 20:03:44 461 byte 15 days old -- INSTALL.LOG
    13/06/2007 00:26:20 (DIR) 0 byte 7 days old -- Outlook Express
    13/06/2007 00:26:20 (DIR) 0 byte 7 days old -- Windows NT
    13/06/2007 00:26:33 (DIR) 0 byte 7 days old -- NetMeeting
    13/06/2007 00:34:03 (DIR) 0 byte 7 days old -- movie maker
    13/06/2007 00:35:02 (DIR) 0 byte 7 days old -- messenger
    13/06/2007 00:46:43 (DIR) 0 byte 7 days old -- Internet Explorer
    14/06/2007 00:36:21 (DIR) 0 byte 6 days old -- MSN Messenger
    17/06/2007 22:13:59 (DIR) 0 byte 3 days old -- 3DBELOTE
    17/06/2007 22:16:08 (DIR) 0 byte 3 days old -- Windows Media Connect 2
    17/06/2007 22:17:48 (DIR) 0 byte 3 days old -- Google
    17/06/2007 22:17:48 (DIR) 0 byte 3 days old -- windows media player
    18/06/2007 16:30:47 (DIR) 0 byte 2 days old -- Grisoft
    18/06/2007 17:12:29 (DIR) 0 byte 2 days old -- Spybot - Search & Destroy
    18/06/2007 21:20:34 (DIR) 0 byte 2 days old -- CCleaner
    18/06/2007 23:00:29 (DIR) 0 byte 2 days old -- Fichiers communs
    18/06/2007 23:01:17 (DIR) 0 byte 2 days old -- Logitech
    18/06/2007 23:02:14 (DIR) 0 byte 2 days old -- MUSICMATCH
    18/06/2007 23:02:15 (DIR) 0 byte 2 days old -- InstallShield Installation Information
    19/06/2007 21:24:54 (DIR) 0 byte 1 days old -- Navilog1
    19/06/2007 21:30:42 (DIR) 0 byte 1 days old -- Lavasoft

    ----- recent files in C:\Program Files\Fichiers communs\
    24/05/2007 21:09:33 (DIR) 0 byte 27 days old -- Java
    05/06/2007 19:57:04 (DIR) 0 byte 15 days old -- Softwin
    13/06/2007 00:26:08 (DIR) 0 byte 7 days old -- System
    18/06/2007 23:00:30 (DIR) 0 byte 2 days old -- Logitech

    ===================== Hidden Objects =====================

    SCAN ABORTED: an unknown error has occurred. Please check Rootkit presence with another tool

    ===================== Checking Rustock rootkit =====================

    ===================== Checking Suspicious files =====================
    (Unusually Runtime packers compressed exe and dll files in C:\, %windir%\, %windir%\system32\

    -This file is compressed with UPX C:\WINDOWS\TSC.EXE
    -This file is compressed with UPX C:\WINDOWS\VSAPI32.DLL
    -This file is compressed with UPX C:\WINDOWS\System32\SRCHSTS.EXE
    -This file is compressed with UPX C:\WINDOWS\System32\SWREG.EXE
    -This file is compressed with UPX C:\WINDOWS\System32\SWSC.EXE
    -This file is compressed with UPX C:\WINDOWS\System32\SWXCACLS.EXE
    -This file is compressed with Upack C:\WINDOWS\System32\IFMON.DLL

    ==========================================
    Scan completed in 7,2 minutes
    End of report
    0
  18. Utilisateur anonyme
     
    Télécharge OTMoveIt sur ton bureau
    http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

    Double clic sur OTMoveIt.exe
    Sélectionne et copie les lignes ci-dessous

    C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe
    C:\cleannavi.txt
    C:\Deckard
    C:\rapport.txt
    C:\!KillBox

    Retourne dans OTMoveit, fais un clic droit dans la fenêtre "Paste List of Files/Folders to be moved" et choisis "coller".
    Clic sur le boutton rouge Moveit et ferme OTMoveIt
    Si un fichier ou un dossier ne peut être déplacer immédiatement il te sera demander de redémarrer ta machine pour finir l'exécution, si c'est le cas, clic sur "Yes"
    Copie et colle le rapport qu'il va te générer ici stp. Le rapport d'OTMoveit se trouve dans ce dossier : C:\_OTMoveIt\MovedFiles et ensuite supprime le dossier C:\_OTMoveit

    Puis dis moi comment se comporte ton PC ;-)
    0
  19. JEFFF78370
     
    C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe moved successfully.
    C:\cleannavi.txt moved successfully.
    C:\Deckard\System Scanner\20070618215256 moved successfully.
    C:\Deckard\System Scanner\20070618214751\backup\WINDOWS\temp\tmp000058a7 moved successfully.
    C:\Deckard\System Scanner\20070618214751\backup\WINDOWS\temp moved successfully.
    C:\Deckard\System Scanner\20070618214751\backup\WINDOWS\Downloaded Program Files moved successfully.
    C:\Deckard\System Scanner\20070618214751\backup\WINDOWS moved successfully.
    C:\Deckard\System Scanner\20070618214751\backup moved successfully.
    C:\Deckard\System Scanner\20070618214751 moved successfully.
    C:\Deckard\System Scanner moved successfully.
    C:\Deckard moved successfully.
    C:\rapport.txt moved successfully.
    C:\!KillBox\Logs moved successfully.
    C:\!KillBox moved successfully.

    Created on 06/20/2007 23:54:54
    0
  20. JEFFF78370
     
    bonsoir je ne sais pas si c est l heure tardif mais tous semble marcher correctement merci a toi ;-)
    0
  21. Utilisateur anonyme
     
    Ok, c'est cool ;-)

    N'hésite pas en cas de problème !

    Bon surf ! ++
    0
  • 1
  • 2

Discussions similaires

Aide pour un virus
cerise92700 -
MisteryBean -

41 réponses
Trojan impossible à supprimer!
Gridouu -
Malekal_morte- -

12 réponses
Comment supprimer le virus Trojan
vitsou -
vitsou -

18 réponses
Menace détectée TrojanSMS-PA sur Google Huawei/Android
Outmost -
bazfile -

6 réponses
Que pensez-vous de Trojan Remover ?
patmoss -
DOUBLON -

10 réponses